Diylisis Protocol
Certify an existing substrate record's portability for a declared recipient role through deictic, grounding, relevance, provenance, and comprehension closure, resolving portability residue in place so a fresh zero-memory consumer can execute from the record itself. Type: (ContextTethered, AI, DISTILL, StableRef) → Certificate.
Definition
Diylisis (διύλισις: refining, distillation): A dialogical act of certifying an existing, substrate-owned record — a Task description, a commit message, a delegation prompt, a durable document — against the portability a declared recipient role needs, repairing what can be repaired in place and surfacing what cannot. The protocol's lexical verb is /distill. The author session declares a certification contract naming the target record and the recipient's role, normalizes each session-local pointer (deixis) within the target to a canonical reference, audits each item for self-containment, judges each item's role-relevance and transformation-provenance, forms a route-judgment per relevant item (a reference the recipient dereferences with its own tools, or a value carried inline), releases dropped content from the record itself (excision, preserved session-side with its reason), gates the result against a zero-memory comprehension standard via an always-on refuter, loops a bounded repair pass — resolution additions and drop-excisions applied in place as they settle — until the hygiene measure reaches its fixed point, and produces a Certificate: the judgments plus an outcome — already portable, or repaired with the applied deltas named. A mandatory reception procedure — role declaration, the contract's granted sources, verification commands, execution scope, and stop condition, dereference steps the receiver runs with its own tools, and the premise list of decisions the receiver reconfirms — leads whatever session text the user carries downstream.
── FLOW ──
Diylisis(target: StableRef, boundary: Role, activity?, activation_verb?) → Detect(target) → tethered? → -- Detect dereferences target through its substrate's read channel (file Read, or an externally-owned record's host CLI/API read); a target no available channel can read Stops here — re-declare a readable locator, never certify an unread copy
¬tethered ∧ Layer 2 (AI-detected): → deactivate (silent — no residue found and no explicit invocation to honor)
¬tethered ∧ Layer 1 (explicit /distill), or tethered: pass_n=1, residuals = ∅, loop: -- an explicit invocation always runs the full certification: the clean Detect scan is relay evidence carried into the run, never an exit — the AlreadyPortable Certificate rests on a real refuter Pass
F0 declare(target, boundary, allowed_sources, activity?, verification, stop, certificate_target?) → contract -- boundary is an open, user-declared Role (no protocol-owned enum); certificate_target defaults to the session scratchpad; Λ.activation_edge = { activation_verb? (default minimal), locator: ref target } is constructed here — target (an existing record), not a to-be-created file, is what the edge hands the recipient — the F5 fourth input exists from Phase 0
bind Λ.constituting_utterance; Λ.contract_provenance = mark(contract, Λ.constituting_utterance) -- per-field provenance against the user's own words (activity, execution_scope, stop_condition, allowed_sources); the F5 fifth input exists from Phase 0
guard has_authored_delta(Λ.contract_provenance) → Constitution(Confirm | Correct) → Λ.cp_answer, contract -- F0 contract-provenance guard (Rule 29): any ai_authored field presents the user↔contract delta for confirm-or-correct before Phase 1; no delta ⇒ relay, no gate
guard ¬competence_substitution(contract, Null, Null) -- F0 competence-substitution guard (Rule 27): a judgment-bearing activity must either leave method to the recipient or name a verified operative artifact; a trip Stops — surface the misfit witness + a proposed recipient-owned-method re-declaration, re-declare before Phase 1
F1 scan(target, deixis) → normalize(surface_token → canonical_ref, confidence, unresolved?) → SubstTable -- scans the TARGET's own content, not a session working context; also binds each decision-shaped item to a DecisionRecord{claim, ledger_ref?} (Rule 33)
|unresolved tokens| > 0: append to residuals (reason: unresolved)
F2 audit(item, self_containment) → classify(inline | stable-pointer | routed-residual) -- no silent residual; a stable-pointer's locator must resolve without the author session AND remain dereferenceable and re-verifiable at reception time (Rule 21)
F3a relevance(item, contract.activity, boundary) → keep_candidate? -- F0 contract predicate, judged against the declared activity (if any) and the recipient role
F3b provenance(item) → Provenance →
durable observable source + support-integrity: → ObservedKeep → KEEP | ROUTE by grounding class -- common-case relay, no Gate: an Inline-grounded item → KEEP(its inline evidence); a StablePointer-grounded item → ROUTE(its stable ref) — same relay authority, and the constructor type-matches F4 (Value needs inline evidence, Reference needs a stable ref)
else (no observable basis): → Unknown → Constitution(ASK) -- KEEP hard line: no KEEP without a durable observable basis (the only other reachable disposition is a user Resolve at the Gate)
F3 disposition(item) ← Disposition: KEEP(inline) | ROUTE(StableRef) | DROP -- UNCHANGED 3-way coproduct; KEEP from an Inline-grounded ObservedKeep; ROUTE from a StablePointer-grounded ObservedKeep, F3a relevance, or the Gate; DROP from F3a relevance or the Gate; Unknown ∨ conflict → Gate; a DROP-candidate whose discriminating content is target-resident (discriminating(d) ≠ ∅) is excision-pending — it enters gate_domain and only a Gate-settled Drop lands its excision delta (deleting target text is the user's judgment, never relay); a DROP with nothing excisable (discriminating(d) = ∅) settles autonomously — the fresh recipient inherits kept and routed content only
F4 compress(kept ∪ routed) → judgments(Λ) = { RouteJudgment(item, verdict, basis) : item ∈ kept ∪ routed } -- Rule 30: verdict = Value(inline_evidence) for a KEEP item, Reference(stable_ref) for a ROUTE item; basis per constructor = F3b-cited observable source or Gate Resolve (Value), F3b source, Gate Route answer, or the F3a relevance premise + resolves_at check (Reference); a DROP'd item carries no RouteJudgment (excluded, same as before)
F5 comprehension_gate(target, judgments, contract, watchlist, activation_edge, constituting_utterance, reception_premises, cp_record) → zero_memory_verdict → -- ALWAYS-ON refuter (every certification pass, no optional layer — Rule 9), re-anchored around attacking RouteJudgment bases and the certificate's standing rather than a candidate handoff's prose; reception-procedure sufficiency is checklist category 6 — the prose-only deletion test (Change C): ignoring every agent-specific affordance, the declared activity MUST still execute from target's own certified content + judgments' inlined values + the dereference step each Reference-verdict judgment implies + allowed_sources ALONE, else Fail; Λ.reception_premises rides as a scoped comparison input — read as the premise list the receiver will reconfirm, so an already-premised claim is not re-Failed
[backstop, after Findings typed into EvidencedFindings, before residual insert] competence_substitution(contract, judgments, zero_memory_verdict) — UNCHANGED (Rule 27): terminates without a Certificate, hands a recipient-owned-method contract to a fresh invocation
[backstop, same site] contract_misfit(contract, Λ.constituting_utterance, Λ.cp_answer, zero_memory_verdict) — UNCHANGED (Rule 29): terminates without a Certificate, hands a re-declared contract to a fresh invocation
Fail(blocking_items, sweep, realization): parse each verdict Findings row → EvidencedFinding →
claim_repair(f): → append (deduplicated by claim) to Λ.reception_premises as a DecisionRecord (claim + ledger_ref pointer) — NOT a residual, NOT a repair-loop entry; surfaced in the emitted reception procedure (Rule 31) and conveyed to the next pass's refuter as a scoped premise input, never silently carried and never re-Failed once premised
¬claim_repair(f) ∧ (f.quoted_token, f.location) ∈ Λ.repaired_targets: → append to residuals (reason: comprehension-gap, evidence kept), block fixed_point -- same-target recurrence (Rule 31): repair stops for this target, surfaces at the existing Gate instead
¬claim_repair(f) ∧ (f.quoted_token, f.location) ∉ Λ.repaired_targets: → resolution repair, routed by the finding's repair site (the object the repair must change, never the finding's phrasing — Rule 31): a target-resident defect → its RepairDelta applied to target in place at this pass's repair step, appended to Λ.repair_deltas, (token, location) appended to Λ.repaired_targets; a judgment-basis defect (a basis that does not support its verdict) → the F6 basis leg (the judgment enters missing_bases via unsupporting(j)) — the basis is re-derived at next pass's F4, target gaining a Resolution delta only when the basis lacks supporting evidence in it, and (f.quoted_token, f.location) appended to Λ.repaired_targets so a recurring category-7 finding on the same judgment blocks as recurrence and surfaces at Qd rather than re-deriving indefinitely; an activation-edge defect (category 8) → re-form the edge declaration in place under the F0 content-free discipline (correction surfaced as relay; the next pass's F5 reviews the re-formed edge); a contract-declared-field defect (a source grant, scope, or stop condition) → the Rule 29 backstop when its category-10 provenance test fires, else the ResidualLedger (reason: certification-leg) surfacing at Qd — a Resolve re-declares the field value on the user's authority, Drop/Defer per their semantics; never a target delta; re-enter F1 next pass (Rule 25 discipline extended, no counter — Rule 31)
Pass(sweep, realization): no new residual (sweep absent → no verdict, re-dispatch)
gate_domain = disposition conflicts ∪ unknown-provenance ∪ unresolved residuals ∪ recurrence-blocked findings ∪ excision-pending drops ∪ certification-leg residuals ∪ exposure residuals, ledger-backed members with deferred = false -- a Qd Defer marks its ledger entry deferred (annotated, premise-bound, not re-presented); excision-pending drops and disposition conflicts stay re-presentable — an accepted-but-unapplied excision still blocks leak_free
[gate_domain ≠ ∅] Gate Qd(gate_domain) → Stop → A -- Constitution surfacing (both verdicts; residuals incl. comprehension-gap and recurrence-blocked); A UNCHANGED, never touched by Qp
[gate_domain = ∅] A := None (identity — clean pass: every item uncontestedly disposed, no unresolved residual, F5 Pass with no findings)
F6 loop: measure(unresolved anchors, stop, residual, leaked drops, undisposed authored, missing bases, unresolvable route pointers, ledger-less decisions) → fixed_point? -- deterministic emit-side checks fold into these measure legs (Rule 30/33): a missing or verdict-unsupporting RouteJudgment basis (the F5 judgment-basis repair route lands here), a Reference verdict whose locator fails resolves_at, or a DecisionRecord with no ledger_ref each increment the measure and repair the same way any other leg does — mechanical, no dispatch, executed on the ¬fixed_point re-entry at each leg's repair site (bases re-derived and locators relocated at the next pass's F4 — inlining re-disposes, a Gate act — a ledgerless decision's found pointer as a Resolution delta at that pass's repair step); a leg whose mechanical repair fails enters the ResidualLedger (reason: certification-leg) and surfaces at the Gate like any other residual; the exposure scan (exposed_drops) reads the dereference-reachable contents of Reference locators and granted sources for dropped items' discriminating tokens — detection-only: a hit enters the ResidualLedger (reason: exposure) and surfaces at Qd, never a leak_free conjunct (the exposing record is substrate-owned, outside the certification's write authority)
¬fixed_point: pass_n += 1, loop (one-pass + bounded audit/lint)
fixed_point: → Qp
Qp composite_premise_gate(Λ.outcome, contract.certificate_target, Λ.reception_premises) → Constitution(consumer_profile, authority_copy) → Λ.consumer_profile, Λ.authority_copy -- Rule 32: fires iff Λ.outcome = Repaired(_) ∨ contract.certificate_target ≠ Null ∨ Λ.reception_premises ≠ ∅ (something is actually being carried downstream or externalized — a repair, a named target, or premises riding the reception procedure); on a bare, premise-free AlreadyPortable session-scratchpad terminal it does not fire — gating every "already fine" run would re-introduce the gate storm the refounding removed
[Qp fired] → terminal check on an AuthoritativeAt answer (resolves_at + leak-clean rendered line; fail → re-present Qp) → F7 | [Qp did not fire] → F7 (Λ.consumer_profile, Λ.authority_copy left at session-default)
F7 certify(target, Λ.activation_edge, judgments, emit(Λ.outcome), reception_procedure) → Certificate → converge -- Certificate.outcome = emit(Λ.outcome), the EmittedDelta projection of the session-side outcome (AlreadyPortable iff Λ.repair_deltas = ∅); target already carries every delta, applied in place at the pass that classified it (Rule 12) — F7 performs no further edit to target, it certifies the current state — Λ.target_identity was bound at the terminal settle over the exact state the final Pass reviewed, and F7's lead action re-checks target against it (mismatch → ¬fixed_point re-entry over the mutated state — the changed content joins the next pass's F1–F3 domain with prior dispositions invalidated and the comprehension verdict cleared — never fingerprinting an unreviewed revision) — so the receiver detects a post-certification edit rather than trusting a stale label (Rule 24); the Certificate lands at contract.certificate_target (default: session scratchpad, dies with session) or an externally-named target; the reception procedure (role + the contract's granted sources, verification commands, execution scope, and stop condition + dereference steps + Λ.reception_premises) leads whatever session text the user carries downstream (DelegationBrief = session layer); an externalized/human-facing copy carries an emit-time stamp + a "reverification premised" mark + the inscribed authority-copy line ("derived copy, authoritative at X")
── MORPHISM ──
target: StableRef, boundary: Role, activity?, activation_verb?
