# Change Control

**pack** Grant and Mandate · draft-1 · 26 August 2026
**role** Every correction and every decision, in the discipline this estate uses: the pack supersedes rather than rewrites, and what a later reading changes is recorded here rather than folded silently into the documents above.

---

## The rule this page implements

A claim, once published, is not edited. If it is wrong or overtaken, an entry here supersedes it and says so. Read this page **second** if you are about to build from documents 00–06, so you read them with the errata in hand; **last** if you are reading the pack through. Never not at all.

## Corrections from the two source briefs (v0.33.62, 26 August)

### GM1 — The grant is discovered, not authored

**Source:** the permissions-file brief.
**The rule:** a hand-written grant file is a wish; it records what somebody believed on the day they typed it, which is the thing a grant is not. So the grant document is **generated by measurement, dated, provenance per node**, and a node with no evidence is marked `none` rather than omitted. Consequence: drift is answered by re-measuring and diffing, not by asking anyone to remember.
**Status:** adopted as the pack's load-bearing rule (documents 02, 03).

### GM2 — Grant is authority, not authorisation

**Source:** the permissions-file brief.
**The refinement, one word and it matters:** the mandate is authorisation (somebody decided it); the grant is **authority that nobody decided**. Calling the grant "implicit authorisation" concedes the point the vocabulary exists to make. And under apparent authority the outside world treats the grant as binding anyway — so *the mandate is actual authority, the grant is apparent authority, and binding regardless.*
**Status:** adopted (document 01).

### GM3 — The library belongs to the registry, the instance to the risk product

**Source:** the pack-spec brief.
**The data rule, stated harder than the memo:** the registry holds the library (public, no personal data ever); the risk product holds the instance (all personal data, never published); and **the instance stores references, never copies.** This keeps the library versionable and makes a finished pack shareable without describing anyone's estate.
**Status:** adopted as the architecture (documents 00, 03, 06).

### GM4 — Reality before the risk register

**Source:** the pack-spec brief, correcting its own approach mid-sentence.
**The ordering rule:** reality → twin → facts → finding → risks → decisions, and it is a **constraint**, not a preference. The first screen is *which environment*, never a risk. A pack whose first screen is a risk register reproduces the habit it was written to fix.
**Status:** adopted; enforced by the screen order (documents 01, 05).

### GM5 — The comparison has three terms, and the blind-spot delta is the argument for the library

**Source:** the pack-spec brief.
**The addition:** an agent reporting its own grant is instrument and subject, so a self-report is a floor, unfalsifiable alone. `library − self-report = blind spots` is the third term that corrects it, and it is the most persuasive number in the flow.
**Status:** adopted (documents 00, 01, 05).

### GM6 — Memory gives the grant a time axis

**Source:** the pack-spec brief.
**The consequence:** with history retained, the grant is a **union over prior sessions**, not a tree over the present. Two identical installs have different grants if their histories differ, so the library publishes the static term and the instance carries the accumulated term. The grant document gains a `history` field that changes the meaning of every node.
**Status:** adopted (documents 01, 02, 05).

### GM7 — Adopt Cedar; adopt the graphs-site conventions; build only the mandate

**Source:** both briefs.
**The inventory result:** Cedar already provides default-deny evaluation outside the agent's loop and states it does not do identity, so it composes with the registry — adopt, do not reinvent. The graphs site already publishes the lexicon, edge sets, provenance chains and a drift gate — adopt. The **one thing nothing provides is the mandate document** with an issuer and an interval — build that.
**Status:** adopted (documents 00, 02, 04).

### GM8 — The naming checks

**Source:** the pack-spec brief.
`card` and `pack` clean and kept; `passport` set aside (tested before, misfits); **`wallet` avoided** — taken by the payments work, and it promises a held-credential model this design does not use.
**Status:** adopted (document 00).

