06 — The MVP
Summary
The build order puts the branch constraint first — one afternoon, a few lines added to a session-end hook that already reads the branch, closing the measured gap where the push is enforced and the branch is only prose. It demonstrates the whole thesis end to end: a mandate, the grant it does not cover, the delta, and the delta closed by an enforcement point that already existed. Then the grant measurement (done for one environment already), the two schemas, the mandate, the skill, and the Cedar compilation target. The acceptance test ends with attempting a prohibited action and being refused by something that is not the agent — until that passes, everything is instrumentation. Deliberately excluded: the risk register (downstream, in the risk product), a new policy language, an identity design, a hand-written grant, an enforcement skill, a census, and a wallet.
Key concepts
- Branch constraint first — the smallest real thing, and it makes a declared mandate mechanical
- What ships where — library and schemas in the registry; instance, screens and risks in the risk product
- The acceptance test — refused by something that is not the agent
Key ideas
- The risk derivation — delta to risks with the plug profile — is the risk product's, at the end of the chain.
- Only the vault survives a device, so it is the natural home for a built pack — offered, not defaulted.
- A design pack ahead of a built product: the registry half has one measured entry, the risk half is specified.