→ declare(target, boundary, allowed_sources, activity?, verification, stop, certificate_target?) -- F0 HandoffContract; relevance and minimality undefined without it; Λ.activation_edge = { activation_verb? (default minimal), locator: ref target } is constructed here — the F5 fourth input exists from Phase 0; guarded by ¬competence_substitution (Rule 27); each judgment-bearing field marked user_stated | ai_authored against the constituting utterance, guarded by ¬has_authored_delta ∨ confirmed (Rule 29)
→ normalize(surface_token, canonical_ref, confidence) -- F1 deictic closure over target's own content: precedes grounding so each grounded item names a stable referent
→ audit(item, self_containment) → (inline | stable-pointer | routed-residual)-- F2 grounding closure: silent residual surfaced, never dropped unseen; a stable-pointer's locator must resolve without the author session AND remain dereferenceable and re-verifiable at reception time (Rule 21)
→ select(item, contract.activity, boundary) -- F3a recipient-relevance predicate against the declared contract
→ attest(item) → Provenance -- F3b read-only provenance; a durable observable source with support-integrity and no basis to dispute it yields ObservedKeep (disposed directly, no Gate — KEEP when Inline-grounded, ROUTE on its stable ref when pointer-grounded), every remaining state yields Unknown; provenance authority is the KEEP hard line only, never an inferred disposition
→ dispose(item) → Disposition -- F3 KEEP(inline) | ROUTE(StableRef) | DROP, unchanged
→ judge(kept, routed) → List(RouteJudgment) -- F4 constructs the certificate's judgment list; DROP is excluded, never a judgment
→ gate(target, judgments, contract, watchlist, activation_edge, constituting_utterance, reception_premises, cp_record) → zero_memory_verdict -- F5 always-on refute-posture comprehension, re-anchored around RouteJudgment bases; reception_premises is a scoped comparison input (an already-premised claim is not re-Failed); Fail re-enters blocking items per the claim/resolution/recurrence discriminator (Rule 31); a competence-substitution backstop trip (Rule 27) or a contract-provenance backstop trip (Rule 29) terminates the invocation instead — contract re-declaration, never a residual
→ settle(measure) → fixed_point -- F6 bounded audit/lint loop on the hygiene measure (incl. basis-presence, pointer-audit, and ledger-pointer legs); fixed_point requires a Pass verdict ∧ leak_free
→ premise_gate(outcome, certificate_target, reception_premises) → consumer_profile, authority_copy -- Qp, conditional (Rule 32): a repair, a named externalization target, or a non-empty premise list fires it
→ certify(target, Λ.activation_edge, judgments, emit(Λ.outcome), reception_procedure) → Certificate -- F7; target already repaired in place across passes (claim-preserving deltas only, Rule 12) — F7 edits nothing further; certificate lands at certificate_target or session scratchpad; DelegationBrief assembly is session-layer
→ Certificate
requires: context_tethered(target) ∨ explicit Layer-1 invocation -- runtime checkpoint (Phase 0): AI-detected (Layer 2) activation requires residue; an explicit /distill runs the full certification even on a clean scan
deficit: ContextTethered -- activation precondition (Layer 1/2)
preserves: source_chain(target) -- history preserves, target releases: substitution, grounding, provenance, and disposition annotate, never mutate; every mutation of target is a logged, claim-preserving RepairDelta — a resolution addition or a drop-excision, applied in place at the pass that classifies it — and dropped content survives with its reason in Λ.history (Rule 12)
invariant: Portability over Author Familiarity ∧ portable(target, boundary) -- Rule 30 restates this formally; the multi-record symptom (a reception procedure directing the recipient to also read an uncertified sibling) is a portability failure caught at F5
── TYPES ──
Role = String -- an OPEN, user-declared recipient/consumer role (e.g. "reviewer", "implementer"), captured at F0 as a sibling field of the activation edge; the protocol reads it as a premise for relevance judgment (F3a) but never normalizes it into a protocol-owned enum — no Role taxonomy is inscribed here
target: StableRef -- the existing, substrate-owned record under certification (a Task description, a commit message, a doc, a delegation prompt); an INPUT to Diylisis, never something F0 creates. items(target) below extracts its content for F1–F6
ContextItem = { content: String, origin: Origin, surface_tokens: Set(String), downstream: List(TaskRef) }
Origin ∈ {UserStatement, DocumentRead, ToolOutput, AIInference, PriorTask} ∪ Emergent(Origin)
items(target) = List(ContextItem) -- the content items read from target; unchanged shape from the prior WorkingContext.items, now sourced from an existing record rather than a live session's accumulated context window
recipient_profile? = Optional(RecipientProfile) -- defaults to { knowledge: "zero-memory" } when absent (the conservative absent-recipient default); orthogonal to Role — RecipientProfile fixes the zero-memory premise F5 stands in for, Role names WHO in that premise (a reviewer, an implementer)
activity? = Optional(String) -- declared at F0; generalizes the former required next_task — a certification pass need not point at a downstream task at all (e.g. "already portable, no action implied")
ConstitutingUtterance = List(String) -- the verbatim user turns that triggered this certification (the invoking utterance plus any prior turns that defined the task); bound at Phase 0 as Λ.constituting_utterance; the F0 provenance mark's comparison base and F5's fifth input (Rule 29). An empty list is valid (a Layer 2 AI-detected pass with no triggering utterance) and marks every tracked field ai_authored by default — the conservative direction
activation_verb? = Optional(String) -- the activation edge's verb, declared at invocation or F0; absent → the canonical minimal verb ("Read <locator> and execute it"). Never a contract field: the contract carries the noun (target, by reference), the edge carries the verb
Detect = target: StableRef → (Bool, tethered_items if true) -- F0 precheck for session-tethered residue WITHIN the target's own content
StableRef = { kind: "path" | "url" | "id" | "command", locator: String } -- a reference resolvable without the author session (the absent-recipient reading). Durability is not a stored field: it is decided at each use site by resolves_at(locator) — the test a StablePointer grounding applies
RecipientProfile = { knowledge: "zero-memory" } -- recipient isolation: no session access; every stable-pointer locator must resolve independently of the author session AND remain re-verifiable at reception time (Rule 21), unconditionally
resolves_at(locator) ≡ the locator's referent persists beyond the author session, is reachable by an absent recipient, and remains dereferenceable when the receiver re-checks it with its own tools at consume time
-- durable grounding: a temp/cache/scratch/session-only-rooted locator does not resolve (the author session's ephemeral tree is gone, or was author-private, by the time a fresh recipient reads it); a url/id/command locator does not resolve when its referent is session-local. A project-tracked path or an externally-durable reference (an issue, a PR, a released artifact) resolves. Primarily discriminates path locators
ActivationEdge = { verb: String; locator: StableRef } -- the minimal executable hand-over, a noun/verb split: the verb is declared at F0 (default: the canonical minimal verb "Read <locator> and execute it"); the locator is `target` BY REFERENCE, never re-declared — the noun lives once in the contract, the edge carries only the verb. Constructed at Phase 0 as Λ.activation_edge; F5 reviews it under the minimal admissible edge (checklist category 8); it hands the recipient the SAME target the certification judged, not a newly-emitted file
content_free(e) ≡ no discriminating token of the task content — the declared activity (contract.activity) or the target's items — appears in e.verb -- evaluable at the Phase 0 → Phase 1 guard. The emit-time complement is leak_free: the edge is an emit channel, so F6 lints it against the actually-emitted content. content_free binds the verb only: the locator's job is naming the artifact, and its content discipline is carried by leak_free and resolves_at
-- a summarizing edge is a second source of truth and will drift from the target
-- a Phase 0 → Phase 1 guard: a content-bearing verb is repaired at F0 (re-form the declaration, surface the correction as relay), never carried into Phase 1
InlineEvidence = { content: String } -- evidence carried inline rather than by reference
HandoffContract { recipient_profile: RecipientProfile; boundary: Role; activity: Option(String);
allowed_sources: List(StableRef); execution_scope: String; verification_commands: List(String);
stop_condition: String; certificate_target: Option(StableRef) }
-- F0 output; the contract every later phase reads for relevance and minimality. boundary is the open declared Role (framework declaration, not a task-content claim — untracked by Rule 29, same as recipient_profile). certificate_target is where F7 will land the Certificate when the user names one; Null defaults to the session scratchpad. Constraints, both checked at F0 and repaired there as relay (like a content_free violation): certificate_target ≠ target, a REFERENT-level test — the two references must resolve to distinct records, compared by canonicalized/dereferenced identity, never by reference string (a relative/absolute path alias or url/id alias of the same record violates; distinctness that cannot be established is treated as violating and repaired at F0 by naming a different destination) — landing the Certificate inside the record it certifies would mutate the certified state after the final Pass, voiding the label (Rule 24) — and the session must hold a write channel to certificate_target (resolvable is not writable; an unwritable destination discovered at F7 would leave the converged run no landing transition). Contract provenance (Rule 29) is NOT a HandoffContract field: Λ.contract_provenance marks activity/execution_scope/stop_condition/allowed_sources against Λ.constituting_utterance and stays session-side, so it never enters the Certificate or the leak-lint's emit domain
ContractField ∈ {activity, execution_scope, stop_condition, allowed_sources} ∪ Emergent(ContractField) -- the HandoffContract fields tracked for provenance (Rule 29): the fields where task/scope elevation shows up. recipient_profile, boundary, verification_commands, and certificate_target are framework declarations, not task-content claims, and stay untracked; Emergent(·) admits a field earning its own branch later (an open question, not yet settled: whether Role elevation — e.g. a silently upgraded consumer role — should itself become a tracked ContractField)
FieldProvenance ∈ {user_stated, ai_authored} -- user_stated: the field's content is traceable to the user's own words in the constituting utterance(s) or the session record (a faithful paraphrase counts); ai_authored: the authoring session's own framing beyond those words — elevating a parked observation into the primary task, expanding scope, creating or reviving a work item, reprioritizing
ContractProvenance = Map(ContractField, FieldProvenance) -- F0 per-field provenance mark, bound as Λ.contract_provenance alongside contract declaration; computed by mark(contract, constituting_utterance), never stored on the emitted contract
mark(contract, utterance) = ContractProvenance -- F0's marking function: per ContractField, user_stated when the field's content is traceable to utterance's own words (fair paraphrase counts), else ai_authored; utterance = ∅ marks every field ai_authored (conservative default, mirrors the empty-watchlist precedent, Rule 9)
cp_record = { provenance: ContractProvenance; answer: Option(Ac) } -- the contract-confirmation record, assembled from Λ.contract_provenance + Λ.cp_answer; F5's third scoped comparison input, conveyed to the refuter under the name contract_confirmation (category 10's second question reads it — an F0-ratified field is never re-failed)
has_authored_delta(p: ContractProvenance) ≡ ∃ field ∈ dom(p) : p[field] = ai_authored -- the Phase 0 gate-firing test (Rule 29): any authored delta present ⇒ present the Confirm/Correct gate; none ⇒ relay, no gate
Ac ∈ {Confirm, Correct(revised: Map(ContractField, String))} -- F0 contract-provenance Gate answer (Rule 29), a Gate coproduct distinct from A (F3) and Aq (Qp): Confirm ratifies the authored fields as declared (ai_authored stands, now user-confirmed); Correct supplies revised text in the user's own words per field, which re-enters contract declaration and re-marks that field user_stated
contract_misfit(contract, constituting_utterance, cp_answer?, verdict?) ≡
(has_authored_delta(mark(contract, constituting_utterance)) ∧ cp_answer = Null) -- F0 leg: an authored delta exists and the Phase 0 gate has not yet been answered (evaluable at the Phase 0 → Phase 1 guard)
∨ (verdict = Fail(B, _, _) ∧ ∃ f ∈ B : f.category = "contract-provenance-misfit") -- F5 backstop leg: the refuter, comparing the contract against constituting_utterance (checklist category 10), finds a delta the F0 gate's record does not show as confirmed
-- the guard against a contract that claims more task/scope than the user's own words authorized (Rule 29). Mirrors competence_substitution's two-leg shape and claim_repair's caller-side classification (Rule 31) — three parallel discriminators of the same shape reading the shape of an arriving finding, not its phrasing
SurfaceToken = String -- a session-local deictic token (undefined jargon, metric shorthand, "as above", a bare task id)
Substitution = { surface_token: SurfaceToken; canonical_ref: StableRef | InlineEvidence | Null;
confidence: Float; unresolved: Bool } -- F1 row; unresolved = true routes the token to the residual ledger
SubstTable = List(Substitution)
Grounding ∈ {Inline(InlineEvidence), StablePointer(StableRef), RoutedResidual(reason: String)} -- F2 per-item self-containment class; StablePointer requires resolves_at(locator) — a locator that does not resolve without the author session, or that a receiver could not re-verify at consume time (resolves_at = false), fails StablePointer classification. Repair: inline the evidence (Inline) or relocate the content to a locator that resolves independently of the session (a resolving StablePointer); when neither is possible in-session the item is RoutedResidual and appends to the residual ledger (reason: unresolved), surfaced at the Gate like any other unresolvable reference
observable_basis(item) ≡ durable_observable_source(item) ∧ support_integrity(item) -- BOTH conjuncts required (the outer ∧ binds the whole disjunction below to support_integrity, never just one branch)
durable_observable_source(item) ≡
( grounding(item) = Inline(e) ∧ origin(item) ∈ {DocumentRead, ToolOutput} ) -- directly-observed evidence carried inline (a file read, a command's captured output); an Inline(AIInference) is the AI's own assertion, not re-observable
∨ ( grounding(item) = StablePointer(r) ∧ resolves_at(r.locator) ) -- a reference the recipient resolves without the author session (a path, a PR/issue url, a stable id), re-observed independently of the item's session-origin
support_integrity(item) ≡ the kept value is recipient-verifiable: a contract verification_command re-runs it, a resolvable url/id re-fetches it, or the inline observed content directly evidences the claim. A present-but-support-unlinked item (current/fresh but the evidence does not track the claim) FAILS this conjunct (Currency ≠ Support-Integrity). When the basis is uncertain or contested (the observable source would conflict with the claimed value, or relevance to the claim is doubtful), support_integrity(item) = false — the conservative direction routes to the Gate rather than auto-KEEPing on a doubtful basis
provenance(item) = ObservedKeep if observable_basis(item) -- Change B: a durable observable basis with support-integrity → KEPT directly, no Gate (the common-case relay path that collapses the gate storm)
| Unknown otherwise (no observable basis — an AIInference, a bare in-session UserStatement, or a contested basis — reason: unknown-provenance)
Provenance ∈ {ObservedKeep, Unknown} -- F3b verdict, a binary partition. ObservedKeep (Change B): a durable directly-observable source coupled to the item by support-integrity — the relay path for ordinary technical state, disposed without the Gate: KEEP(e) when the item's F2 grounding is Inline(e), ROUTE(r) when StablePointer(r), so the F4 verdict constructor always type-matches its evidence. Unknown: every remaining state (no observable basis, or a contested basis), surfaced at the Gate. Provenance authority is the KEEP hard line only — ROUTE/DROP dispositions come from F3a relevance or the Gate, not from a provenance verdict; a correction-requiring claim (one that diverges from its observable source) surfaces at the Gate for a user Resolve
Disposition = KEEP(InlineEvidence) | ROUTE(StableRef) | DROP -- F3 3-way coproduct, UNCHANGED. Feeds RouteJudgment construction (Rule 30) but is not itself the certificate-level record
RouteJudgment = { item: ContextItem; verdict: Reference(StableRef) | Value(InlineEvidence); basis: String } -- Rule 30: the certificate-level record per KEPT or ROUTEd item. verdict = Reference(r) when disposition = ROUTE(r); verdict = Value(e) when disposition = KEEP(e). basis names the ground that reached the disposition, per constructor: a Value verdict cites its F3b observable source or the Gate's Resolve answer; a Reference verdict cites its F3b source, the Gate's Route answer (the user-supplied reference), or — for an F3a-relevance-routed item — the declared activity/boundary premise the route serves together with its locator's resolves_at check. Either way it is the field the refuter (F5) attacks: a basis that does not actually support its verdict is a category-7 finding
RepairDelta = { item: ContextItem; repair: Resolution(StableRef | InlineEvidence) | Excision(span: String); basis: String } -- Rules 12/31: applied to target in place at the repair step of the pass that classifies it, logged to Λ.repair_deltas. Resolution adds a definition, pointer, dereference command, or inline evidence beside an existing claim; Excision removes a DROP'd item's discriminating content (session bookkeeping the disposition released; span bounded by the same discriminating(d) precision test the leak lint uses; basis = the disposition that released it). Emission discipline: an Excision delta is EMITTED content-free via the EmittedDelta projection below — never the excised item, its content, or its span; the full delta stays session-side in Λ.repair_deltas/Λ.history — otherwise the Certificate itself would disclose what was dropped. Neither kind alters an asserted claim a KEPT or ROUTEd item carries — an excision whose span would touch kept-claim content routes to the Gate as a disposition conflict instead of applying
DecisionRecord = { claim: String; ledger_ref: Option(StableRef); deferral: Option(String) } -- Rule 33: deferral holds the Gate-Defer condition when a premise-origin entry — or any Qd-surfaced gate_domain entry the user answered Defer(condition), the answer binding a new DecisionRecord for the accepted gap — was deferred (deferred(d) ≡ d.deferral ≠ Null); it is rendered as the annotation on the emitted premise list, so the condition justifying the stall-exit convergence travels in the Certificate rather than dying with the session. a decision-shaped item within target, bound at F1. ledger_ref names the durable record (this project: the git record — commit messages, issue/PR bodies, and their comments, where this project's decision chains in fact live; admissibility is the resolves_at criterion — externally durable, dereferenceable — not a closed enum) where the decision's rationale lives; Null when no ledger pointer is yet attached (a ledger-less decision, an F6 measure leg — repair = attach the pointer, inscribed into target beside the decision claim as a Resolution delta so it travels with the record, or surface at the Gate when no pointer can be found)
