# The Experiments, The Deck, And The Table: Cards For Grants, Mandates, Facts, Evidence And Actions — And The Digital-Twin Claim Made Explicit

**version** v0.33.67
**date** 27 August 2026
**from** Human (project lead)
**to** Engineering, Architecture, the PKI/registry team, the RiskMandate team

**type** Dev brief — a convention, an object layer, and a second experiment

*The fourth 27 August brief. The chain room landed as intended — "this type of game like environment is exactly what we need to be experimenting right now" — and this brief carries the three instructions that came with the endorsement: experiments become a **convention**, each in its own folder, each focused on one workflow and one visualisation; the **objects** get visual forms of their own, because the room gave desks to the processes and nothing to the grants, mandates, facts, evidence and actions themselves; and the analogy to reach for is **card games and tabletop play** — multiple players, agents and systems alike, whose actions resolve against grants and mandates and produce consequences. Plus the question that reframes all of it: "in fact what we are doing here is creating the infrastructure for the digital twins, right?"*

---

## What This Is

Three things. **First, a convention**: `/experiments/`, one folder per experiment, each with its own generator, its own gates, and its own bench entry with a `does_not_prove` — the chain room moves to `/experiments/the-room/` as the first occupant, which costs nothing because nothing is deployed and nothing has users. **Second, the deck**: the five objects the project lead names — **grants, mandates, facts, evidence, actions** — each given a card form with a suit, so the object layer finally has a visual grammar the way the process layer has desks. A card is a rendering of a signed statement and nothing more; every field on it is derived from the artefact it cites. **Third, the table**: the second experiment, at `/experiments/the-table/`, where players — **the agents and the systems they interact with, both** — sit around a table and play action cards that resolve against the grants and mandates in front of them, producing consequences and evidence. And unlike the room, whose right half is a marked simulation, **the table's first scenario is one hundred per cent real**: it replays the estate's own incident of 26 August — the push refused by the hook, the mandate found to be wrong, the issuer amending it, the push landing — from the artefacts that incident left behind, with a gate that **re-runs the enforcement tool during the build** and fails if the table claims a refusal the tool does not reproduce. On the twin question: **yes, and the corpus already says so.** A grant document is a twin of an environment's capability surface; the room and the table are twin theatres; and a simulation is precisely *running proposed actions against the twin instead of against reality* — which is what makes it safe, and what makes it a rehearsal rather than a cartoon.

## 1 · The Convention

One experiment, one folder, one workflow, one visualisation. `/experiments/<name>/` carries the page and its stylesheet; `admin/build/gen_<name>.py` carries the generator and its gates; the bench carries the entry and its limits. A hub at `/experiments/index.html` lists them, generated from a manifest so the listing cannot drift from the folders.

The rules every experiment inherits, now stated once instead of per page:

1. **Every word derived at build time** from the files the pipeline runs on. No typed counts, no hand-written state.
2. **Real and synthetic never blend.** A surface is either derived from real artefacts or carries the SYNTHETIC marker beside every value, per the simulation rules.
3. **Every visual claim has a gate** that compares the drawing to the declaration — a route to a chain, a card to its source, a resolution to a re-run.
4. **Genre, not work.** Conventions of a genre — desks, verbs, cards, suits, hands, turns — are for using. A specific game's art, names, characters or wording are not. *Tabletop* is a genre; a named product is a work.
5. **Render it, screenshot it, read the screenshot** before shipping. Three of four known defects in this genre were invisible in source.

## 2 · The Deck — The Object Layer The Room Lacked

Asked directly: *have you added a scene and visual representations for grants, mandates, evidence, facts and actions?* Answered honestly: no. The room visualised the **process** — eight desks for the roles work passes through. The **objects** appeared only as dialogue. The deck fixes that, and the suits come straight from the two genres of v0.33.64's envelope:

| Suit | Object | Genre | A card is |
|---|---|---|---|
| **CAN** | grant (one node) | assertion | what this environment can reach, its tier, its evidence class, its date |
| **MAY** | mandate | decision | issuer, subject, allow-list summary, interval, prohibitions |
| **IS** | fact | assertion | a statement that something is the case: subject, predicate, `as_of`, stater |
| **SHOWS** | evidence | assertion | the method and class that back a fact; points at the statement it grounds |
| **DOES** | action | event | actor, verb, target, timestamp — the card that gets *played* |
| **DECIDES** | decision | decision | acceptance, amendment, revocation — the cards only people play |

Two rules make the deck a model rather than an art style. **A card is a rendering of a signed statement** — the same one-envelope-two-genres shape, so the deck *is* the primitive set wearing table clothes, and a card with a field no schema carries is wrong, not the schema. And **the resolution order is the ordering rule as game mechanics**: a DOES card resolves first against CAN (*is it reachable?*), then against MAY (*was it authorised?*), and its outcome mints an IS card backed by a SHOWS card. Blast radius is the CAN cards left face-up on the table that no MAY card covers — excess authority, dealt out where everyone can see it.

*Site-agent note:* the DOES suit is the genuinely new primitive. v0.33.64's seven cover who, what-is and what-was-decided; **actions are the events the whole apparatus exists to govern**, and they had no representation anywhere in the estate — which is the receipt gap of the book's Chapter 1, surfacing again. A DOES card is not a receipt (it is not signed by the actor at time of act), but it is the slot a receipt would fill, and the table makes the slot visible.

## 3 · The Table — Whodunnit, Played Forward And Backward

**The players include the systems.** This is the instruction the room only half-followed — its stations were roles; the table's players are principals with hands: **The Agent** (the real session identity), **The Hook** (git's enforcement point — a system, playing reactions), **The Issuer** (the fixture root, playing DECIDES cards), **The CI Runner** (library entry #2 — the environment a permitted push lands in, holding its own alarming CAN cards, unrestricted egress among them).