## What the pack's own construction added

### GM9 — The first library entry measured the environment that wrote the pack, and it refused to measure itself

**Source:** this pack, document 03 and the [first library entry](../library/claude-code-remote__ccr-container__2026-08-26.json).
**What happened:** the site agent generated the first grant by measuring its own Claude Code Remote container. A single self-measurement probe — read the harness settings and hooks, sweep egress hosts, check escalation — was **refused by an account-level classifier that evaluates outside the agent's loop.** The refused nodes are marked `unknown`, not guessed.
**Why it belongs here:** the refusal is a **boundary-tier control observed working on the measuring agent itself** — the cleanest possible demonstration of the pack's own three-tier test, produced by accident. And it confirms GM5 by a hard route: the measurer genuinely could not census itself, so *floor, not census* is not a caution, it is what the first entry literally is.
**Status:** recorded; the entry ships as the library's first point with its holes marked.

### GM10 — Node n3 is the thesis, live

**Source:** the same entry.
The measured environment can push to the release branch of a repository that deploys a public site, and **nothing mechanical checks which branch** — the constraint is prose (`expectation` tier). In this session explicit permission was given first, so the mandate worked *as an expectation*, not as a mechanism. That is exactly the gap build-order step 1 closes.
**Status:** recorded as the worked example the branch-constraint fix addresses.

### GM11 — Build-order step 1 is built, and the acceptance test passed

**Source:** this pack, [document 07](07__enforcement.md), 26 August 2026.
**What was built:** a mandate document (issuer-signed, interval-bearing, allow-list stored and prohibitions generated), a tool that issues, verifies and evaluates it, and a `pre-push` hook that git runs and that refuses by exit code.
**The test, executed:** `git push origin HEAD:dev` against a mandate permitting only `claude/**` produced `error: failed to push some refs`; `origin/dev` was unchanged; a push to `claude/**` in the same minute succeeded. **The refusal came from git, not from the agent deciding to comply** — the acceptance test's last sentence, and the only part of it that could not be faked.
**The tier reached, stated rather than claimed:** **setting**, not boundary — the hook is inside the grant it bounds (`--no-verify`, unsetting `core.hooksPath`, or editing the file all get past it). Exactly the move the permissions brief predicted, tier three to tier two, and no further. A boundary is the same allow-list evaluated where the agent cannot reach it: branch protection, or a required CI check.
**Status:** adopted. Two design choices recorded with it — the hook **reads the mandate at runtime rather than compiling a copy** (a compiled copy drifts exactly as a stored delta goes stale), and it is **default-deny** (missing, unparseable, mis-signed or expired all refuse), the adopted Cedar discipline, which does carry the cost that a broken mandate file stops all pushes.

### GM12 — The control refused the release that was carrying it, and the remedy was to amend the mandate

**Source:** the same document.
**What happened:** within the hour, the hook refused the release push that would have published document 07. The correct remedy was **not** `--no-verify` and **not** editing the hook. Mandate v1 was simply **wrong** — narrower than the authorisation that actually existed, since the project lead had granted `dev` pushes explicitly on 25 August. So the issuer **amended it**: v2 supersedes v1, permits `claude/**` and `dev`, cites the instruction, and carries an interval scoped to the MVP stage. Branch-scoped excess authority went from `['dev']` to `none`; `main` is still refused, because nobody authorised it.
**Why it belongs on the record:** *issue -> refuse -> discover the mandate was wrong -> amend with a citation and an interval* is what a mandate is **for**, and it is only visible because the constraint was mechanical. **An expectation that was too narrow would have been silently ignored and nobody would have learned anything: the refusal is what forced the authorisation to be written down.** It will also look, to a sceptic, exactly like moving the goalposts, which is why the amendment carries its citation and its interval rather than a wider allow-list and no explanation.
**Status:** recorded; the amendment path is the designed one and is now demonstrated.

### GM13 — The measurement caught its own tier change, unprompted

**Source:** `tools/measure.py`, run 26 August after the hook was installed.
The tool independently reported node n4 as `setting` where the 26 August library entry recorded `expectation`, because it probes `core.hooksPath` rather than being told what to say. That is [document 03](03__library.md)'s drift table working in the *somebody improved something* direction, on the first re-measurement, one commit after the improvement — and the alarming direction (`setting` to `expectation`: a control removed while nothing broke) is the same diff read the other way, so it now has a working detector rather than a described one.
**Status:** recorded. It is also the first evidence that the measurement method is reproducible by something other than the session that wrote the entry.