ReceptionProcedure = { role: Role; granted_sources: List(StableRef); verification_commands: List(String); execution_scope: String; stop_condition: String; dereference_steps: List(String); premises: List(DecisionRecord) } -- Rule 31/W2: the mandatory lead section of whatever session text the user carries downstream. granted_sources, verification_commands, execution_scope, and stop_condition mirror their contract fields — the execution base the F5 deletion test judges against AND the declared frame (scope and acceptance criteria) the F5 verdict was judged under travel with the procedure, so the certified base and constraints coincide with what the receiver actually holds (a Pass earned against a source, scope, or stop condition the receiver never receives would certify an unexecutable handoff or one judged against hidden constraints). dereference_steps are commands/paths the RECEIVER runs with its own tools — leading with the target_identity re-check (compare target's current state against the Certificate's revision-fixed form or content digest — a digest comparison re-runs the named algorithm over the named snapshot boundary; mismatch → the label no longer applies, Rule 24) — to re-verify each Reference-verdict RouteJudgment at consume time (the receiver-side re-verification leg, owned by the receiver, not the author session); premises = Λ.reception_premises, the claim-repair findings relayed here rather than resolved in-loop — each premise is a surfaced, receiver-directed item, not a silent residual (Rule 6)
ConsumerProfile = { recipient_class: "human" | "agent"; substrate_access: Bool } -- Rule 32: captured at Qp; the common parameter of every RouteJudgment's downstream rendering (reference-vs-value mix follows the user's standing Externalization Publish Mode rule, realized one layer down — not modeled further in this formal block)
AuthorityCopy ∈ {Derived, AuthoritativeAt(location: StableRef)} -- Rule 32: captured at Qp; when the Certificate or its human-facing copy is externalized, this value is inscribed IN THE ARTIFACT ("derived copy, authoritative at X") rather than left as session-only metadata. Terminal check (post-Qp, pre-F7, mechanical): an AuthoritativeAt location must pass resolves_at, and the rendered authority-copy line must pass the same discriminating-content leak test as every emit channel — a failing answer re-presents Qp with the failure cited; this closes the one post-lint input F7's projection takes
Aq = (ConsumerProfile, AuthorityCopy) -- Qp's answer: a PRODUCT (both facets always answered together), not a coproduct like A or Ac — distinct from and never touching A_tag/A (Gate integrity, Rule 14)
claim_repair(f: EvidencedFinding) ≡ resolving f requires changing an asserted claim, premise, or decision's content — not merely supplying a definition, pointer, dereference command, or inline evidence beside an existing claim -- Rule 31's caller-side discriminator, parallel in shape to behavior_repair (Rule 27) and the category-10 contract-provenance test (Rule 29): the target of the repair, never the finding's phrasing, decides. ¬claim_repair(f) is a resolution_repair and stays in the F6 loop (subject to same-target recurrence); claim_repair(f) relays to Λ.reception_premises instead
EmittedDelta = Resolution(delta: RepairDelta) | ExcisionMark -- the emitted projection of a RepairDelta: emit(δ) = Resolution(δ) when δ.repair is a Resolution whose added content survives in target's current state (no later applied Excision covers it), else ExcisionMark — a bare content-free constructor carrying no item, content, or span. A Resolution superseded by a later applied excision squashes to ExcisionMark in the emitted projection — the full historical delta stays session-side in Λ.repair_deltas, so the emitted outcome never re-leaks excised content. The Certificate's outcome is typed over EmittedDelta so the content-free excision emission is well-typed, not an ill-typed truncation; Λ.repair_deltas keeps the full RepairDeltas session-side
gate_domain(Λ) = disposition conflicts ∪ unknown-provenance items ∪ unresolved residuals ∪ recurrence-blocked comprehension-gap findings ∪ excision-pending drops ∪ certification-leg residuals ∪ exposure residuals, ResidualLedger-backed members taken with deferred = false
-- the set Qd is defined over; a Qd Defer(condition) marks its ledger-backed entry deferred — user-constituted, annotated, carried by the stall exit, not re-presented (without this the gate-quiet terminal pass is unreachable: the same accepted gap would re-fire Qd forever). An excision-pending drop or disposition conflict is NOT deferral-excludable: an accepted-but-unapplied excision still blocks leak_free and a conflict still blocks fixed_point, so excluding them would trade re-presentation for a gateless livelock — they re-present until re-disposed or the run exits uncertified (Rule 12's unreachable-as-clean analysis); Qd fires only when gate_domain ≠ ∅ (a clean pass — every item uncontestedly disposed: an ObservedKeep KEEP or ROUTE (by grounding class), F3a ROUTE, or an F3a DROP with nothing excisable; F5 Pass with no findings — has an empty domain and no Gate to present). Excision-pending drops are DROP-candidates whose discriminating content is target-resident (discriminating(d) ≠ ∅): presented at Qd with the standard A options — Drop confirms the excision, Resolve/Route re-dispose, Defer per its semantics — so target text is deleted only on the user's judgment. Disposition conflicts include an excision whose span would touch kept-claim content (Rule 12); certification-leg residuals are the F6 legs whose mechanical repair failed (missing basis, unresolvable route pointer, ledger-less decision — Rules 30/33). claim_repair findings never enter gate_domain: they relay to Λ.reception_premises instead (surfaced there, not here)
Qd = Residual + disposition-conflict gate over gate_domain(Λ), conditional on gate_domain(Λ) ≠ ∅ [Tool: Constitution interaction]
A = Gate answer ∈ {None} ∪ {Resolve(canonical_ref), Route(StableRef), Drop, Defer(condition)}
-- Gate coproduct for surfaced residuals, unknown-provenance items, and disposition conflicts; presented intact (Rule 14). None is the identity answer when gate_domain = ∅ — not a user-facing option, never presented at Qd. A Defer(condition) answer, whatever the entry's origin, also binds a DecisionRecord carrying the accepted gap and its condition into Λ.reception_premises — the stall-exit annotation the Certificate transports (fixed_point comment; DecisionRecord.deferral)
A_tag ∈ {Resolve, Route, Drop, Defer} -- the constructors of A without their bound arguments; an advisory names the constructor only, and the Gate answer materializes it into a full A term (type-preserving materialization: the user binds the argument and decides at the Gate)
EvidencedFinding = { item: ContextItem; quoted_token: String; location: String; category: String; why_unresolvable: String; advisory: A_tag; repair_note: String } -- one F5 Fail finding: cited evidence (quoted token + location + category + why the recipient cannot resolve it), an advisory Gate disposition tag, and a prose repair note; the typed form of one Findings-table row in the refuter verdict. The refuter emits rows WITHOUT an item handle (it sees only target's content + judgments); the caller binds `item` at parse time by matching quoted_token + location — when no unique tracked item matches, the caller synthesizes a ContextItem from the finding (origin: AIInference) so the finding still enters residuals or Λ.reception_premises per claim_repair; unless the competence-substitution backstop (Rule 27) or the contract-provenance backstop (Rule 29) trips, when the finding routes to contract re-declaration instead; a Fail row is never dropped for binding failure
WatchList = Set(String) -- session-term watchlist, the third F5 input (recorded as Λ.watchlist), enumerated at dispatch from the author session's own record: skill/protocol names invoked this session ∪ subagent names dispatched ∪ tool names called ∪ plugin/skill names whose instructions are loaded in the session context. The enumeration reads the live session, never a directory scan of installed-but-unused plugins: the watchlist names what is ACTIVE in the session (and could therefore leak into the certificate as plain prose), not what is installed
zero_memory(recipient) removes session access, NOT competence -- the recipient's ordinary competence to choose, apply, adapt, and verify a method is intact; the F5 gate measures portability of content, never the recipient's engineering judgment (the mis-reading "zero-memory recipient ⇒ judgment-free executor" is the root of competence substitution)
judgment_bearing(t) ≡ completing task t requires choosing, creating, adapting, debugging, or deploying a mechanism whose correct behavior is not already fixed by an authoritative, independently re-verifiable artifact
recipient_owns_method(contract) ≡ contract.activity ∪ contract.execution_scope explicitly leave mechanism selection and implementation judgment to the recipient, while contract.verification_commands and contract.stop_condition define outcome acceptance
authoritative_primitive(p) ≡ p is a single exact command, config value, or API-shape token quoted as an authoritative primitive (Rule 27 admissible), not an assembled multi-step procedure -- a lone primitive is admissible evidence, never authored operative procedure
authored_procedure(p) ≡ p was written or assembled by the author session during this work (origin AIInference / Λ.authored), not an artifact independently existing in the target system ∧ ¬authoritative_primitive(p) -- a lone authoritative primitive stays admissible (Rule 27) even when the author wrote it down, so it never trips the artifact leg
operative(p, candidate, contract) ≡ candidate presents exact procedure p as ready to copy, run, or adopt, and satisfying contract.stop_condition depends on using p rather than inspecting it as evidence or independently choosing a mechanism
verified_operative(p, candidate, contract) ≡ p has (exact content identity ∨ a revision-fixed StableRef) ∧ resolves_at(ref(p)) ∧ candidate carries or routes observable verification evidence whose support_integrity covers the stated behavioral claim and environment ∧ contract.verification_commands replay that claim before adoption ∧ contract.stop_condition claims no more than that verification establishes ∧ candidate states that modification invalidates the verified status ("adopt unchanged" vs "reference/adapt") -- "the author ran it" alone is insufficient
contract_names_verified_operative(p, contract) ≡ p is named by a revision-fixed StableRef in contract.allowed_sources ∧ resolves_at(ref(p)) ∧ (∃ e ∈ contract.allowed_sources : e resolves to observable verification evidence whose support_integrity covers p's stated behavioral claim and environment) ∧ contract.verification_commands replay p's stated behavioral claim before adoption ∧ contract.stop_condition claims no more than that verification establishes ∧ contract states adopt-unchanged (modification invalidates the verified status) -- the F0-evaluable analogue of verified_operative: reads the CONTRACT (allowed_sources + verification_commands + stop_condition), NOT a candidate, so the "name a verified operative artifact" F0 escape is inhabitable at Phase 0 where candidate = Null. candidate-level verified_operative stays the F5 artifact-leg test
behavior_repair(f, p) ≡ resolving F5 finding f requires changing p's control flow, state, timing, concurrency, resource ownership, or failure behavior; supplying a missing fact, decision, StableRef, command, config value, or API shape is NOT a behavior repair -- the discriminator is the TARGET OF THE REPAIR, never the finding's phrasing
competence_substitution(contract, candidate?, verdict?) ≡
(judgment_bearing(contract.activity) ∧ ¬recipient_owns_method(contract) ∧ ¬∃ p : contract_names_verified_operative(p, contract)) -- F0 leg: judgment-bearing activity, method neither recipient-owned nor grounded in a verified artifact the CONTRACT names (evaluable at F0 where candidate = Null; the candidate-level verified_operative test is the artifact leg below, at F5)
∨ (candidate ≠ Null ∧ ∃ p ⊆ candidate : operative(p, candidate, contract) ∧ authored_procedure(p) ∧ ¬verified_operative(p, candidate, contract)) -- artifact leg: authored operative procedure without verified status
∨ (verdict = Fail(B, _, _) ∧ ∃ f ∈ B, p ⊆ candidate : operative(p, candidate, contract) ∧ behavior_repair(f, p)) -- F5 backstop leg: ONE behavior-repair finding suffices, no multi-pass "shift" is required
-- the guard against substituting author-written procedure for recipient judgment (Rule 27). The verb "implement" alone NEVER trips. Witness discipline: when no witness can be named that the activity is executable-from-alone at the declared strength, the contract claims less (the recipient-owned-method form), never more. Evaluator dual: the F5 realization's authority envelope is the refuter's declared tool set — execution evidence is inadmissible, and a broader tool profile at dispatch is an evaluator substitution that voids the verdict
SweepTrace = List({ category: String, status: String, checked: String }) -- per-category sweep record (what was actually checked, including which references were tool-verified); required for BOTH verdicts — a verdict missing the sweep trace or the realization is no verdict (re-dispatch, never default to Pass)
F5Realization ∈ {refuter-subagent, generic-subagent, lint-fallback} -- which realization produced the verdict, platform-laddered: the packaged named agent where the platform registers plugin agents; a generic fresh subagent carrying the same F5 instructions where only generic spawn exists (fresh-context isolation preserved); lint-fallback only where no subagent surface exists — the weakened realization (no fresh-context isolation), and the verdict must carry the realization it ran under
ZeroMemoryVerdict ∈ {Pass(sweep: SweepTrace, realization: F5Realization), Fail(blocking_items: Set(EvidencedFinding), sweep: SweepTrace, realization: F5Realization)} -- F5 comprehension verdict, ALWAYS dispatched (Rule 9) — never an optional layer. Fail names the findings a fresh recipient cannot resolve; each is classified by claim_repair (Rule 31) before it enters residuals or Λ.reception_premises. A reception procedure directing the recipient to also read an uncertified sibling record is a Fail (portable(target, boundary) requires one certified record). Prose-only deletion test (Change C): a pass whose declared activity is NOT executable from target's certified content + judgments' inlined values + the reception procedure + allowed sources alone is likewise a Fail
TargetIdentity = RevisionFixed(rev: String) | ContentDigest(digest: String) -- the certified state's identity, bound to Λ.target_identity at the terminal settle from the exact target state the final Pass reviewed — F7's lead action re-checks target's current state against it before assembly (a mismatch — a mutation between the final Pass and certification, e.g. during the turn-yielding Qp — re-enters the loop over the mutated state instead of certifying — the changed content re-enters F1–F3, prior dispositions invalidated, the comprehension verdict cleared — so F7 never fingerprints an unreviewed revision): a revision-fixed form when target's substrate provides one (a commit SHA, an immutable revision id), else a content digest the receiver can recompute — algorithm-prefixed (e.g. sha256:) and computed over the exact snapshot form the reception procedure's lead step names (the lead step carries the re-computation instruction: algorithm + snapshot boundary — which content form of a mutable substrate is digested — so the check is deterministically reproducible, never guessed) — the same disjunction verified_operative already uses (exact content identity ∨ a revision-fixed StableRef). The receiver's lead dereference step compares target's current state against this identity; a mismatch means a post-certification edit — Rule 24's label no longer applies, the record reads as Draft, re-certify before trusting
Certificate = { target: StableRef; target_identity: TargetIdentity; activation_edge: ActivationEdge; judgments: List(RouteJudgment); outcome: AlreadyPortable | Repaired(deltas: List(EmittedDelta)); reception_procedure: ReceptionProcedure } -- Rule 30: the RESULT TYPE, replacing PortableHandoff. target, target_identity, and activation_edge bind the Certificate to the record, the exact certified state, and the edge it was verified under (Rule 24's label needs all three — a later edit is receiver-detectable, never only declared) — an externalized Certificate identifies its record by itself, never only through session context. certify: (target: StableRef, boundary: Role) → Certificate is the core relation Diylisis realizes (with activity?/activation_verb? as additional declared parameters). outcome = AlreadyPortable ⟺ Λ.repair_deltas = ∅ (the celebrated clean terminal: nothing new created, basis retained on every judgment); outcome = Repaired(deltas) otherwise — in the EMITTED Certificate, outcome is typed over EmittedDelta: Resolution deltas whose added content survives in target ride in full — one superseded by a later applied excision squashes to an ExcisionMark — while Excision deltas ride as content-free ExcisionMarks (the leak lint audits the emitted outcome). The record (target) stays substrate-owned; the Certificate is the judgment/audit layer over it, not a copy of it
emit_candidate(Λ) = the candidate channels F6 lints before convergence: contract ∪ judgments ∪ reception_procedure ∪ residual_ledger ∪ activation ∪ emitted_outcome -- the repairable to-be-emitted content; activation is the emitted ActivationEdge and emitted_outcome is the Certificate's outcome as it will be emitted (the EmittedDelta projection) — the lint mechanically enforces that no excised content or span survives into the Certificate. The reception_procedure member is linted through its assembly inputs, which all exist by F6 (the boundary role, the contract's granted sources, verification commands, execution scope, and stop condition, the dereference step each Reference-verdict judgment implies, Λ.reception_premises); F7's assembly is a PROJECTION of these already-linted components plus Qp's answer rendered through a fixed template (the authority-copy line over Aq's locator) — it adds no free prose, so the F6 lint over components covers the assembled output
tokens(X) = the token content extracted from channels X (strings, not the structured objects) -- projection Channels → Set(Token), so the ⊆ test below compares homogeneous token sets
discriminating(d) = the session-local tokens that UNIQUELY identify a DROP'd item d — its distinctive content, not bare ids nor tokens shared with in-scope items -- precision-bounded against false positives; when the boundary is uncertain, delegate the leak check to a fresh subagent (as F5 does) rather than let a common token block convergence
leaked_drops(Λ) = { d ∈ Λ.dropped : discriminating(d) ∩ tokens(emit_candidate(Λ) ∪ target_current) ≠ ∅ } -- target_current = target's post-repair content this pass: DROP'd content that survived into an emitted channel OR remains readable in the record itself (a Defer-terminalized drop, or an excision unapplied on a no-write substrate) — the recipient dereferences target, so released content remaining there is a leak like any other; the minimality dual of the F5 comprehension-gap (F5 catches missing, this catches leaked). ANY surviving discriminating token counts — each member of discriminating(d) is individually distinctive (precision-bounded below), so a strict subset surviving is still disclosure; the intersection form also closes the empty-set liveness trap by construction (∅ ∩ X = ∅, never a leak)
leak_free(Λ) ≡ leaked_drops(Λ) = ∅ -- no DROP'd content in any emitted channel nor remaining in target's current content
exposed_drops(Λ) = { d ∈ Λ.dropped : discriminating(d) ∩ tokens(reachable_contents(Λ)) ≠ ∅ } -- F6 DETECTION-ONLY exposure scan; reachable_contents(Λ) = the dereferenceable contents of each Reference-verdict judgment's stable_ref and each contract.allowed_sources entry, read through the session's available read channels (read-only relay observation; a source the session cannot read cannot certify non-exposure — while Λ.dropped ≠ ∅ it enters the ResidualLedger (reason: exposure, evidence naming the unscannable source) and surfaces at Qd like a detected hit; its resolvability stays category 4's concern). The exposing record is substrate-owned and outside the certification's write authority, so a hit never joins leaked_drops/leak_free (an unrepairable conjunct would livelock the fixed point) and is never silently carried: the dropped item enters the ResidualLedger (reason: exposure, evidence naming the exposing source and pointer) and surfaces at Qd — a Route(r) narrows or replaces the exposing pointer, a Resolve re-disposes the dropped item on the user's authority, a Drop releases the routed item whose pointer exposes it, a Defer accepts the exposure with its condition (deferral-excludable: unlike an excision-pending drop, no in-authority repair is being skipped)