**The first scenario is real, and that is its entire value.** The estate's own 26 August incident, from the artefacts it left behind:

| Turn | Card played | Resolves | Reaction, quoted from the transcript |
|---|---|---|---|
| 1 | The Agent DOES `push claude/**` | CAN ✓ (node n3) · MAY ✓ (v1) | permitted; work crosses to the CI Runner |
| 2 | The Agent DOES `push dev` | CAN ✓ (node n3) · **MAY ✗ (v1)** | **PUSH REFUSED BY A MANDATE** — the hook's banner, real bytes |
| 3 | The Issuer DECIDES `amend v1 → v2` | citing the authorisation that actually existed (GM12) | a new MAY card enters play, carrying its citation and interval |
| 4 | The Agent DOES `push dev` | CAN ✓ · MAY ✓ (v2) | permitted; the site deploys; tag `v0.1.28` is the timestamp |

Turn 3 is the whole estate in one move: **the remedy for a refusal was a DECIDES card, not a bypass** — the mandate was wrong, and the refusal is what forced the authorisation to be written down.

**And then the whodunnit: the same scenario walked backward.** Start from the consequence — *the site deployed* — and turn the cards over one at a time: which DOES produced it, which MAY permitted that, who DECIDED that MAY into existence, citing what, and which SHOWS cards prove each step. Forward is the simulation; **backward is the audit**, and they are the same cards in the same order. That is the register's promise — *was it valid last Tuesday?* — as play.

**The build gate that keeps the table honest is live:** the generator **re-runs `mandate.py check-branch`** against the mandate each turn names, during the build. If the table shows a refusal the tool does not reproduce, or a permit it refuses, the build fails. The reactions are quoted from the captured transcripts by byte, not paraphrased.

## 4 · The Digital-Twin Claim, Grounded

> *"In fact what we are doing here is creating the infrastructure for the digital twins, right?"*

Yes — and it is already in the corpus, not as ambition but as the model's spine. The grounding ladder runs *fact grounds to evidence, evidence grounds to measure, **measure is taken on a twin, a twin is grounded in its connection to reality***. The Grant & Mandate lexicon opens its chain with *TWIN — that installation, the thing every fact attaches to*. The library entry **is** a twin: a measured, dated representation of one environment, good exactly as far as its connection to reality and honest about where that connection was refused (`unknown`, the air gap held as a tracked gap rather than drawn as though it connects).

What the experiments add is the layer the corpus names and nobody built: **the twin as a place where actions can be rehearsed.** A simulation is running a proposed DOES card against the twin instead of against reality — same resolution order, no consequences. That gives the three uses in the memo their precise forms:

| Use | Is |
|---|---|
| *Explain to new users/customers* | Replay a recorded scenario on the twin — the table's mode today |
| *Visualise what the agents are doing* | Stream real actions onto the table as they happen — the same surface, live-fed |
| *Simulate actions and reactions* | Play a **proposed** action against the twin before reality sees it: would this push be refused? what would it reach? what has no MAY card over it? |

The third is the one with product gravity, and it is worth naming what it requires and does not: it requires nothing from RiskMandate, no new schema, and no new engine — the resolution order plus the twin plus the enforcement tool *is* the engine, and the build gate already runs it. What it does require is that twins stay fresh, which is the drift mechanism the library already demonstrates. **A twin that is not re-measured is a stale delta with a nicer name.**

## 5 · What Ships In This Round

1. `/experiments/` + hub, generated from a manifest. The room moves to `/experiments/the-room/` — no deployment exists, so the move is free.
2. `/experiments/the-table/` — the deck (one exemplar card per suit, each derived from a real artefact and linking it) and the four-turn replay, playable forward, with the backward walk as the epilogue.
3. `admin/build/gen_table.py` with the gates: every card field re-derived from its cited source; the live check-branch gate on every resolution; turn count and card counts computed; the reaction text byte-checked against the captured transcripts.
4. Bench entries for both experiments; the room's entry updated for its new address.

## 6 · What This Does Not Claim

- **The table replays one incident.** One scenario, four turns, one agent, one control. It demonstrates the mechanics, not coverage.
- **A DOES card is not a receipt.** Nothing here is signed by the actor at the time of action; the table shows where receipts would sit, which is not the same as having them.
- **Proposed-action simulation is specified, not built.** Today the table replays; it does not yet accept a hypothetical card. That is deliberately the next experiment, not a stretch of this one.
- **The genre bets remain bets**, now three implementations deep across two estates, still with zero user tests.

---

## Honest Tensions

| Tension | Note |
|---|---|
| A convention declared after two data points | The room and the table are n=2. The convention is cheap to hold and cheap to revise, and writing it down is what makes the third experiment cheap |
| Cards are charming, and charm overclaims | Bounded the same way the room bounds it: every card cites its artefact, every resolution is re-run, and the one suit with no signatures behind it (DOES) says so on its face |
| The twin language invites grandeur | The claim is kept exact: a twin is a measured representation plus a stated connection to reality, and the estate's own twins are floors with named holes. Infrastructure for digital twins, yes — the twins themselves are two, and thin |
| Moving the room one release after shipping it | Free only because nothing is deployed; done now precisely because that window closes |

---

*CC BY 4.0. Sources: the project lead's memo of 27 August 2026; graphs.sgit.ai (the grounding ladder; twins and the air gap); the Grant & Mandate pack (the lexicon's TWIN; GM12); this repository at v0.1.42, including the captured enforcement transcripts. Every quotation verbatim, re-read from its source.*