### GM14 — The authority is a fixture and the enforcement is not, and they are independent

**Source:** [document 07](07__enforcement.md).
The mandate's issuer is the registry's operator root, whose private half is **published**. So anybody can forge this mandate, and the hook would enforce the forgery exactly as diligently. **A hook enforcing a fixture-signed mandate is real enforcement of an unaccountable instruction** — the two halves come apart, and a report giving only one of them misleads in whichever direction it omits. Closing the authority half needs a real issuer key, which is the enrolment path the registry already ships and nobody has walked.
**Status:** recorded as a standing limitation of every demonstration built on the fixture root.

### GM15 — The library has a second entry, and it is the other end of node n3

**Source:** [library entry #2](../library/github-actions-runner__ci__2026-08-26.json), measured by `tools/measure.py` running inside a GitHub Actions runner (run 32984977257, 26 August 2026).
**Why this environment:** entry #1 ends at a push (node n3). **This is what happens next.** So the two entries join at that edge and together they are the blast-radius path, rather than two unrelated points in a list — which is what a library of measured grants is *for*, and what a single entry could not demonstrate.
**The contrast, which is the useful part:** the hosted agent sits behind a **mandatory egress proxy** (a non-allowlisted host was connection-reset); the CI runner that deploys its work reached **every host tested, unrestricted**. The agent **retains a session record**, so its grant is a union over prior turns; the runner retains **nothing**, so its grant is a tree over the present — the clearest illustration in the library of why the `history` field changes the meaning of every node. And the runner's grant is the only one in either entry **declared up front**, in a `permissions:` block set above the job that the job cannot widen: the one genuine boundary that was *designed* as one rather than discovered.
**Status:** adopted as the library's second entry.

### GM16 — The second measurement found two defects, both by measurement rather than review

**Source:** the same entry.
**The first is in the tool, and it is the pack's own warning turned on itself.** Node n1 labelled the OS user separation a `boundary`; node n1a recorded that passwordless `sudo` **succeeds**. So the separation is defeated by a capability the same grant includes — a **setting**, by the pack's own test, mislabelled as a boundary by an automated measurer. The cause: the tool evaluated each node **in isolation**. *A tier is a property of a node's relationship to the rest of the tree, not of the node.* The tool has been corrected to decide n1 against the escalation result; the entry keeps the original label under `SUPERSEDED_BY` so the defect stays visible rather than being tidied away.
**The second is in the control built yesterday.** Node n4 reports `core.hooksPath=unset`, tier `expectation` — in a repository whose tree **does** contain `.githooks/pre-push`. The hook file is committed; **the git config that activates it is local and does not travel.** Any fresh clone — a runner, a new contributor, the same agent in a new container — gets the file and not the enforcement, and nothing announces it. **The control is one un-run command away from being absent.**
**Consequence:** it strengthens GM-D26 rather than weakening step 1. A boundary is the same allow-list evaluated where the agent cannot reach it — branch protection, or a required CI check — and that needs no per-clone setup step at all.
**Status:** the tool defect corrected; the hook limitation recorded as decision GM-D28 rather than silently patched.

### GM17 — The deliveries are now recorded, not only the corrections

**Source:** [document 08, the build record](08__build-record.md), 26 August 2026.
**Why it was needed:** this estate records every correction meticulously and had recorded **no deliveries at all**. The cost was visible: three days after the register shipped, the registry pack still described its own subject as *entirely unbuilt* in three places, because nothing in the discipline obliged anyone to write down that something had been finished. **A corpus that records only its corrections will misstate what it has built — and in this case it understated it.**
**What the record covers:** four releases (v0.1.26–v0.1.29), each row naming a fetchable artefact so a reader checks the claim rather than takes it; the four findings that cost something to record (GM12, GM13, and GM16's two defects); what the readiness report's six blocking questions became — three closed by execution, three still open; and a flat list of what remains only written down, because a build record that lists only deliveries is a sales document.
**The correction it forced elsewhere:** the registry pack's [C33](../../registry-mvp/change-control.html) supersedes its own *unbuilt* status, and C34 records the readiness report and the three questions the build answered.
**Status:** adopted. The build record is maintained alongside change control, not instead of it.