undisposed_authored(Λ) = Λ.authored \ (Λ.kept ∪ Λ.routed ∪ Λ.dropped) -- repair-authored items (an F5 resolution-repair or a leak repair) not yet given a disposition; a nonzero count keeps the loop off its fixed point until each authored item re-enters Phase 1 and F1–F3 dispose it (bottoms out: a Resolve supplies user-constituted evidence, never new authored prose)
missing_bases(Λ) = { j ∈ judgments(Λ) : j.basis = "" ∨ j.basis = Null ∨ unsupporting(j) } -- F6 leg (Rule 30): a RouteJudgment with no basis, or one whose basis the latest F5 verdict flagged as verdict-unsupporting (unsupporting(j) ≡ the latest zero_memory_verdict carries a category-7 finding naming j's basis as not supporting its verdict ∧ F4 has not since re-derived that basis — the F5 judgment-basis repair route lands here), repaired by supplying or re-deriving one; when none can be supplied, the judgment's item enters the ResidualLedger (reason: certification-leg) and surfaces at the Gate — a Resolve supplies the basis, a Drop/Defer releases the item and its judgment with it
unresolvable_route_pointers(Λ) = { j ∈ judgments(Λ) : j.verdict = Reference(r) ∧ ¬resolves_at(r.locator) } -- F6 leg (Rule 30): a Reference verdict whose locator fails the durable-grounding test, repaired by relocating — the disposition-preserving mechanical arm (a new locator under the same ROUTE); inlining re-disposes ROUTE→KEEP, a Gate act, never a mechanical repair — so when no relocatable locator exists the item enters the ResidualLedger (reason: certification-leg) and surfaces at the Gate (a Resolve may inline the evidence and re-dispose it on the user's authority)
ledgerless_decisions(Λ) = { d ∈ Λ.decisions ∪ Λ.reception_premises : (d.ledger_ref = Null ∨ ¬resolves_at(d.ledger_ref.locator)) ∧ ¬deferred(d) } -- a Gate answer on a premise-origin entry updates Λ.reception_premises IN PLACE: Resolve binds its ledger_ref, Route(r) binds r as the ledger_ref after the resolves_at check (on a decision-store entry Route and a pointer-carrying Resolve collapse to the same update; a failing locator re-presents), Drop removes the premise entry (the user releases the reconfirmation obligation), Defer marks it deferred-with-condition — annotated in the emitted premise list and excluded from this leg as a user-constituted residual (the stall-exit discipline), never silently surviving unpointered -- F6 leg (Rule 33), auditing BOTH decision stores — F1-bound decisions and claim-repair reception premises (a premise the receiver must reconfirm needs its ledger pointer no less; without this leg a Null-ref premise would be suppressed as already-premised on the next pass and enter the Certificate unpointered); repair = attach one; when none can be found the decision's item enters the ResidualLedger (reason: certification-leg) and surfaces at the Gate (a Resolve supplies the pointer; a Route(r) binds r as the ledger_ref after the resolves_at check — on a decision-store entry the two collapse to the same update; a Drop releases the item and removes its DecisionRecord from Λ.decisions; a Defer(condition) does likewise while binding the accepted gap as a deferred-annotated DecisionRecord into Λ.reception_premises — the fixed point's deferral discipline). The ledger channel itself is not modeled — a project fact (this repo: the git record)
unmet_stop(Λ) = { c ∈ clauses(contract.stop_condition) : ¬satisfied(c, Λ) } -- F6 leg: a declared stop-condition clause the pass's current state does not yet satisfy; repair = perform the certification work the clause still requires (mechanical when the clause names a runnable check). A clause no mechanical repair can satisfy enters the ResidualLedger (reason: certification-leg) and surfaces at the Gate like any other leg — a Resolve confirms or re-declares the clause on the user's authority, a Route(r) points the clause's satisfaction evidence at r (resolves_at-checked; failing → re-present), a Drop releases it, a Defer(condition) marks the entry deferred with its bound DecisionRecord — so a stable unmet stop never rides the stall exit silently: it reaches Qd and survives only user-constituted
measure(Λ) = |unresolved_anchors| + |unmet_stop| + |unsurfaced_residual| + |leaked_drops| + |undisposed_authored| + |missing_bases| + |unresolvable_route_pointers| + |ledgerless_decisions| -- F6 hygiene measure: targets the repair and detects the stall. NOT monotone per pass — a repair pass authors new prose (Rule 25), and authored prose is generative, so legs can rise before they settle; termination is argued at LOOP, not from per-pass decrease
fixed_point(Λ) = (measure(Λ) = 0 ∨ (measure stable ∧ all residuals surfaced — incl. every certification-leg entry — ∧ leak_free(Λ) ∧ undisposed_authored(Λ) = ∅ ∧ no disposition conflict)) ∧ zero_memory_verdict = Pass ∧ no RepairDelta applied this pass ∧ no Gate answer newly disposed an item or appended a reception premise this pass -- the verdict and the judgment list must stand over target's final state: a pass that applied any delta (resolution or excision) re-enters, and so does a pass whose Gate answer changed any disposition — or appended a reception premise (a Qd Defer's bound DecisionRecord is an F5-input mutation) — after F4/F5 ran (the next pass re-runs F4 over the updated kept ∪ routed and re-dispatches F5 over the updated premise list), so the terminal pass is delta-free and gate-quiet. A nonzero stable remainder is never silent: each contributing entry passed through Qd (Phase 3 → Phase 4 requires the answer received) and the gate-quiet conjunct forces one post-answer audited pass — the stall exit certifies only user-constituted, annotated residuals (e.g. a Defer accepting a gap), by design; a Qd Defer(condition) on ANY gate_domain entry additionally binds a DecisionRecord{claim: the accepted gap, deferral: condition} appended to Λ.reception_premises, so the deferred gap and the condition justifying the stall travel to the receiver in the emitted premise list rather than dying with the session (Rule 33's deferral annotation, generalized beyond premise-origin entries) — and marks a ledger-backed entry deferred, removing it from gate_domain so the required gate-quiet post-answer pass is reachable (an accepted gap is not re-presented; excision-pending drops and disposition conflicts stay in gate_domain per its definition)
portable(target, boundary) ≡ fixed_point(Λ) ∧ every ResidualLedger entry surfaced ∧ leak_free(Λ) -- Rule 30: the formal invariant Candidate C names; equivalent to the CONVERGENCE predicate — a target is portable for a declared boundary exactly when Diylisis would converge on it
ResidualLedger = Set({ item: ContextItem, reason: "unresolved" | "unknown-provenance" | "comprehension-gap" | "certification-leg" | "exposure", surfaced: Bool, deferred: Bool, evidence: Option(EvidencedFinding) }) -- deferred (default false): set by a Qd Defer(condition) answering this entry — the entry stays in the ledger, still counted by the stall exit's all-residuals-surfaced conjunct and annotated by its DecisionRecord in the emitted premise list, but leaves gate_domain so an accepted gap is not re-presented every pass (the gate_domain dual of Rule 33's deferred(d) exclusion); silent residual forbidden: every entry must have surfaced = true before convergence; evidence carries the F5 finding that re-entered the item for comprehension-gap entries (an exposure entry's evidence instead names the exposing source and pointer; Null for other reasons). A claim_repair finding is NOT an entry here — it relays to Λ.reception_premises instead, itself surfaced (in the emitted reception procedure), never silent (Rule 6)
Phase ∈ {0, 1, 2, 3, 4}
── PHASE TRANSITIONS ──
Phase 0: target: StableRef, boundary: Role, activity?, activation_verb? → Detect(target) → tethered? -- tethered checkpoint (silent)
then F0 declare(target, boundary, allowed_sources, activity?, verification, stop, certificate_target?) → HandoffContract -- recipient_profile carries the zero-memory knowledge premise; boundary is the open declared Role; Λ.activation_edge is constructed in the next step from activation_verb? and target — the F5 fourth input exists from Phase 0
then Λ.activation_edge = edge(activation_verb?, target) -- verb declared or defaulted to the canonical minimal verb; locator is a reference to target, never a copy
then bind Λ.constituting_utterance; Λ.contract_provenance = mark(contract, Λ.constituting_utterance); guard has_authored_delta(Λ.contract_provenance) → Constitution(Confirm | Correct) → Λ.cp_answer -- F0 contract-provenance guard (Rule 29): present the user↔contract delta when any field is ai_authored; no delta ⇒ relay
Phase 1: HandoffContract → F1 normalize(surface_token, canonical_ref, confidence) → SubstTable [Tool: Read, Grep, Glob]
then F1 bind(decision-shaped item) → DecisionRecord{claim, ledger_ref?} → Λ.decisions -- Rule 33
then F2 audit(item, self_containment) → Grounding (inline | stable-pointer | routed-residual)
unresolved F1 tokens and routed-residual F2 items append to ResidualLedger (surfaced = false)
Phase 2: (SubstTable, Grounding) → F3a relevance(item, contract.activity, boundary)
→ F3b attest(item) → Provenance
→ F3 dispose(item) → Disposition -- KEEP from an Inline-grounded ObservedKeep (durable observable source + support-integrity); ROUTE from a StablePointer-grounded ObservedKeep, F3a relevance, or the Gate; DROP from F3a relevance or the Gate; Unknown routes to Gate
Phase 3: kept ∪ routed → F4 judge(kept, routed) → judgments(Λ): List(RouteJudgment) -- Rule 30 (track)
→ F5 comprehension_gate(target, judgments, contract, watchlist, activation_edge, constituting_utterance, reception_premises, cp_record) → zero_memory_verdict [Tool: Read, Task]
→ [gate_domain(Λ) ≠ ∅] Qd(gate_domain(Λ)) → Stop → A | [gate_domain(Λ) = ∅] A := None (identity) [Tool: Constitution interaction]
then repair(A, blocking_items | ∅) → Λ.authored, Λ.repair_deltas, Λ.reception_premises -- blocking_items is bound by a Fail verdict and ∅ under Pass; each blocking finding routes per claim_repair (Rule 31) to Λ.authored (resolution repair, re-disposed next pass), Λ.reception_premises (claim repair, surfaced there), or the residual ledger (recurrence-blocked); this step applies the pass's settled deltas to target in place — resolution additions and the excision of every excision-bearing item whose Drop the GATE settled this pass (an F3a DROP with nothing excisable needs no delta — Rule 12); when target's substrate offers the session no write channel (an immutable published record), the would-be delta routes to the residual ledger (reason: certification-leg) and surfaces at Qd instead of assuming the write landed [Tool: Edit | the record's own write channel]
Phase 4: A, verdict → exposure_scan(reachable_contents(Λ)) [Tool: Read] → F6 settle(measure) → fixed_point?
¬fixed_point → Phase 1 (next pass); fixed_point → bind Λ.outcome (AlreadyPortable iff Λ.repair_deltas = ∅, else Repaired(Λ.repair_deltas)) ∧ bind Λ.target_identity (a revision-fixed form or content digest of target's current — final-Pass-reviewed — state) → Qp composite_premise_gate(Λ.outcome, contract.certificate_target, Λ.reception_premises) → Aq → [Aq carries AuthoritativeAt(loc)] terminal check: resolves_at(loc) ∧ rendered authority-copy line leak-clean — fail → re-present Qp with the failure cited | (no fire, or check passed) → F7 lead re-check: target's current state = Λ.target_identity — mismatch (a post-Pass mutation, e.g. during the turn-yielding Qp) → Phase 1 re-entry over the mutated state (the content changed since the final-Pass-reviewed state joins that pass's F1–F3 domain, its items' prior dispositions invalidated and re-disposed; Λ.zero_memory_verdict cleared so F5 re-dispatches) | match → F7 certify(target, Λ.activation_edge, judgments, emit(Λ.outcome), reception_procedure) → Certificate
Phase 0 → Phase 1: (context_tethered(target) = true ∨ explicit Layer-1 invocation) ∧ HandoffContract declared ∧ (contract.certificate_target = Null ∨ (contract.certificate_target ≠ target (referent-level: canonicalized identities distinct, per the HandoffContract constraint) ∧ session_writable(contract.certificate_target))) ∧ content_free(Λ.activation_edge) ∧ ¬competence_substitution(contract, Null, Null) ∧ (¬has_authored_delta(Λ.contract_provenance) ∨ Λ.cp_answer ≠ Null) -- a content_free violation is repaired at F0 (re-form the declaration; correction surfaced as relay), never carried forward; a competence-substitution trip is a Stop (Rule 27): the misfit witness + a proposed recipient-owned-method re-declaration surface for the user, and Phase 1 opens only on the re-declared contract. A contract-provenance delta (Rule 29) is a lighter gate than either: no field wrongness is implied, only confirmation — Phase 1 opens once the user Confirms or Corrects, or immediately when no field is ai_authored
Phase 0 → deactivate: context_tethered(target) = false ∧ Layer 2 activation (AI-detected) -- silent: no residue and no explicit invocation to honor. An explicit Layer-1 /distill proceeds to Phase 1 regardless: the clean scan is relay evidence, and the AlreadyPortable Certificate rests on the always-on refuter's Pass, never on the silent scan alone
Phase 1 → Phase 2: SubstTable produced ∧ every item assigned a Grounding class ∧ every decision-shaped item bound to a DecisionRecord -- deixis normalized, self-containment audited, decisions bound
Phase 2 → Phase 3: every item carries a Disposition or a surfaced unknown-provenance flag -- relevance + provenance discharged
Phase 3 → Phase 4: zero_memory_verdict produced ∧ ¬competence_substitution(contract, judgments, zero_memory_verdict) ∧ ¬contract_misfit(contract, Λ.constituting_utterance, Λ.cp_answer, zero_memory_verdict) ∧ (A received ∨ gate_domain(Λ) = ∅) -- comprehension evaluated (Pass or Fail) and residual answered, OR the gate domain is empty (clean pass, A = None by identity). Pass gates convergence at Phase 4. A backstop trip (Rule 27 or Rule 29) takes precedence — it fires the graceful-deactivate transition below, never this one
Phase 4 → Phase 1: ¬fixed_point(Λ) → pass_n += 1 -- measure unsettled OR comprehension verdict not yet Pass OR |undisposed_authored| > 0 OR a delta landed this pass OR a Gate answer newly disposed an item or appended a reception premise this pass (F4 re-runs over the updated kept ∪ routed, F5 re-dispatches over the updated premise list), re-audit; the next pass's F1–F3 domain is Λ.authored (repair-authored content awaiting disposition — Rule 25), while items of target retain the dispositions they already carry and target carries the claim-preserving deltas already applied (resolution additions and drop-excisions — Rule 12); a leak repair (leaked_drops > 0 detected at this settle) is performed on this re-entry — the excisions/rewrites it authors enter Λ.authored before the next pass's F1; nonzero mechanical certification legs (missing bases, unresolvable route pointers, ledgerless decisions) likewise queue their repairs on this re-entry at their repair sites — basis re-derivation and locator relocation at the next pass's F4 (inlining re-disposes — a Gate act via Qd Resolve, never mechanical), a ledgerless decision's found pointer as a Resolution RepairDelta applied and logged at that pass's repair step (Rules 12, 33), a repair that cannot be performed routing its item to the residual ledger (reason: certification-leg) to surface at Qd; an identity-mismatch re-entry (target mutated after the final Pass, detected by F7's lead re-check) additionally widens the F1–F3 domain to target's changed content, invalidates the changed items' prior dispositions, and clears Λ.zero_memory_verdict so F5 re-dispatches over the mutated state
Phase 4 → converge: fixed_point(Λ) ∧ zero_memory_verdict = Pass ∧ every ResidualLedger entry surfaced ∧ leak_free(Λ) -- Qp fires conditionally (Rule 32), then F7 certifies: its lead action re-checks target against Λ.target_identity (bound at settle; a post-Pass mutation → Phase 1 re-entry over the mutated state), then assembles the Certificate over target's current, already-repaired state (no further edit), present the reception procedure as session text
Phase 3 → deactivate (backstop, graceful): competence_substitution(contract, judgments, zero_memory_verdict) ∨ contract_misfit(contract, Λ.constituting_utterance, Λ.cp_answer, zero_memory_verdict) -- a behavior-repair finding on authored operative procedure (Rule 27), or a category-10 finding that the contract claims more than the constituting utterance authorized (Rule 29): terminate this /distill invocation without a Certificate, surface the witness + a proposed re-declared contract for a FRESH invocation; NOT an in-loop restart — J gains no re-declaration arm and no new contract instance is created within the loop, so the LOOP permanence/fixed-point argument (scoped to one invocation) is untouched. The fresh invocation re-runs F3a relevance under the re-declared activity
Phase 3 → deactivate (ungraceful): Esc -- residual untreated, no Certificate produced
── LOOP ──
J = {next_pass, converge, esc}
next_pass: ¬fixed_point(Λ) ∧ ¬Esc → pass_n += 1, Phase 4 → Phase 1 (bounded audit/lint re-scan)
converge: fixed_point(Λ) ∧ every ResidualLedger entry surfaced ∧ leak_free(Λ) → Qp (conditional) → F7 certify → Certificate
esc: Esc → ungraceful deactivate (residual untreated)
-- UNCHANGED coproduct: Qp's firing and Aq's answer are not new members of J — Qp sits between "fixed_point reached" and "F7 certifies" within the converge arm, exactly as Qd already sits within Phase 3 without being a fourth J member
One-pass + bounded audit/lint: the morphism runs once forward (F0→F7), then F6 re-audits against the hygiene measure. Termination is NOT argued from per-pass decrease — a pass that repairs comprehension gaps authors new prose, and authored prose can carry new obligations, so measure(Λ) can rise across a repair pass. It is argued from three facts: dispositions of target's items are permanent (Phase 4 → Phase 1 keeps every carried disposition; every target mutation is a logged, claim-preserving RepairDelta — a resolution addition or a drop-excision — so each pass's refuter reviews target's actual current state, which is what makes the repaired-target log meaningful and the final Pass honest), the Gate bottoms out (a Resolve supplies user-constituted evidence, never new authored prose), and the fixed point's stable-measure branch is an explicit stall exit. The excision family bottoms out the same way: dispositions are permanent, an excision lands only on a Gate-settled Drop, and each DROP'd item is excised at most once, so a pass eventually applies no delta — and the fixed point is reachable only on a pass that is both delta-free and gate-quiet (no Gate answer newly disposed an item), so the terminal pass's Pass verdict and judgment list stand over target's final state; a Gate Route, Resolve, or premise-appending Defer landing after F4/F5 ran forces one more pass, in which F4 re-runs over the updated kept ∪ routed and F5 re-dispatches over the updated premise list. The competence-substitution backstop (Rule 27) and the contract-provenance backstop (Rule 29) each remove one unbounded-by-repair family, exactly as before — J stays {next_pass, converge, esc}, no new contract instance is created within the loop, and neither adds a measure leg or a Disposition arm. The resolution-repair discriminator (Rule 31) removes a THIRD unbounded family the same way: a claim_repair finding cannot be resolved by any amount of document repair (the defect is in what target asserts, not in what supports it), so it relays to Λ.reception_premises instead of re-entering the loop — and the premise list rides the next dispatch as a scoped comparison input, so an already-premised claim is not re-Failed pass after pass; and same-target recurrence (a resolution-repair finding recurring at an already-repaired token×location) is capped not by a counter but by the repaired-target log Λ.repaired_targets — a location repaired once and failing again is evidence the repair family is not converging there, so it surfaces at Qd instead of looping again.
Provenance hard line: F3b never infers KEEP from appearance. KEEP is reachable exactly two ways: a durable directly-observable source coupled to the item by support-integrity (ObservedKeep — the common-case relay path, disposed without the Gate: KEPT when Inline-grounded, ROUTEd on its stable ref when pointer-grounded — the same relay authority either way); or a user Resolve at the Gate. Every other state yields Unknown, which routes to the Gate as a Constitution question where the author decides KEEP, ROUTE, or DROP. Provenance authority covers the KEEP hard line only: ROUTE and DROP dispositions are reached through F3a relevance or the Gate, never defaulted from a provenance verdict.
Silent-residual ban: every item classified as routed-residual at F2, every unresolved token at F1, every unknown-provenance item at F3b, every comprehension-gap item at F5 (excluding claim_repair findings, which relay to Λ.reception_premises instead), and every certification-leg item whose mechanical repair failed at F6 enters the ResidualLedger with `surfaced = false` and must reach `surfaced = true` through the Gate before convergence. A Λ.reception_premises entry is surfaced by a different, equally non-silent route: it appears in the emitted reception procedure the receiver reads — the ban is on hidden residue, not on which surface carries it.
Comprehension hard line: F5's verdict gates the fixed point. A Fail re-enters its blocking items per the claim/resolution/recurrence discriminator (Rule 31) and keeps the loop off its fixed point — except when the competence-substitution backstop (Rule 27) or the contract-provenance backstop (Rule 29) trips, either of which terminates the invocation, nothing entering the ledger; convergence requires a Pass verdict, so a Certificate never emits while the zero-memory gate fails. The prose-only deletion test is part of this gate (Change C): if the declared activity cannot be executed from target's certified content plus judgments' inlined values plus the reception procedure plus allowed sources alone, F5 Fails.
Leak repair: when `leaked_drops > 0` the loop re-enters, and the repair is a targeted emit-channel revision — excise every leaked DROP'd item's discriminating content from every emit channel: contract, judgments, reception_procedure, residual_ledger, the activation edge — then re-audit. Unlike the F5 repair, no item re-enters the residual ledger: a DROP was already user-decided at the Gate, so the defect is its content surviving the emit and the fix is excision from the candidate emit, not re-surfacing. Target itself is upstream of this lint: a DROP'd item's discriminating content was already excised from target at its repair step (Rule 12), so the emit-channel sweep is the residual guard, not the only barrier — the fresh recipient learns nothing of drops from any surface the certification emits or target itself carries. Content reachable only by dereferencing a foreign substrate-owned source (a Reference locator, a granted source) is outside the certification's write authority: the F6 exposure scan detects a dropped item's discriminating content there and surfaces it at Qd (reason: exposure) for user disposition, never silently — an unreadable foreign source, while drops exist, surfaces the same way (non-exposure cannot be certified for it) — the repair object is the pointer or the disposition, never an edit to the foreign record.
Repair-authored content: every item the author session writes during an F5 resolution repair or a leak repair enters `Λ.authored` and re-enters Phase 1 on the next pass, where F1–F3 give it a substitution row, a grounding class, a provenance verdict, and a disposition. The recursion bottoms out: a Gate answer on an authored item yields a disposition, and a Resolve supplies user-constituted evidence, never new authored prose. The fixed point is unreachable while `|undisposed_authored| > 0`.
Convergence evidence: At convergence, present the substitution table, the per-item disposition trace, the surfaced residual ledger, and the Certificate's judgment list with each basis. Convergence is demonstrated, not asserted.
── CONVERGENCE ──
converge iff fixed_point(Λ) ∧ every ResidualLedger entry surfaced ∧ leak_free(Λ) ∧ ¬user_esc -- equivalently, portable(target, boundary) (Rule 30)
fixed_point(Λ): (measure(Λ) = 0, OR measure stable across a pass with all residuals surfaced — incl. every certification-leg entry — leak_free, every authored item disposed, and no open disposition conflict) ∧ zero_memory_verdict = Pass ∧ the pass applied no repair delta ∧ no Gate answer newly disposed an item (the terminal pass is delta-free and gate-quiet: its Pass verdict and judgment list stand over target's final state)
surfaced ledger: ∀ r ∈ ResidualLedger : r.surfaced = true (no silent residual reaches the recipient; a claim_repair finding is surfaced via Λ.reception_premises instead, per the Silent-residual ban note above)
leak_free: leaked_drops(Λ) = ∅ — no DROP'd item's discriminating content survives in any emitted channel (contract, judgments, reception_procedure, residual ledger, the activation edge) or in target's own current content; the minimality dual of comprehension. Content reachable only through a dereferenced foreign source is the exposure scan's domain (exposed_drops → ResidualLedger reason: exposure) — detection-surfaced at Qd, never a leak_free conjunct
single certified record: target is ONE record — a fresh recipient must execute from it (plus the reception procedure) alone, never a directive to also read an uncertified sibling. A reception procedure directing the recipient elsewhere fails comprehension (F5)
comprehension: zero_memory_verdict = Pass (a Fail re-enters blocking items per Rule 31 and forces another pass — except when the Rule 27 or Rule 29 backstop trips, either of which terminates the invocation, nothing entering the ledger; no Certificate emits on a Fail)
user_esc: user exits via Esc at the Phase 3 Gate (ungraceful, residual untreated, no Certificate produced)
progress(Λ) = (pass_n, measure(Λ), |undisposed_authored(Λ)|, zero_memory_verdict) -- a fixed-point distance readout, not a monotone ratio: the measure may rise across a repair pass, so no scalar fraction represents progress; convergence is the fixed_point predicate, never a percentage
── TOOL GROUNDING ──
-- Realization: Constitution → TextPresent+Stop; Extension → TextPresent+Proceed
Phase 0 Detect (observe) → Substrate-appropriate read of target (Read, Grep for a file-backed record; the record's own read channel — an issue/PR/comment read via the host CLI/API, a task-description read — for an externally-owned record: the read dual of the Phase 3 repair write channel, the realization layer mapping the read to the record's substrate; the same channel serves every later observe entry over target's content) (silent — dereference target's locator and heuristically scan its content for session-tethered residue; a StableRef target is read, not assumed — a target the session cannot dereference through any available read channel Stops at F0, surfaced for re-declaration of a readable locator, never certified from an unread session copy; no user output)
Phase 0 declare (observe) → Read, Grep (target, boundary, allowed_sources, activity?, verification, stop, certificate_target? from session context, target's content, and project config)
Phase 0 bind (track) → Internal state update (Λ.activation_edge = edge(activation_verb? | minimal, target); Λ.constituting_utterance bound from the session record; Λ.contract_provenance = mark(contract, Λ.constituting_utterance) (Rule 29))
Phase 0 cp-guard (constitution) → present (conditional: has_authored_delta(Λ.contract_provenance) — the user↔contract delta on activity/execution_scope/stop_condition/allowed_sources; the user Confirms or Corrects before Phase 1; no delta ⇒ relay, cited in the disposition trace, no gate)
Phase 0 cs-guard (constitution) → present (conditional: competence_substitution(contract, Null, Null) trip — the contract-misfit witness + a proposed recipient-owned-method re-declaration; the user re-declares before Phase 1)
Phase 1 normalize (observe) → Read, Grep, Glob (resolve each surface token in target's content to a canonical reference; the read-only deictic scan runs as Extension)
Phase 1 decision-bind (observe) → Read, Grep (bind each decision-shaped item to a DecisionRecord, locating a ledger_ref where findable; Extension relay when found, Unknown-equivalent when not — Rule 33)
Phase 1 audit (sense) → Internal analysis (per-item self-containment classification: inline / stable-pointer / routed-residual)
Phase 2 attest (observe) → Read, Grep, Glob (ObservedKeep: read-only confirmation that the item's durable observable source resolves — an Extension relay (entropy→0, basis = the cited observable source, no Gate). No observable basis → Unknown → Gate)
Phase 2 dispose (track) → Internal state update (Λ.dispositions, Λ.residual_ledger; a DROP-candidate with excisable target content is marked excision-pending for the Qd Gate — only a Gate-settled Drop queues its excision RepairDelta for the Phase 3 repair step, Rule 12)
Phase 3 judge (track) → Internal state update (Λ.judgments constructed from kept ∪ routed per Rule 30)
Phase 3 comprehension_gate (dispatch) → Read, Task (refute-posture review, ALWAYS dispatched, platform-laddered: the diylisis:zero-memory-refuter subagent where the platform registers plugin agents; a generic fresh subagent carrying the F5 instructions where only generic spawn exists; lint checklist only where no subagent surface exists. Inputs are target's content, judgments (with bases), the full declared contract (recipient profile, boundary Role, activity, allowed sources, execution scope, verification commands, stop condition — categories 6, 9, and 10 read the source grants, the operative-procedure tests, and the scope claims), the activation edge, the session-term WatchList, Λ.constituting_utterance and the contract-confirmation record (Λ.contract_provenance + Λ.cp_answer) — comparison inputs scoped to checklist category 10 only (the confirmation record lets category 10 honor an F0 Confirm: a field the F0 gate ratified is not re-failed on a Layer-2 empty utterance) — and Λ.reception_premises — a scoped comparison input previewing the reception procedure's premise list: an already-premised claim is not re-Failed, while a new claim-defect and every resolution defect still count; author self-simulation excluded)
Phase 3 comprehension_gate (track) → Internal state update (Λ.watchlist recorded at dispatch; parse the verdict: each Findings row → EvidencedFinding; classify each by claim_repair (Rule 31) → Λ.reception_premises (claim repair) or Λ.repaired_targets recurrence check → residuals (blocked) or Λ.authored + Λ.repair_deltas (resolution repair) — EXCEPT operative-procedure findings (Rule 27 cs-backstop) and category-10 findings (Rule 29 cp-backstop); Λ.zero_memory_verdict set with its sweep trace and realization; a verdict missing the per-category sweep trace or the Realization line is rejected as no verdict → re-dispatch)
Phase 3 cs-backstop (constitution) → present (conditional: competence_substitution(contract, judgments, zero_memory_verdict) — a behavior-repair finding on authored operative procedure; surface the witness + a proposed recipient-owned-method contract; terminate without a Certificate, hand the proposed contract to the caller for a FRESH invocation)
Phase 3 cp-backstop (constitution) → present (conditional: contract_misfit(contract, Λ.constituting_utterance, Λ.cp_answer, zero_memory_verdict) — a category-10 finding; surface the witness + a contract re-declared with those fields confirmed against the user's own words; terminate without a Certificate, hand the proposed contract to the caller for a FRESH invocation)
Phase 3 Qd (constitution) → present (conditional on gate_domain(Λ) ≠ ∅: surfaced residuals + unknown-provenance items + disposition conflicts + recurrence-blocked findings; when gate_domain(Λ) = ∅ — a clean pass — A := None by identity and no gate presents; Esc → loop termination at LOOP level, not an Answer)
Phase 3 repair (transform) → Substrate-appropriate write on target (Edit for a file-backed record; the record's own write channel — an issue-comment or issue-body edit via the host CLI/API, a task-description update — for an externally-owned record the session can write; the realization layer maps the write to the record's substrate): this pass's settled deltas — resolution additions and Gate-settled drop-excisions — applied in place and logged (Rule 12); only a record with no write channel available to the session (an immutable published record — a committed commit message) routes the would-be delta to the residual ledger (certification-leg) instead of assuming the write landed; timing: within the pass, after the Gate answer, before Phase 4 settle)
Phase 3 repair-track (track) → Internal state update (F5/Gate repair-authored items appended to Λ.authored, undisposed, or to Λ.repair_deltas/Λ.reception_premises per Rule 31)
Phase 4 exposure-scan (observe) → Read, Grep, Glob (substrate-appropriate read-only dereference of each Reference-verdict locator and each granted source, their contents scanned for dropped items' discriminating tokens — relay observation feeding the settle's exposed_drops leg, run before the measure is computed; a source the session cannot read, while Λ.dropped ≠ ∅, is recorded as an exposure residual — non-exposure cannot be certified for it)
Phase 4 settle (track) → Internal state update (measure(Λ) incl. leaked_drops, exposed_drops (fed by the exposure-scan observe step above), missing_bases, unresolvable_route_pointers, ledgerless_decisions, leak-lint, fixed-point check, pass counter; on fixed_point, binds Λ.outcome — AlreadyPortable iff Λ.repair_deltas = ∅, else Repaired(Λ.repair_deltas) — so Qp reads a bound value, never a not-yet-computed one; also binds Λ.target_identity over the final-Pass-reviewed state, which F7's lead action re-checks before assembly)
Phase 4 leak-repair (track) → Internal state update (performed on ¬fixed_point re-entry when leaked_drops > 0: targeted emit-channel excision/rewrite per LOOP; authored excisions/rewrites enter Λ.authored before the next pass's F1)
Phase 4 leg-repair (track) → Internal state update (performed on ¬fixed_point re-entry when a mechanical certification leg is nonzero: each repair queued at its repair site — a missing or unsupporting basis re-derived at the next pass's F4; an unresolvable Reference locator relocated at that F4 (disposition-preserving; inlining would re-dispose ROUTE→KEEP — a Gate act, reached only through a Qd Resolve on the failed-repair residual); a ledgerless decision's found pointer queued as a Resolution RepairDelta, applied and logged at that pass's repair step (Rules 12, 33); a repair that cannot be performed routes its item to the residual ledger (reason: certification-leg), surfacing at that pass's Qd — no leg stays nonzero without a queued repair or a surfaced residual)
Phase 4 Qp (constitution) → present (conditional: Λ.outcome = Repaired(_) ∨ contract.certificate_target ≠ Null ∨ Λ.reception_premises ≠ ∅ — recipient class (human/agent incl. substrate access) + authority-copy naming, one composite gate; does not fire on a bare, premise-free AlreadyPortable session-scratchpad terminal; answer Aq bound to Λ.consumer_profile, Λ.authority_copy; never touches A or A_tag — Rule 32)
converge (extension) → TextPresent+Proceed (substitution table + disposition trace + surfaced residual ledger + the Certificate's judgments + the emitted activation edge; proceed to F7 — emit is leak_free across every channel incl. the activation edge, residual ledger recipient-relevant only). F7's two operations are grounded as the (observe)/(transform) entries below — target already carries its deltas, applied at their repair steps (Rule 12), so F7 edits nothing further — still Extension per A2 Standing authority (the Phase 3 Gate and Qp constituted the settled Λ, so this is a deterministic relay of that judgment, not a fresh constitutive act)
F7 lead re-check (observe) → Read | substrate-appropriate read (target's current state compared against Λ.target_identity — for a digest, re-running the named algorithm over the named snapshot boundary; mismatch → ¬fixed_point re-entry per PHASE TRANSITIONS, never certifying an unreviewed revision)
F7 emit (transform) → Write | session-text presentation (the Certificate and reception procedure landed at contract.certificate_target or the session scratchpad — the one artifact authored; target itself untouched)
Seam transition to a declared next protocol (extension) → TextPresent+Proceed (fires at deactivation/handoff: a user-declared chain naming the next protocol, or a composition edge this SKILL.md declares, settles the next move — proceed directly to it, citing that settling source; every Constitution gate inside Diylisis and inside the next protocol fires unchanged)
── MODE STATE ──
Λ = { phase: Phase, target: StableRef, boundary: Role,
contract: Option(HandoffContract), -- F0 output; relevance and minimality premise
constituting_utterance: ConstitutingUtterance, -- F0-bound: the verbatim user turns behind this certification (Rule 29); F5's fifth input; empty is valid and marks every tracked field ai_authored
contract_provenance: ContractProvenance, -- F0-bound per-field provenance mark (Rule 29); session-side only, never emitted
cp_answer: Option(Ac), -- F0 contract-provenance Gate answer; Null until answered
activation_edge: ActivationEdge, -- F5 fourth input, constructed at Phase 0: declared verb (default minimal) + target as locator (by reference)
pass_n: Nat, -- bounded audit/lint pass counter
subst_table: SubstTable, -- F1 deictic normalization rows
target_identity: Option(TargetIdentity), -- bound at the terminal settle (fixed_point): the identity of the exact state the final Pass reviewed; F7's lead action re-checks target against it before assembly
decisions: Set(DecisionRecord), -- F1-bound decision-shaped items within target (Rule 33)
grounding: Map(ContextItem, Grounding), -- F2 self-containment class per item
provenance: Map(ContextItem, Provenance), -- F3b verdict per item
dispositions: Map(ContextItem, Disposition), -- F3 KEEP/ROUTE/DROP per item, unchanged
kept: Set(ContextItem), -- F4 KEEP-disposed items
routed: Set(ContextItem), -- F4 ROUTE-disposed items
dropped: Set(ContextItem), -- DROP dispositions
judgments: List(RouteJudgment), -- F4 output: the certificate's judgment list, built from kept ∪ routed (Rule 30)
watchlist: WatchList, -- F5 third input, enumerated at Phase 3 dispatch from the live session record
authored: Set(ContextItem), -- items the author session created during a resolution repair or a leak repair; origin AIInference unless verbatim observed evidence. Re-enters Phase 1 for disposition (Rule 25)
repair_deltas: List(RepairDelta), -- repair deltas — resolution additions and drop-excisions — applied to target in place at their repair steps (Rules 12/31)
repaired_targets: Set((token: String, location: String)), -- Rule 31: the repaired-target log; a resolution-repair finding recurring on a logged pair stops repair and surfaces at Qd instead — no counter, membership-only
reception_premises: List(DecisionRecord), -- claim-repair findings relayed here (Rule 31), surfaced in the emitted ReceptionProcedure, never a residual; also F5's scoped comparison input (premise deduplication — an already-premised claim is not re-Failed)
gated: Set(ContextItem), -- items surfaced at the Gate for user judgment (unknown-provenance ∪ conflict ∪ excision-pending)
residual_ledger: ResidualLedger, -- entries across every reason (unresolved, unknown-provenance, comprehension-gap); silent entry forbidden
consumer_profile: Option(ConsumerProfile), -- Qp's ConsumerProfile answer, when Qp fires (Rule 32)
authority_copy: Option(AuthorityCopy), -- Qp's AuthorityCopy answer, when Qp fires (Rule 32)
outcome: Option(AlreadyPortable | Repaired(deltas: List(RepairDelta))), -- the SESSION-SIDE outcome, bound at the settle that finds fixed_point (AlreadyPortable iff repair_deltas = ∅), carrying full RepairDeltas; F7 emits Certificate.outcome = emit(Λ.outcome), the EmittedDelta projection (resolutions in full, excisions as ExcisionMarks) — the full deltas never leave the session
measure: Nat, -- F6 hygiene measure (incl. |leaked_drops|, |missing_bases|, |unresolvable_route_pointers|, |ledgerless_decisions|)
zero_memory_verdict: Option(ZeroMemoryVerdict), -- F5 comprehension verdict; Fail re-enters blocking items per Rule 31 and blocks fixed_point (a backstop trip terminates the invocation instead, nothing entering the ledger)
items_touched: Set(ContextItem), -- every item processed: the partition universe (= items(target) ∪ authored once all are disposed)
history: List<(ContextItem, Substitution, Disposition, drop_reason: Option(String))>, -- drop_reason is the typed home for Rule 12's drop-reason preservation; Null for non-DROP entries. History is where excised DROP'd content survives (target releases, history preserves — session-side only, never emitted)
active: Bool, cause_tag: String }
-- Invariant: items_touched = kept ∪ routed ∪ dropped (pairwise disjoint) — holds at fixed_point, not as a standing condition — where items_touched = items(target) ∪ authored. Mid-loop, repair-authored items sit in Λ.authored undisposed until the next pass's F1–F3 dispose them (undisposed_authored(Λ) measures exactly this gap)
-- terminal partition over Disposition = KEEP | ROUTE | DROP, UNCHANGED; the Gate answer Defer resolves to a dropped item carrying a re-trigger condition (released, not retained); on an excision-pending item Defer defers the excision itself — the released content still readable in target keeps leaked_drops ≠ ∅, so the item re-surfaces at the next Qd rather than terminalizing
-- gated is the transient pre-resolution cell, empty at fixed point: every gated item resolves to a terminal disposition (Resolve → KEEP, Route → ROUTE, Drop/Defer → DROP)
-- residual_ledger is a cross-cutting surfacing record, not a partition cell: every entry reaches surfaced = true before convergence. reception_premises is a SEPARATE, parallel surfacing record for claim-repair findings — both are non-silent, neither is a partition cell
-- Invariant: KEEP(item) ⇒ provenance(item) = ObservedKeep ∨ user_resolved_at_gate(item) (no KEEP by inference — only via a durable observable source with support-integrity, or an explicit user Resolve)
-- Invariant: every mutation of target is a logged RepairDelta — a resolution addition or a drop-excision, applied in place at the repair step of the pass that classifies it — and never alters an asserted claim a KEPT or ROUTEd item carries (Rule 12); outside these logged deltas target is read-only, and dropped content survives with its reason in Λ.history
── COMPOSITION ──
*: product — (D₁ × D₂) → (R₁ × R₂). registered dependency edges preserved. Dimension resolution emergent via session context.