### GM18 — The blocks caught a schema violation in the pack's own library, on first render

**Source:** [document 09](09__building-blocks.md) and the [block gallery](../blocks.html), 26 August 2026.
**What happened:** the gallery renders the real library entries rather than mockup data. On its **first render** it produced two evidence badges the stylesheet had no class for — `unevidenced` (twice) and `documented + observed` (once) — none of which is one of the five classes [document 02](02__schemas.md) defines.
**Where they were, and that is the finding.** All three were in **library entry #1, which was hand-assembled.** Entry #2, generated by `tools/measure.py`, had **no drift at all** — its vocabulary is whatever the tool emits, and the tool only emits the five. So [GM1](99__change-control.md) — *a grant is discovered, not authored* — proved itself on this pack's own data: **the hand-written document violated the schema and the measured one could not.** The rule was adopted as a claim about wishes versus facts; it turns out to be a claim about vocabularies too.
**What was done:** the three values corrected to the schema's classes (`none`, `none`, `observed`), with the correction recorded inside the entry's `measurement_honesty` block rather than applied silently. And `gen_blocks.py` gained a **hard guard**: an unrecognised tier or evidence class now **fails the build**, verified by injecting one and watching it exit non-zero. *"A schema change breaks the build rather than the integration"* stops being a promise in document 09 and becomes a check.
**Status:** adopted; decision GM-D31.

### GM19 — The live mandate names a capability the vocabulary does not contain

**Source:** the workbench (../../workbench/index.html), 30 August 2026 — found while wiring the decision engine to the registry's comparison rule.
**What happened:** `registry/capabilities.json` declares **exact string equality as the only comparison** (containment is deliberately undefined), and declares `repo.contents.write`. Mandate v2 — the estate's one live, signed mandate — allows **`repo.contents.push`**. Under the registry's own rule those are simply different strings: the primary mandate's capability is **outside the declared vocabulary**, and has been since it was issued.
**Why nothing noticed:** the pre-push hook compares the mandate against the *attempted push*, never against the vocabulary — enforcement and vocabulary never met until an engine tried to use both. This is the admitted absence (a capability vocabulary that does not exist, pack decision 6 open) producing a concrete defect rather than an abstract gap.
**What was done:** nothing silent. The workbench surfaces it as a `warn` on every relevant evidence pack rather than normalising `push` to `write`, because an engine that quietly maps one string onto another has invented the containment rule the registry refuses to define. The reconciliation — rename in the mandate, rename in the vocabulary, or define comparison — is the project lead's, since decision 6 is theirs.
**Status:** recorded, deliberately unfixed; feeds decision 6.