F3b composes Elenchus's provenance and freshness tagging plus its Revised | Bounded | Routed disposition vocabulary: it separates an item KEPT on a durable observable source with support-integrity (ObservedKeep → KEEP, the common-case relay) from an item whose provenance is genuinely undecided (Unknown → Gate).
F5 reuses the comprehension structure of a result-grasp check, redirected: the recipient under verification is a fresh executor with no session access, not the author, so the gate excludes author self-simulation. Now attacking RouteJudgment bases and the Certificate's standing rather than a candidate handoff's prose.
F2 may call an external-reference check (request/ground style) when a grounding pointer's target needs verification; the self-containment audit itself stays inline.
Core Principle
Portability over Author Familiarity: A substrate-owned record accumulates session-tethered residue — undefined jargon, metric shorthand, author process traces, tool state, and dangling task identifiers — that reads as complete to its author because the author silently shares the missing context. A fresh recipient with no session access has none of that shared ground. Diylisis certifies the record's portability: each deictic token is normalized to a canonical reference, each item is audited for self-containment, each route-judgment is graded against the declared recipient role and its transformation provenance, and the residue that cannot be resolved in place is surfaced rather than silently carried. The record is portable when the author's familiarity is no longer a hidden dependency — and the certificate says so with a basis attached to every judgment, whether or not anything needed repair.
Mode Activation
Activation
AI detects session-tethered residue in an existing record before it is handed off OR the user calls /distill. Detection is silent (Phase 0); residual and disposition-conflict judgment always requires user interaction via Cognitive Partnership Move (Constitution) (Phase 3).
Activation layers:
- Layer 1 (User-invocable):
/distillslash command or description-matching input, naming a target record and a recipient role. Always available. - Layer 2 (AI-guided): Session-tethered residue detected in a record about to cross a reception boundary (a Task about to be handed to a fresh subagent, a doc about to be shared, a delegation prompt about to be dispatched). Detection is silent (Phase 0).
Context tethered = the target record carries references whose resolution depends on the author session — undefined jargon, metric tokens, "as above"-style anchors, author process narration, or task identifiers that do not transfer to a fresh session.
Gate predicate:
context_tethered(target) ≡ ∃ item(i, target) : depends_on_author_session(i) ∧ ¬resolvable_by_stable_ref(i) -- presupposes target dereferenced through its substrate's read channel (file Read, or an externally-owned record's host CLI/API read — the read dual of the Phase 3 repair write channel); a target no available channel can read is undecidable here and Stops at F0 (re-declare a readable locator), never certified from an unread session copy
Boundary (contextualize ↔ distill): distill closes a portability gap to an absent zero-memory recipient — it certifies an existing record's content in place (monotone with respect to what it asserts) and repairs only resolution means. When the deficit is instead fit to an observable present context (a correct result that mutates to fit a convention, environment, or audience — ApplicationDecontextualized, non-monotone), it is not a distill case → route to /contextualize. This is the complement of contextualize's portability-to-an-absent-recipient → /distill guard.
Priority
<system-reminder> When Diylisis is active:Supersedes: Handing off the target record as-is, uncertified
(A record must be certified for portability before it transfers; author-shared context that the recipient cannot resolve is normalized, routed, or surfaced first)
Retained: Safety boundaries, tool restrictions, user explicit instructions
Action: At Phase 3, present surfaced residuals, unknown-provenance items, and disposition conflicts for user judgment via Cognitive Partnership Move (Constitution). </system-reminder>
- Diylisis completes before the record transfers to a fresh recipient
- Loaded instructions resume after the Certificate is produced, the competence-substitution backstop gracefully terminates the invocation (Rule 27), or Esc
Trigger Signals
Heuristic signals for session-tethered residue detection (not hard gates):
| Signal | Inference | |--------|-----------| | Undefined jargon or metric token | A term carries meaning only in the author session (a versioned label, a metric shorthand, a coined name) | | Deictic anchor | "As above", "the earlier one", "that file", "this approach" — references resolved by session position, not by stable reference | | Author process narration | Instructions that describe the author's own session workflow rather than the recipient's task | | Dangling task identifier | A task id referenced without the data a fresh session needs to restore it | | Fresh-recipient reception imminent | The target record is about to cross a reception boundary — dispatched to a fresh subagent, shared externally, handed to a future session with no shared context |
Skip:
- The target record is already self-contained — every load-bearing reference resolves by stable reference (a Layer-2 routing consideration only: an explicit Layer-1
/distillstill runs the full certification, whose clean result is the celebrated AlreadyPortable Certificate, not a skip) - The recipient shares the author session (same continuous context), so no portability gap exists
- User explicitly says the residue is acceptable for the intended recipient
- Phase 0 detection finds no session-tethered residue (Layer 2 AI-detection only — an explicit Layer-1
/distillstill runs the full certification) - The deficit is fit to an observable present context (a correct result that may not fit the convention, environment, or audience where it is applied —
ApplicationDecontextualized), NOT portability to an absent zero-memory recipient → route to/contextualize(the contextualize ↔ distill boundary). Demarcation: target-context observability (observable present context →/contextualize; absent zero-memory recipient → distill), transform-target (the result mutates to fit →/contextualize; the record's claims are preserved and only resolution means are added → distill), and monotonicity (non-monotone, mutation breeds new mismatches →/contextualize; monotone with respect to asserted claims → distill) - Stripping secrets (credentials, tokens, keys) from the target record —
/distillassumes a secret-free record; secret redaction is a separate concern handled upstream by a dedicated redaction agent, not part of the distill morphism.
Mode Deactivation
| Trigger | Effect |
|---------|--------|
| Fixed point reached with every residual surfaced | Produce the Certificate (judgments + outcome) and present the reception procedure as session text |
| User Esc at the Phase 3 Gate | Return to normal operation; residual untreated, no Certificate produced |
| Phase 0 detection finds no residue (Layer 2, AI-detected) | Deactivate silently — no residue and no explicit invocation to honor. An explicit Layer-1 /distill does NOT deactivate here: it runs the full certification and issues an AlreadyPortable Certificate backed by a real refuter Pass |
| Competence-substitution backstop trips at F5 (Rule 27) | Terminate this /distill invocation without a Certificate; surface the witness + a proposed recipient-owned-method contract, which the caller carries into a FRESH invocation — a graceful terminal, distinct from the Esc row above |
| Contract-provenance backstop trips at F5 (Rule 29) | Terminate this /distill invocation without a Certificate; surface the witness + a contract re-declared against the user's own words, which the caller carries into a FRESH invocation — a graceful terminal, distinct from the Esc row above |
Protocol
Phase 0: Tethered Detection + Contract Declaration
Verify the target record carries session-tethered residue, then declare the certification contract. Detection is silent; contract declaration is the first user-visible step when residue is present.
- Detect residue — scan target's own content for session-tethered references: undefined jargon, metric tokens, deictic anchors, author process narration, dangling task identifiers. The scan itself is silent. If none are present and the scan was AI-initiated (Layer 2 auto-detection), deactivate silently. An explicit
/distillinvocation (Layer 1) proceeds regardless: the clean scan is relay evidence carried into the run, and the certification completes F0→F7 so the AlreadyPortable Certificate rests on a real refuter Pass — never on the silent scan alone. - Declare F0 HandoffContract — fix the recipient profile's knowledge isolation (zero-memory) and the boundary — an open, user-declared Role naming who or what will consume the record (a reviewer, an implementer, an agent with substrate access — no protocol-owned enum) — the activity (optional: what, if anything, the recipient will do next), the allowed sources, the execution scope, the verification commands, the stop condition, and an optional certificate target — where the Certificate itself should land when the user wants it externalized; absent, it defaults to the session scratchpad — and it must name a location other than target itself, since a Certificate landed inside the record it certifies would edit the certified state after the final Pass — and one the session can actually write, checked at declaration time so a converged run never discovers an unlandable destination at F7 (both repaired at F0, surfaced as relay). Locator resolvability (
resolves_at, Rule 21) is judged unconditionally: a locator rooted in a temp/scratch/session-scoped location fails, and it must remain dereferenceable when the receiver re-checks it with its own tools at consume time. The contract is the premise every later phase reads. - Contract-provenance guard (F0) — mark each judgment-bearing contract field — activity, execution scope, stop condition, and allowed sources — against the constituting utterance: the verbatim user words that triggered the certification. A field is user-stated when its content is traceable to those words; it is ai-authored when the authoring session's own framing goes beyond them. When every tracked field is user-stated, proceed as relay. When any field is ai-authored, Stop before Phase 1 and present the delta for Confirm or Correct. This gate is dedicated and separate from the Phase 3 residual gate.
- Competence-substitution guard (F0) — before Phase 1, check the declared contract against
competence_substitution(Rule 27). A judgment-bearing activity must either leave method to the recipient or name a verified operative artifact. When neither holds, Stop: surface the misfit witness and a proposed recipient-owned-method re-declaration, and re-declare the contract before Phase 1. The witness question may be discharged upstream by running/gap(Syneidesis) on the certification decision before F0.
Scope restriction: Read-only investigation. Does NOT modify files or any external record (repair deltas are applied only at later passes' repair steps — Rule 12 — never during Phase 0). Dereferencing target through its substrate's read channel — including an externally-owned record's host CLI/API read, the read dual of the Phase 3 repair write channel — IS the Phase 0 observation itself, not an excluded external call: read-only, mutation-free. A target the session cannot dereference through any available read channel Stops here — surface for re-declaration of a readable locator; a record never read is never certified.
Phase 1: Deictic Closure + Grounding Closure + Decision Binding
F1 — Deictic closure (precedes grounding): Scan target's own content for surface tokens whose meaning is session-local. For each, build a substitution row: surface_token → canonical_ref → confidence → unresolved?. Tokens that cannot be resolved are marked unresolved = true and appended to the residual ledger (reason: unresolved) with surfaced = false. In the same pass, bind each decision-shaped item within target to a DecisionRecord{claim, ledger_ref?} (Rule 33): locate the durable record where the decision's rationale lives (this project: the git record — a commit message, an issue/PR body) and bind ledger_ref when found; leave it Null otherwise — a ledger-less decision is not a silent gap, it is an F6 measure leg.
F2 — Grounding closure (self-containment audit): For each item, classify how its content reaches the recipient:
- Inline — the evidence travels with the item (the recipient needs no external lookup).
- Stable-pointer — the item names a stable reference the recipient can resolve. The reference must resolve without the author session (
resolves_at(locator)) and remain dereferenceable and re-verifiable when the receiver checks it with its own tools at consume time. A locator rooted in an ephemeral or session-scoped location fails this test. Repair: inline the evidence, or relocate the content to a locator that resolves independently of the session. When neither is possible in-session, the item becomes a routed-residual and surfaces at the Gate. - Routed-residual — the item cannot be made self-contained; it is routed with a reason and appended to the residual ledger. Surfaced at the Gate before convergence — none reaches the recipient silently.
Scope restriction: Read-only investigation (Read, Grep, Glob). The read-only deictic scan and decision binding run as Extension (no gate); the items they cannot resolve become residual-ledger entries for the Gate.
Phase 2: Recipient-Relevance + Transformation-Provenance + Disposition
F3a — Recipient-relevance: For each item, judge whether it serves the declared activity (if any) and the boundary role. Items neither needs are disposition candidates for DROP; items either needs proceed to F3b.
F3b — Transformation-provenance: For each item, attest its provenance. The verdict is a two-way partition — ObservedKeep | Unknown (Change B), unchanged from the reception-verification refounding:
- ObservedKeep — a durable, directly-observable source coupled to the kept value by support-integrity. KEPT directly, no Gate. The default path for ordinary technical state.
- Unknown — no observable basis, or a claim that diverges from its observable source. Surfaces at the Gate.
F3 — Disposition: Assign each item a disposition from the UNCHANGED three-way coproduct:
- KEEP(inline) — retained inline; reachable via ObservedKeep or a Gate Resolve.
- ROUTE(StableRef) — carried by a stable reference; reachable via F3a relevance or a Gate Route.
- DROP — released; reachable via F3a relevance or a Gate Drop. A DROP-candidate whose discriminating content is target-resident is excision-pending: it surfaces at the Qd Gate (Drop confirms, Resolve/Route re-dispose, Defer per its semantics), and only the user's Drop lands the excision RepairDelta — its discriminating content (precision-bounded by the same
discriminatingtest the leak lint uses) is then removed from target at the pass's repair step, so the fresh recipient inherits kept and routed content only. An F3a DROP with nothing excisable settles autonomously. The item and its drop reason survive session-side inΛ.history, and no emitted surface (target, reception premises, any emit channel) mentions the drop. An excision whose span would touch content a KEPT or ROUTEd claim carries is not applied — it surfaces at the Gate as a disposition conflict.
Unknown-provenance items and conflicting dispositions enter Λ.gated and surface at the Phase 3 Gate.
Phase 3: Judgment Formation + Comprehension Gate + Residual Constitution
F4 — Judgment formation (Rule 30): Construct judgments(Λ), the Certificate's per-item record, from every KEPT or ROUTEd item: a KEEP item becomes RouteJudgment(item, Value(inline_evidence), basis); a ROUTE item becomes RouteJudgment(item, Reference(stable_ref), basis). basis names the ground that reached the disposition: a Value verdict cites its F3b observable source or the Gate's Resolve answer; a Reference verdict cites its F3b source, the Gate's Route answer, or — when routed by F3a relevance — the declared activity/boundary premise the route serves together with its locator's resolves_at check. DROP'd items carry no judgment.
F5 — Comprehension gate (zero-memory standard, refute posture, ALWAYS ON): Verify target's content and its judgments against a fresh-recipient comprehension standard. The primary realization is the zero-memory-refuter subagent dispatched with a fresh context, every certification pass — no optional layer. Its inputs are target's certified content (not a candidate emitted file — the record itself, in its current, already-repaired state), the judgments with their bases, the contract's recipient profile, boundary Role, and activity, the activation edge (reviewed under the minimal admissible edge), a session-term watchlist, a constituting utterance (scoped to checklist category 10 only), and the reception premises accumulated so far (scoped to premise deduplication: an already-premised claim is not re-Failed, while a new claim-defect and every resolution defect still count). The reviewer's posture is refute, not verify, sweeping the same fixed category checklist as before, re-anchored around the certification result: (1) coined names without in-target definition, (2) session identifiers, (3) deictic anchors, (4) unresolvable references — now including a Reference verdict's locator failing resolves_at or reception-time re-verifiability, (5) rendering accidents, (6) reception-procedure sufficiency — the prose-only deletion test: ignoring every agent-specific affordance, the declared activity must still be executable from target's certified content, the judgments' inlined values, the dereference step each Reference-verdict judgment implies (receiver-executable — a path, command, or id, not a vague pointer), and the allowed sources alone (the granted base the emitted reception procedure carries to the receiver), with the provided reception premises read as the premise list the receiver will reconfirm; a load-bearing step that is missing or non-executable is a Fail advised Resolve, (7) inference presented as evidence — now the RouteJudgment-basis attack: does each judgment's basis actually support its verdict, or is it the author's own reasoning dressed as a citable source? This is the category the basis field exists to make attackable, (8) activation edge defects, (9) operative procedure (Rule 27 backstop), (10) contract-provenance misfit (Rule 29 backstop), and (11) an emergent category. The verdict is evidence-cited; a Pass requires a per-category sweep trace. A Fail verdict names the blocking items; each is classified by claim_repair (Rule 31) — a finding whose repair would change what target asserts relays to Λ.reception_premises (surfaced in the reception procedure, never a residual, never re-looped); a finding whose repair only adds resolution means (a definition, pointer, dereference command, or inline evidence) is a resolution repair — applied in place and logged to Λ.repaired_targets, UNLESS that same (token, location) already appears in the log, in which case repair stops and the finding surfaces at the Gate instead (recurrence, not a counter). A record that directs the recipient to also read an uncertified sibling record is itself a Fail — portability requires one certified record.
Competence-substitution backstop (Rule 27) and Contract-provenance backstop (Rule 29): UNCHANGED in mechanism — either terminates the invocation without a Certificate and hands a re-declared contract to a fresh invocation, never entering a residual.
Gate (F3 + F5 surfacing, Constitution): Conditional on gate_domain(Λ) ≠ ∅. Present surfaced residuals, unknown-provenance items, disposition conflicts, and recurrence-blocked comprehension-gap findings via Cognitive Partnership Move (Constitution). When gate_domain(Λ) = ∅, A := None by identity and Phase 3 advances to Phase 4 without presenting a gate.
Pre-gate text output (Context-Question Separation): Present as text output before the gate:
- The substitution table rows that resolved
- The per-item disposition trace for items already disposed
- The residual ledger entries awaiting judgment, each with its reason and — for comprehension-gap entries — the cited evidence
Then present a per-item interaction for the surfaced residuals and unknown-provenance items:
How should this surfaced item be handled?
Options:
1. **Resolve** — supply the canonical reference or inline evidence: [what stable reference or inline content resolves it]
2. **Route** — carry it by a stable reference the recipient resolves: [the path, id, or command]
3. **Drop** — the activity does not need it; release it
4. **Defer** — set it aside until a named condition is met: [the re-trigger condition]
Every residual reaches surfaced = true through this gate. An Unknown-provenance item becomes KEEP only through a Resolve answer here, never by inference.
Phase 4: Audit/Lint Loop + Composite Premise Gate + Certification
F6 — Bounded audit/lint loop: Re-audit against the hygiene measure — unresolved anchors, unmet stop conditions, unsurfaced residual, leaked DROP content, missing RouteJudgment bases, unresolvable Reference-verdict pointers, and ledger-less decisions (Rule 33). These last three are mechanical, no-dispatch checks — the deterministic emit-side legs of certification — and repair the same way any other measure leg does: supply the missing basis, relocate the unresolvable pointer (inlining its evidence re-disposes ROUTE→KEEP — a Gate act, reached through a Qd Resolve), attach the missing ledger pointer. When a leg's mechanical repair fails, the affected item enters the residual ledger (reason: certification-leg) and surfaces at the Gate — a Resolve supplies what was missing, a Drop/Defer releases the item together with its judgment or decision record, so no basis-less judgment survives convergence. The exposure scan runs beside these legs: the dereference-reachable contents of each Reference-verdict locator and each granted source are read (read-only) for dropped items' discriminating tokens (a source the session cannot read, while dropped items exist, surfaces the same way — non-exposure cannot be certified for it) — a hit is detection-only, entering the residual ledger (reason: exposure) for Gate disposition (narrow or replace the exposing pointer, re-dispose the dropped item, release the routed item, or accept with an annotated Defer), because the exposing record is substrate-owned, outside the certification's write authority — it never joins the leak-free conjunct. When the measure reaches zero (or stabilizes with all residuals — including every certification-leg entry — surfaced, leak-free, every authored item disposed, and no open disposition conflict), the comprehension verdict is Pass, and the pass applied no repair delta, the loop is at its fixed point.
Qp — Composite premise gate (Rule 32): Fires iff Λ.outcome = Repaired(_) (a repair actually changed target), or contract.certificate_target ≠ Null (the user named an externalization target), or Λ.reception_premises ≠ ∅ (claim-repair premises will ride the reception procedure downstream) — that is, iff something is actually being carried downstream or externalized. On a bare, premise-free AlreadyPortable, session-scratchpad-only terminal, Qp does not fire: gating every "already fine, nothing to hand off" run would reintroduce the very gate storm the reception-verification refounding removed. When it fires, it captures, in ONE composite interaction: the consumer profile (human or agent, including substrate access) and the authority copy declaration (a derived copy, or authoritative at a named location). Qp's answer, Aq, is a product of both facets — it never touches A or A_tag (Rule 14 unaffected).
F7 — Certify: Assemble the Certificate: target, its target_identity (a revision-fixed form or content digest of the exact state the final Pass reviewed, bound at the terminal settle — F7's own lead action re-checks target's current state against it, a mismatch (a mutation after the final Pass, e.g. during the turn-yielding premise gate) re-entering the loop over the mutated state instead of certifying; the receiver's lead dereference step re-checks it again, so a post-certification edit is detected at reception rather than trusted under a stale label, Rule 24), and the activation_edge (binding the Certificate to the record, state, and edge it certifies — self-identifying when externalized), judgments, outcome (AlreadyPortable when Λ.repair_deltas = ∅, else Repaired over the emitted projection of Λ.repair_deltas — resolution deltas in full, excisions as content-free marks), and the reception_procedure (boundary role, the contract's granted sources, verification commands, execution scope, and stop condition — the execution base and declared frame the F5 verdict judged against, emitted so the receiver actually holds them — dereference steps for the receiver's own tools, and Λ.reception_premises). Target already carries every repair delta — resolution additions and drop-excisions, each applied in place at the repair step of the pass that classified it, none altering an asserted claim (Rule 12) — so F7 performs no further edit: it certifies the record's current state, the same state the final Pass verdict reviewed. The Certificate lands at contract.certificate_target when named, else the session scratchpad (session-local, dies with the session — consistent with a consume-time-bounded authority). An externalized or human-facing copy carries an emit-time stamp, a "reverification premised" mark (a human consumes without dereferencing, so the mark states that re-verification is a premise of trust, not a guarantee already discharged), and the inscribed authority-copy line ("derived copy, authoritative at X") from Qp's answer. DelegationBrief assembly stays at the session layer: Diylisis converges at organized session text — the reception procedure leading it — and the user carries that text downstream by their own action; the protocol does not assemble or dispatch a delegation brief itself.
After certification, trigger converge and present the convergence evidence trace.
Assurance Tiers
The label is record-relative: it attaches to target — the certified record Diylisis points at — never to a new content record (the one artifact Diylisis produces is the Certificate itself — the judgment layer over target, landing at certificate_target or the session scratchpad, never inside target; F7's Certificate names an existing record). Two tiers:
| Tier | Label | Process actually run | Honest claim |
|------|-------|----------------------|--------------|
| Draft | Uncertified draft | No Diylisis pass has run against target — plain Markdown, no F5 gate, no leak / durable-pointer audit | target carries no Certificate claim; its content is author-only and session-tethered until certified |
| Certified | Certified /distill | ONE always-on F5 comprehension-gate Pass (Rule 9; realization recorded in the verdict) + ONE leak / durable-pointer audit (Rule 18/21), reaching fixed point (Rule 10) | target carries a Certificate: the F5 gate reached Pass under the realization its verdict records (refuter-subagent / generic-subagent / lint-fallback — Rule 9's platform ladder; the label's claim is exactly that realization's rigor, never more), every RouteJudgment basis is grounded per Rule 30, and the leak / durable-pointer audit cleared. The label certifies target as of the Certificate's issuance, together with its emitted activation edge (Rule 26) |
Because Rule 9's F5 dispatch is unconditional — every certification pass runs the full gate under the strongest realization the platform offers, with no optional lighter layer — there is no partial-rigor middle tier: a target either has never been through F7 (Draft) or carries a Certificate from a completed pass (Certified). Within the Certified tier the verdict's Realization line is the honest rigor bound: a lint-fallback Pass certifies lint-fallback rigor, and the label never claims a refuter isolation that did not run. Format density within the Certified tier still scales with residue volume, but that density is a presentation choice, not an assurance claim.
Honest-label rule (the point of the tiers): Rule 24 states the boundary — the "Certified /distill" label attaches to target as of the moment F7 issued its Certificate, together with the emitted activation edge target was reviewed under. A later edit to target outside Diylisis, or a certification dispatched under a substituted edge — one that restates task content, grants the recipient context beyond target and its named sources, or points at a locator that does not resolve without the author session — breaks the verified reception conditions, and target carries no verified label regardless of how it reads (Rule 26).
UX Safeguards
Each guard's full Structure/Effect is articulated once, at its canonical location below — this table is a name-to-location index, not a second statement of it.
| Guard | Canonical location | |-------|---------------------| | Gate specificity | Gate predicate (Mode Activation § Activation) | | Contract-first | Rule 4 | | Deixis before grounding | Rule 5 | | Durable grounding | Rule 21 | | Silent-residual ban | Rule 6 | | Provenance hard line | Rule 7 | | Zero-memory comprehension | Rule 9 | | Certification invariant (portable(target, boundary)) | Rule 30 | | Resolution-repair discriminator | Rule 31 | | Composite premise gate (Qp) | Rule 32 | | Decision-ledger pointer | Rule 33 | | Competence-substitution guard | Rule 27 | | Contract-provenance guard | Rule 29 | | Repair-audit closure | Rule 25 | | Fixed-point loop | Rule 10 | | Emit-time leak lint (minimality dual) | Rule 18 | | Single certified record | Rule 9 | | Channel separation | Rule 11 | | Convergence evidence | LOOP § Convergence evidence | | Honest assurance label | Rule 24 |
Rules
- AI-detects, user-judges residual: AI detects session-tethered residue in target, normalizes deixis, audits self-containment, and attests provenance; surfaced residuals and disposition conflicts require user judgment via Cognitive Partnership Move (Constitution) at Phase 3. AI detection is implicitly confirmed when the user engages with the surfaced residual.
- Recognition over Recall: Present surfaced residuals, unknown-provenance items, and disposition conflicts as structured options with differential implications via Cognitive Partnership Move (Constitution); Constitution interaction yields turn before proceeding. The Gate binds to
A ∈ {Resolve, Route, Drop, Defer}(per TYPES). - Portability over Author Familiarity: A certification is portable when no load-bearing reference within target depends on the author session. Resolve, route, or surface every session-tethered reference rather than certifying it as-is on the author's silent familiarity.
- Contract is the premise: F0 declares target, boundary, activity, allowed sources, scope, verification, and stop condition before any relevance or minimality judgment. Recipient-relevance (F3a) judges against the declared activity and boundary; judgment formation (F4) is contract-relative completeness. Declare the contract first so these judgments have a premise, not an author guess.
- Deixis precedes grounding: F1 normalizes each session-local token within target to a canonical reference before F2 audits self-containment, so every grounded item names a stable referent.
- Silent-residual ban: Every routed-residual (F2), every unresolved token (F1), every unknown-provenance item (F3b), and every comprehension-gap item at F5 that is a resolution finding enters the ResidualLedger with
surfaced = falseand reachessurfaced = truethrough the Gate before convergence. A claim-repair finding (Rule 31) is not exempt from surfacing — it is surfaced through a parallel, equally non-silent route:Λ.reception_premises, carried in the emitted reception procedure the receiver reads. Volatile-rooted pointers are intercepted earlier, at F2's durable-grounding check (Rule 21). - Provenance hard line: F3b grants KEEP exactly two ways — and never by inference from appearance. (a) ObservedKeep (Change B): a durable, directly-observable source coupled to the kept value by support-integrity. KEPT directly, no Gate. (b) A user Resolve at the Gate. Every other state is Unknown and routes to the Gate. Support-integrity, not mere currency, is the ObservedKeep bar. Provenance authority is the KEEP hard line only.
- Minimal-complete, not minimal-aesthetic: F4 forms a judgment for exactly the items the declared activity and boundary need. The surfaced residual-ledger trace is preserved session-side (
Λ.residual_ledger/Λ.history), not in the Certificate: a Drop/Defer-released entry is excised from it (per Rule 12, enforced by the leak lint). - Zero-memory comprehension gate (refute posture, always on): F5 verifies against a fresh recipient with no session access via the
zero-memory-refutersubagent — fresh context, refute posture, dispatched every certification pass, with no optional layer. Inputs: target's own content (in its current, already-repaired state), the judgments with their bases, the contract's recipient profile, boundary Role, and activity, the activation edge (reviewed under the minimal admissible edge, its locator naming target directly rather than a to-be-created file), a session-term watchlist, the constituting utterance (scoped to checklist category 10 only), and the reception premises accumulated so far (scoped to premise deduplication: an already-premised claim is not re-Failed; a new claim-defect and every resolution defect still count). The verdict is evidence-cited; a Pass requires a per-category sweep trace. The checklist categories are unchanged in number and shape from the reception-verification refounding, re-anchored around the certification result: category 6 is now reception-procedure sufficiency — the prose-only deletion test (Change C) generalized: the declared activity must be executable from target's certified content, the judgments' inlined values, the dereference step each Reference-verdict judgment implies (receiver-executable, not a vague pointer), and the allowed sources alone (the granted base the emitted reception procedure carries to the receiver), with the reception premises passed as a scoped input read as the premise list the receiver will reconfirm; category 7, inference presented as evidence, is now the primary attack surface on each RouteJudgment'sbasis— a judgment whose basis does not actually support its verdict is exactly the finding this category exists to catch; category 4 additionally covers a Reference verdict's locator failing reception-time re-verifiability; a locator beyond the refuter's declared tool reach (a url, an external id, a command) is judged by its durability class perresolves_at's own criteria — a project-tracked path or an externally-durable reference (an issue, PR, or release artifact) passes, with the sweep row recording "beyond tool reach — judged by durability class" and the class evidence, and it is a finding only when its class is session-scoped/ephemeral or neither target nor its judgment supplies identifying context. A Fail verdict re-enters its blocking items per the claim/resolution/recurrence discriminator (Rule 31) rather than uniformly as comprehension-gap residuals — except an operative-procedure finding (category 9), which trips the Rule 27 backstop, and a category-10 finding, which trips the Rule 29 backstop; neither ever entersΛ.reception_premisesor the residual ledger. A record whose reception procedure directs the recipient to also read an uncertified sibling is itself a Fail. The refuter's tool ceiling (Read/Grep/Glob, execution evidence inadmissible) and the author-self-simulation exclusion are unchanged. Checklist status: the eleven categories are a projection of the portability principle (portable(target, boundary), Rule 30) — regenerable from that principle when circumstances change, not a fixed normative enumeration the principle merely restates; category 11 (Emergent) keeps the set open by design, and a sweep finding nothing in the fixed categories is not licensed to skip Emergent. Sync obligation: this rule, the F5 section, and the packagedagents/zero-memory-refuter.mdinscribe the same contract; an edit to either surface must sync the other in the same commit. - Fixed-point termination: F6 loops until the hygiene measure (unresolved anchors, unmet stop, unsurfaced residual, leaked DROP content, missing RouteJudgment bases, unresolvable route pointers, and ledger-less decisions) reaches its fixed point, conjoined with a Pass comprehension verdict. Not guaranteed to decrease pass over pass. Termination is the measured fixed point conjoined with a passing zero-memory gate, never a felt sense of completeness.