## The decisions register

| # | Decision | Made by / where | Status |
|---|---|---|---|
| GM-D1 | The grant is generated by measurement, never authored | v0.33.62 permissions brief (GM1) | **Settled** |
| GM-D2 | Grant is authority, not authorisation; apparent authority binds anyway | v0.33.62 (GM2) | **Settled** |
| GM-D3 | Library in the registry, instance in the risk product, references not copies | v0.33.62 pack-spec (GM3) | **Settled** |
| GM-D4 | Reality before the risk register, as a constraint | v0.33.62 (GM4) | **Settled** |
| GM-D5 | Three-term comparison; blind-spot delta is the library's justification | v0.33.62 (GM5) | **Settled** |
| GM-D6 | `history` field on the grant; static term in library, accumulated term in instance | v0.33.62 (GM6) | **Settled** |
| GM-D7 | Adopt Cedar as the compilation target for the allow-list | v0.33.62 permissions brief (GM7) | **Settled — adoption, not build** |
| GM-D8 | Adopt graphs.sgit.ai lexicon, edge sets, provenance, drift gate | v0.33.62 pack-spec (GM7) | **Settled** |
| GM-D9 | The mandate document (issuer + interval) is the one thing to build | v0.33.62 (GM7) | **Settled — the gap** |
| GM-D10 | The delta is computed, never stored | v0.33.62 + registry pack C7 | **Settled** |
| GM-D11 | Allow-list stored, prohibitions a dated generated view | v0.33.62 + registry pack C12/C17 | **Settled** |
| GM-D12 | The skill discovers/declares/diffs and must not enforce | v0.33.62 permissions brief | **Settled** |
| GM-D13 | Build the branch-constraint-in-a-hook first | v0.33.62 permissions brief | **Settled — build order step 1** |
| GM-D14 | `wallet` avoided; `passport` set aside; `card`/`pack` kept | v0.33.62 pack-spec (GM8) | **Settled** |
| GM-D15 | Who measures a library entry, with what authority? | pack doc 03/06 | **Open — the measurer is the subject** |
| GM-D16 | How often is an entry re-measured? | pack doc 03/06 | **Open — ages on the vendor's schedule** |
| GM-D17 | Does the instance record which library version it referenced? | pack doc 06 | **Open — otherwise change is unattributable** |
| GM-D18 | The exact history-window field | pack doc 02 | **Open — differs per product and plan** |
| GM-D19 | Where the built pack lives (browser / vault / file) | pack doc 06 | **Open — only the vault survives a device** |
| GM-D20 | Is the blind-spot number published per agent? | pack doc 05 | **Open — it is a vendor comparison either way** |
| GM-D21 | Can a hook trust the mandate file it reads? | pack doc 06 | **Open — the registry is what makes it checkable** |
| GM-D22 | Corpus version for this pack | — | **Open — assigned on adoption** |
| GM-D23 | The hook reads the mandate at runtime rather than compiling a copy | pack doc 07 (GM11) | **Settled — no drift between policy and enforcement point** |
| GM-D24 | Enforcement is default-deny: missing/unparseable/mis-signed/expired all refuse | pack doc 07 (GM11) | **Settled — Cedar's discipline, and it does stop work when the file breaks** |
| GM-D25 | A refusal is remedied by amending the mandate, never by bypassing the control | pack doc 07 (GM12) | **Settled — demonstrated by v1 to v2** |
| GM-D26 | Reaching tier *boundary* means the same allow-list evaluated off-machine | pack doc 07 (GM11) | **Open — branch protection or a required CI check: a change of location, not policy** |
| GM-D27 | Who issues a real (non-fixture) mandate for this estate? | pack doc 07 (GM14) | **Open — needs a real enrolment; the registry ships the path** |
| GM-D28 | The pre-push hook does not travel with a clone (`core.hooksPath` is local config) | library entry #2 (GM16) | **Open — a per-clone setup step, or move the check off-machine per GM-D26** |
| GM-D29 | A tier is decided against the tree, never in isolation | library entry #2 (GM16) | **Settled — tool corrected; the mislabelled node kept visible** |
| GM-D30 | Deliveries are recorded in a build record, beside the corrections | pack doc 08 (GM17) | **Settled — the discipline recorded corrections and no deliveries** |
| GM-D31 | The block gallery renders real documents, and unrecognised vocabulary fails the build | pack doc 09 (GM18) | **Settled — verified by injecting a bad value** |
| GM-D32 | Does the risk product consume this stylesheet, or fork it? | pack doc 09; project lead, 26 Aug | **Settled — RiskMandate CONSUMES it. The library/instance split argued for it and the project lead confirmed: two products, one component contract** |
| GM-D33 | `evidence-pack/v0` — a decision emits a pack: checks with sources, delta, twin age, enforcement tier, `does_not_prove` | the workbench, from the 27 Aug memo (evidence packs, real-time checks) + the service-twin brief's receipts | **Proposed — introduced by the workbench, not yet adopted by the pack; the next consumer should be an agent at a real decision point, `mode: enforcement`** |