- Channel separation: F7 assembles the Certificate — judgments, outcome, and reception procedure (Rule 30's result type) — and, where it fires, the composite premise gate's answer. Within the Certificate the channels stay distinct: the judgments carry the certification's authority; the reception procedure (leading whatever session text the user carries downstream) complements them and holds no authority the judgments lack; the activation edge initiates and carries no content, naming the act and target, never task content (
content_free(activation)). - Claim preservation (history preserves, target releases): Substitution, grounding class, provenance verdict, and disposition annotate target's content; they never mutate it. Every mutation of target is a logged RepairDelta, applied in place at the repair step of the pass that classifies it: a resolution delta adds a definition, pointer, dereference command, or inline evidence beside an existing claim; an excision delta removes a DROP'd item's discriminating content — session bookkeeping the disposition released, its span bounded by the same
discriminatingprecision test the leak lint uses. An excision lands only on a Gate-settled Drop: deleting target text is the user's judgment (never relay), so a DROP-candidate with excisable target content is excision-pending and surfaces at Qd, while an F3a DROP with nothing excisable settles autonomously and needs no delta. Neither kind alters an asserted claim a KEPT or ROUTEd item carries; an excision whose span would touch kept-claim content routes to the Gate as a disposition conflict instead of applying. When target's substrate offers the session no write channel (an immutable published record — a committed commit message; an externally-owned record the session CAN write, such as an issue comment, is repaired through that record's own write channel), a would-be delta is never silently assumed applied: it routes to the residual ledger (reason: certification-leg) and surfaces at the Gate. A DROP'd item is preserved inΛ.historywith its drop reason — and appears nowhere the recipient reads: not in target after excision, not in any emitted channel (Rule 18), not in the reception premises. The fresh recipient continues from kept and routed content alone, learning nothing of what was dropped. The emit-time leak lint (F6/F7) backstops this: any DROP'd discriminating content surviving in an emitted channel — or in target's own current content — is aleaked_dropsdefect that increments the hygiene measure and blocks the fixed point. On a record whose substrate offers no write channel, a DROP with excisable content is therefore unreachable-as-clean: the coherent Gate resolutions are re-disposing the item (KEEP or ROUTE — the content legitimately remains, carrying a judgment) or exiting uncertified (Esc); a certification cannot claim the recipient learns nothing of a drop while the dropped content stays readable in the record. - Context-Question Separation: The substitution table, disposition trace, and residual-ledger entries appear as text output before the Gate; the Gate question contains only the surfaced item identifier and the four disposition options with their differential implications. Embedding context in the question fields is a protocol violation.
- Gate integrity (Safeguard tier): The Gate option set (
A_tag = {Resolve, Route, Drop, Defer}) is presented intact — injection, deletion, and substitution each violate this invariant. Qp's answerAqis a distinct product type and never touchesAorA_tag. Type-preserving materialization is distinct from mutation. - (vacant. Formerly "Ledger consumption is read-only; re-distillation writes the ledger", covering the CorrectionDelta ledger's read/append split. The ledger family it governed was deleted in the diylisis 1.0.0 refounding (reception-verification refounding, W1); the number stays vacant rather than being reassigned or the remaining rules renumbered, since Rules 27/29 and agents/zero-memory-refuter.md's checklist-category numbering are cross-cited by number.)
- Plain emit discipline: User-facing emit uses everyday language to reduce the user's cognitive load — every emit token should carry decision-relevant meaning, not project-internal overhead. SKILL.md formal-block vocabulary stays in the formal block.
- Round-local salience bundling: Each user-facing round bundles the current judgment, its nearest evidence, and the differential implication that matters for the next move.
- Emit-time leak lint (minimality dual): Before convergence, F6/F7 assert
leaked_drops = ∅— noΛ.droppeditem's discriminating content survives in any emitted channel (contract, judgments, reception_procedure, residual ledger, or the activation edge) or in target's own current content (the record the recipient dereferences joined the lint domain when excision joined the delta kinds). A surviving DROP increments the hygiene measure and blocks the fixed point. Target itself joins this discipline upstream: a DROP'd item's discriminating content is excised from target at its repair step (Rule 12), so the emit-channel sweep here is the residual guard, not the only barrier. The exposure scan is this lint's detection-only complement: F6 reads the dereference-reachable contents of each Reference-verdict locator and each granted source for dropped items' discriminating tokens; a hit enters the ResidualLedger (reason: exposure) and surfaces at Qd — the exposing record is substrate-owned, outside the certification's write authority, so the repair object is the pointer or the disposition (narrow/replace the pointer, re-dispose the item, release the routed item, or an annotated Defer), never the foreign record, and the hit never joins the leak_free conjunct (an unrepairable conjunct would livelock the fixed point). - (vacant. Formerly "Single canonical handoff (re-distillation discipline)", covering the re-distillation write-side discipline. The re-distillation/ledger machinery was deleted in the diylisis 1.0.0 refounding (W1); the surviving portability ground — a certification concerns ONE record, and a reception procedure directing the recipient to an uncertified sibling fails comprehension — now lives in Rule 9 and the CONVERGENCE §single certified record item. The number stays vacant per the same cross-reference discipline as Rule 15.)
- (vacant. Formerly "Constituted horizon (re-verification, never suppression)", covering
validity_horizontranscription and expiry semantics on the CorrectionDelta ledger. The ledger and its horizon machinery were deleted in the diylisis 1.0.0 refounding (W1). The number stays vacant per the same cross-reference discipline as Rule 15.) - Durable grounding: F2 classifies an item as StablePointer only when its locator resolves without the author session AND remains dereferenceable and re-verifiable when the receiver checks it with its own tools at consume time (
resolves_at). The same test applies to the activation edge's own locator and to every Reference-verdict RouteJudgment. Repair: inline the evidence, or relocate the content to a locator that resolves independently of the session; when neither is possible in-session, the item routes to the residual ledger and surfaces at the Gate. A DecisionRecord'sledger_refis a specialization of this same criterion, applied to decisions rather than general content (Rule 33): the pointer must be dereferenceable and re-verifiable the same way, and its absence is a measure leg, not a silent gap. This is a self-containment guard, not a provenance or relevance judgment. - Formal blocks are runtime-normative: This protocol's formal blocks are LLM-facing and constitutive of protocol identity: they type the prose and carry the operational contract executed at runtime. A reduced or single-shot realization carries every one of them through as runtime contract.
- (vacant. Formerly "Conditional correction ledger (handoff durability)", covering the
HandoffDurabilityclassification that conditionalized the CorrectionDelta ledger. Both were deleted in the diylisis 1.0.0 refounding (W1). The number stays vacant per the same cross-reference discipline as Rule 15.) - Honest assurance label: The label is record-relative — it attaches to
target, the certified record, never to a new content record (the Certificate — the one artifact produced — is the judgment layer over target, not part of it). Two tiers: Draft — no Diylisis pass has run against target; target makes no Certificate claim. Certified/distill— F7 has issued a Certificate for target: the always-on F5 gate (Rule 9) reached Pass under the realization its verdict records, and the leak / durable-pointer audit (Rule 18/21) cleared at fixed point (Rule 10). The label holds only as of that Certificate's issuance together with its emitted activation edge; a later edit to target outside Diylisis, or a dispatch under a substituted edge (Rule 26), reopens the tether and the label no longer applies. Detectability: the Certificate carriestarget_identity— a revision-fixed form or content digest of the certified state, bound at the terminal settle over the exact state the final Pass reviewed and re-checked by F7's lead action before issuance (a post-Pass mutation re-enters the loop over the mutated state instead of certifying) — and the reception procedure's lead dereference step re-checks it, so a post-certification edit is detected at reception (the record reads as Draft; re-certify), never merely declared invalid while a receiver trusts stale content. The rigor actually applied must never be over-claimed. - Repair-authored content re-enters disposition: Prose the author session writes while performing an F5 resolution repair or a leak repair is not exempt from disposition. Every authored item enters
Λ.authoredand re-enters Phase 1 on the next pass, where F1–F3 give it a substitution row, a grounding class, a provenance verdict, and a disposition. The fixed point is unreachable while any authored item is undisposed. - Activation edge: emitted and verified, not enforced: The edge is constructed at F0 (verb declared, defaulting to the minimal admissible edge; locator = target by reference), so F5 reviews a value that already exists from Phase 0. The protocol emits the activation edge as part of the Certificate's context, and F5 verifies target together with it under the minimal admissible edge. But the protocol cannot enforce that a dispatcher actually hands the recipient target with the emitted edge: an activation substituted at dispatch time breaks the reception conditions the certification was verified under, and carries no verified assurance label. Target already exists at F0 — there is no to-be-created-referent case this rule needs to special-case.
- Competence-substitution guard (F0 + F5 backstop): A certification carries what the recipient cannot cheaply re-derive — decisions, evidence, constraints, acceptance checks — and leaves the choice, application, adaptation, and verification of a method with the recipient: zero-memory removes session access, never that competence. F0 leg: a judgment-bearing activity (per
judgment_bearing) must either leave method to the recipient (recipient_owns_method) or name a verified operative artifact the contract itself grounds (contract_names_verified_operative); otherwise Stop and re-declare. The verb "implement" alone never trips. F5 backstop: ONE Fail finding requiringbehavior_repairon authored operative procedure suffices — terminate without a Certificate and hand the proposed recipient-owned-method contract to the caller for a fresh invocation. Placement: the F0 leg realizes at the Phase 0 → Phase 1 guard alongsidecontent_free(activation); the F5 leg realizes immediately after the Fail verdict's findings are typed into EvidencedFindings and before the claim/resolution/recurrence classification (Rule 31). Runtime line: (1) Role — inspected as evidence, or must the recipient adopt it? (2) Method substitution — could the recipient choose a different mechanism? (3) Assurance — if exact adoption is required, is it identified by exact revision with bounded, re-verifiable claims? Code-as-evidence is admissible; code-as-instruction is admissible only as an authoritative primitive or a verified operative artifact resolvable without the author session. Evaluator dual: the F5 realization's authority envelope is the refuter's declared tool set (Read/Grep/Glob); execution evidence is inadmissible. - Seam relay on declared continuation: when a user-declared chain or a composition edge this SKILL.md declares names the next protocol, the between-protocol seam after Diylisis's convergence is relay (Extension) — proceed directly, citing the settling source. This governs only the seam BETWEEN protocols; every Constitution gate inside Diylisis and the next protocol fires unchanged.
- Contract-provenance guard (F0 + F5 backstop): A contract carries exactly the task, scope, and stop condition the user's own words established — no more. F0 leg: at declaration, mark each judgment-bearing field (
activity,execution_scope,stop_condition,allowed_sources)user_statedorai_authoredagainst the constituting utterance. When every tracked field isuser_stated, proceed as relay; when any field isai_authored, Stop and present the delta for Confirm or Correct. F5 backstop: the refuter's checklist category 10 compares the contract against the constituting utterance and reports a finding whenactivityorexecution_scopeclaims more than the F0 gate's own record shows as confirmed; terminate without a Certificate and hand a re-declared contract to the caller for a fresh invocation. Placement: the F0 leg realizes at the Phase 0 → Phase 1 guard; the F5 leg realizes at the same site as the Rule 27 backstop, before the Rule 31 classification. Why a dedicated gate: direction and comprehension are different questions on different axes; folding a contract-provenance finding into the Phase 3 residual gate's four options would leave the direction question unanswerable there. - Certification invariant:
portable(target, boundary) ≡ fixed_point(Λ) ∧ every ResidualLedger entry surfaced ∧ leak_free(Λ)— a target is portable for a declared boundary exactly when Diylisis would converge on it (TYPES restates this; CONVERGENCE is its unfold). The result type is the Certificate:{ target; target_identity: TargetIdentity; activation_edge; judgments: List(RouteJudgment); outcome: AlreadyPortable | Repaired(deltas); reception_procedure: ReceptionProcedure }(target + target_identity + activation_edge bind the Certificate to the record, the exact certified state, and the edge it was verified under — self-identifying when externalized, a post-certification edit receiver-detectable per Rule 24) (TYPES is the authoritative statement; Rule 11 keeps the channels' roles distinct within it), replacing the prior PortableHandoff.certify: (target: StableRef, boundary: Role) → Certificateis the core relation;Diylisis(target, boundary, activity?, activation_verb?)is the full invocation carrying its additional declared parameters. Each KEEP-disposed item becomesRouteJudgment(item, Value(inline_evidence), basis); each ROUTE-disposed item becomesRouteJudgment(item, Reference(stable_ref), basis); DROP is excluded.outcome = AlreadyPortableexactly whenΛ.repair_deltas = ∅— the celebrated clean terminal: nothing new is created, and every judgment still carries its basis, so the reason target is portable is visible even when nothing needed fixing.outcome = Repaired(deltas)otherwise. Neitheroutcomenor aRouteJudgment.verdictis a new LOOP judgment or a new Disposition arm:Jstays{next_pass, converge, esc}andDispositionstaysKEEP | ROUTE | DROP— both are Certificate-level fields computed from the unchanged coproducts, not new coproduct members. - Resolution-repair discriminator (no counter): Every F5 Fail finding is classified, at the caller, by
claim_repair(f)— the same target-of-repair test that shapesbehavior_repair(Rule 27) and the category-10 contract-provenance test (Rule 29): does resolvingfrequire changing what target asserts (a claim, a premise, a decision's content), or only supplying a definition, pointer, dereference command, or inline evidence beside an existing claim? Aclaim_repairfinding is contract-content evidence, not a comprehension gap: no amount of document repair can resolve it, because the defect is in what target asserts, not in what supports it — it relays toΛ.reception_premisesas aDecisionRecord{claim, ledger_ref}, surfaced in the emitted reception procedure for the receiver to reconfirm at consume time, never re-entering the repair loop and never a residual. Aresolution_repairfinding (¬claim_repair) stays in the loop, routed by its repair site — the object the repair must change: a target-resident defect'sRepairDelta(resolution kind) is applied to target at this pass's repair step and logged toΛ.repaired_targetsby(quoted_token, location), so the next dispatch reviews the repaired state; a judgment-basis defect (category 7: a basis that does not support its verdict) repairs through the F6 basis leg — the judgment entersmissing_basesvia itsunsupportingarm, the basis is re-derived at next pass's F4 (target gaining a delta only when the basis lacks supporting evidence in it), and the(quoted_token, location)pair is logged toΛ.repaired_targetslike any other repair site, so a recurring category-7 finding on the same judgment blocks as recurrence and surfaces at Qd; an activation-edge defect (category 8) re-forms the edge declaration in place under F0's content-free discipline, relay-surfaced and reviewed by the next pass's F5; a contract-declared-field defect (a source grant, scope, or stop condition) routes to the Rule 29 backstop when the category-10 provenance test fires, and otherwise enters the ResidualLedger (reason: certification-leg) to surface at Qd, where a Resolve re-declares the field value on the user's authority — never a target delta, since repairing target for a contract defect would repair the wrong object. If that same pair recurs in a later finding, repair stops for it — not because a counter was reached, but because recurrence at an already-repaired location is itself evidence the repair family is not converging there; the finding surfaces at the existing Qd gate instead (Resolve/Route/Drop/Defer, Resolve bottoming out at user-supplied evidence), exactly as any other comprehension-gap residual would. This removes a third unbounded-by-repair family from the fixed-point argument (alongside Rules 27 and 29):Jis unchanged, no new contract instance, no new measure leg beyond the ones Rule 33 and this rule's own bookkeeping already name, and no new Disposition arm. - Composite premise gate (Qp): At convergence, before F7 certifies, one Constitution interaction captures the consumer profile (
recipient_class ∈ {human, agent}, plussubstrate_accesswhen agent) and the authority copy declaration (Derived, orAuthoritativeAt(location)) — merging what would otherwise be two separate dispatch-time questions (Task-domain settlement #3 and #4) into one. Its answer,Aq = (ConsumerProfile, AuthorityCopy), is a product — both facets are always answered together — and is structurally distinct from, and never touches,AorA_tag(Rule 14). Qp fires iffΛ.outcome = Repaired(_),contract.certificate_target ≠ Null, orΛ.reception_premises ≠ ∅: something is actually being carried downstream (a repair happened, or claim-repair premises will ride the reception procedure) or externalized (the user named a target beyond the session scratchpad). On a bare, premise-freeAlreadyPortable, scratchpad-only terminal — the default, celebrated success shape — Qp does not fire: gating every "already fine, nothing new" run would reintroduce the gate storm the reception-verification refounding removed.consumer_profilesets the common rendering parameter everyRouteJudgmentis realized under downstream (reference-vs-value mix, per the user's standing Externalization Publish Mode rule — realized one layer down, not modeled further here);authority_copy, when the Certificate is externalized, is inscribed IN THE ARTIFACT ("derived copy, authoritative at X") rather than left as session-only metadata. - Decision-ledger pointer: A decision-shaped item within target is bound, at F1, to a
DecisionRecord{claim, ledger_ref: Option(StableRef)}.ledger_refnames the durable record where the decision's rationale lives (this project: the git record — commit messages, issue/PR bodies, and their comments, where this project's decision chains in fact live); admissibility is theresolves_atcriterion — externally durable and dereferenceable — not a closed enum; the protocol does not model the ledger channel itself, only the pointer discipline. ADecisionRecordwhoseledger_refisNull— or names a locator that failsresolves_at(a session-local or broken pointer is no better than none) — is an F6 measure leg (ledgerless_decisions), repaired by attaching a pointer when one can be found — inscribed into target beside the decision claim as a ResolutionRepairDelta, so the pointer travels with the record itself (and rides the emitted outcome), never as a session-only Λ annotation that would die with the session; when it cannot, the decision's item enters the ResidualLedger (reason: certification-leg) and surfaces at the existing Gate (a Resolve supplies the pointer; a Drop releases the item and its DecisionRecord; a Defer(condition) releases it from this leg while binding the accepted gap as a deferred-annotated DecisionRecord into Λ.reception_premises per the fixed point's deferral discipline). A Qd Defer is the ONE user-constituted exception to the pointer obligation: the deferred premise travels unpointered but never silently — its deferral condition is rendered as the annotation on the emitted premise list, so the receiver reads an explicitly deferred premise, not a bare unpointered one. This is the F2 StablePointer criterion (Rule 21) specialized to decisions: dereferenceable and re-verifiable at reception time, applied to where a decision's WHY lives rather than to general content.