| GM-D34 | How does the engine compare a mandate capability against the vocabulary? | GM19 — the live mandate's `repo.contents.push` vs the declared `repo.contents.write` | **Open — exact equality says they differ; silently mapping them would invent the containment rule the registry refuses to define. Feeds decision 6, the project lead's** |
| GM-D35 | The `acceptor` seat in the excess-authority view may be filled by a **policy reference** — the insurer as acceptor of last resort; the chain's terminal node reads *…risks → decisions / acceptances / policies* | the v0.33.71 insurance pivot brief, 30 Aug | **Proposed — the pivot is recorded, no surface is rebuilt on it until adopted** |
| GM-D36 | `policy/v0` and `loss-event/v0` join the schema family: the registry defines the shapes, the instance holds the instances (GM3 unchanged) | v0.33.71 — the loss event named as the one primitive the estate lacks | **Proposed — shapes not yet drafted; whoever's schema records loss events owns the eventual actuarial table** |
| GM-D37 | The first demonstrable insurance shape is **parametric**: triggers computed over evidence packs, payout table keyed to capability strings | v0.33.71 — the memo's payout logic, named | **Proposed — a workbench demonstration on fixtures awaits the project lead's yes (N16)** |
| GM-D38 | **Stage 1 of the insurance work carries no money.** The deliverable is a rating (levels/points), not a premium — not a regulated activity, and needs no carrier | v0.33.72 memo 1, 30 Aug | **Proposed — it dissolves the blocker v0.33.71 called fatal** |
| GM-D39 | **A rating is computed from published evidence and ships its derivation.** A level that cannot be re-run by somebody else is refused | v0.33.72 §2 — memo 1 removes the money that v0.33.71 said kept a claim honest | **Proposed — the load-bearing rule; it answers a real contradiction between memos 0 and 1** |
| GM-D40 | **Rating inputs carry their evidence channel**: measured and declared (questionnaire/card) facts are weighted differently and never merged; unknown is never scored as absent | v0.33.72 §5 — `library − self-report = blind spots` applied to rating | **Proposed** |
| GM-D41 | **Aggregation reads correlation off shared graph nodes** rather than summing independent micro ratings | v0.33.72 §4; narrowed by v0.33.73 §5 | **Proposed — narrowed: reinsurance supplies the hierarchy's SHAPE, not the correlation. The arithmetic is still unimplemented** |
| GM-D42 | **The rating is a gate, not a report** — and being a control, it declares its own enforcement tier under the pack's three-tier test, on its own face | v0.33.73 §3 memo 2, 30 Aug | **Proposed — a gate that overstates its tier is worse than none, because it will be believed** |
| GM-D43 | **The rating authority is separated from the deploying party.** A rating produced by the party that wants to ship is self-assessment wearing a number, however reproducible its arithmetic | v0.33.73 §1 | **Proposed — the other half of GM-D39: method AND separation** |
| GM-D44 | **The derivation must decompose**, so a gate can say *reduce by this much, and here is what would do it* | v0.33.73 §2 — GM-D39 extended from audit to action | **Proposed** |
| GM-D45 | **The delta is classified by who could have closed it** — elective (the operator's), structural (the platform's finest grain), defect (a vulnerability, temporary). Only elective delta is attributable to the operator | v0.33.74 §3 memo 3, 30 Aug | **Proposed — a rating that charges for structural delta rates a vendor's roadmap, not a customer's diligence** |
| GM-D46 | **Platform granularity is a library artefact**, measured once and referenced by every placement — the library/instance rule one altitude up, and the only public good in this apparatus | v0.33.74 §4 | **Proposed** |
| GM-D47 | **rating = f(twin, world state, mandate)**, with the twin and the world carrying independent freshness, both printed | v0.33.74 §6 — a zero-day changes the world, not the twin | **Proposed** |
| GM-D48 | **A re-rating states what changed, which way, and which controls are implicated — never a magnitude multiplier**, until loss data exists | v0.33.74 §7 — the memo's "10x", declined as false precision | **Proposed** |
| GM-D49 | **A rating crossing a threshold may emit a revocation** — the register already carries revocation as an append and the hook already enforces it; the gate declares its tier | v0.33.74 §8 — "pull the plug" | **Proposed — everything but the world-state input exists** |
| GM-D50 | **`measure.py` gains a commit-authorship node.** A push credential confers authorship under any name absent signed-commit enforcement; neither library entry has a node for it | v0.33.74 §1 — named in passing by memo 3 | **Proposed — a defect in the discovery instrument, found by conversation rather than by the tool** |
| GM-D51 | **The cyber insurance market is carried as precedent for GM-D39**: a market that priced what it could not check lost money on both sides at once. A rating's first obligation is to be checkable, not accurate | v0.33.75 §1 memo 4, 31 Aug | **Proposed** |
| GM-D52 | **The enforcement tier is an impact-reduction measure** — the quantity security has never been able to articulate — and it RANKS rather than prices | v0.33.75 §3 | **Proposed, and NARROWED by GM-D82** — the tier ranks reachability, which is not the incident-response team's quantity |
| GM-D53 | **Multiple independent raters, and disagreement between them is signal.** The no-money analogue of layered cover, and the mitigation for the monoculture this pivot would otherwise create | v0.33.75 §6 | **Proposed — requires a second rater, and there is none** |
| GM-D54 | **The level scale is 1–5.** Currency implies loss data nobody has; 1–100 implies resolution the inputs cannot support; a band is arguable where a decimal is not | v0.33.76 §1 memo 5; project lead, 31 Aug | **SETTLED — the first settled decision in this pivot. Closes N17 q1 and unblocks the first MVP** |
| GM-D55 | **This project is not in line.** Schemas, flows, connectors, evidence — never the carrier, never the execution broker. Consequence: **it can never itself be a boundary**, only ship a check that becomes one when installed by somebody who is | v0.33.76 §2 | **Proposed — *instrument before you enforce*, applied to the business model** |
| GM-D56 | **We define what a broker must be able to show; we do not operate one.** The disclosure format for structural-to-elective conversion is a schema | v0.33.76 §3 — the memo's own self-correction | **Proposed** |
| GM-D57 | **A connector labels the evidence class of everything it imports**, so that *integrate with what exists* does not become *launder what exists* | v0.33.76 §5 | **Proposed — cheap on the first connector, expensive to retrofit onto the fifth** |
| GM-D58 | **A broker's claimed level reduction is computed by the rating method, never by the broker.** GM-D43's separation applied to the vendor channel; the disclosure GM-D56 requires is the derivation of the claimed reduction | v0.33.77 §1 memo 6, 31 Aug | **Proposed — "we reduce your level by X" is apparent authority until something computes it** |
| GM-D59 | **A broker changes the grant's topology, not only its width.** The rating nets what it removes against what it adds — the broker's own reach, and for a SaaS broker decisions crossing the boundary. **Deployment topology is a rating variable** | v0.33.77 §2 | **Proposed — CORRECTS the framing in v0.33.74 §5, which said a broker converts structural delta to elective and stopped there** |
| GM-D60 | **Elective delta carries a cost to close**; *latent* delta — offered by the platform but impractical to adopt — is its high-cost region | v0.33.77 §3 — the case GM-D45's three classes could not hold | **Proposed — extends GM-D45 with a dimension rather than a fourth class** |
| GM-D61 | **A broker's own rating is systemic**: the one placement whose mis-rating propagates to every customer whose level it reduced, which is why its policy is not optional | v0.33.77 §2 | **Proposed** |
| GM-D62 | **`policy/v0` is a mandate-shaped statement issued by a rater** — same five fields, append-only record, revocation-by-append and verification walk. One more statement `type`, no new register machinery | v0.33.78 §1 memo 7, 31 Aug | **Proposed — ANSWERS GM-D36's open shape question** |
| GM-D63 | **A policy does not sign; its subject signs, and the policy establishes what that signature is worth.** Possession is proved cryptographically; standing is established afterwards by a statement | v0.33.78 §2 — the v0.33.60 briefing pack's own rule, applied | **Proposed** |
| GM-D64 | **The relying party is the enforcement point.** The policy handshake is the first mechanism in this pivot that can reach tier `boundary`, because a relying party is outside the requesting agent's grant — conditional on it being genuinely independent of the requester | v0.33.78 §3 | **Proposed — RESOLVES the limit GM-D55 recorded** |
| GM-D65 | **Verification is not metered by the check.** A verification is not a use; check events belong in the issuer's own lane rather than a central log; and a per-verification price is a tax on the behaviour the system most wants | v0.33.78 §6 — the v0.33.61 observability brief | **Proposed — price by seat, policy or period** |
| GM-D66 | **A revocation SLA states the required check interval**, or it is a hope with a number on it: effective revocation latency is the relying party's check interval, not the issuer's promise | v0.33.78 §5 — the observability brief's computable quantity | **Proposed** |
| GM-D67 | **The first MVP is an explainer, not a calculator.** An instrument answers a question somebody already knows how to ask; an explainer creates the person who can ask it. The rating exists underneath it as the thing demonstrated | v0.33.79 §1 memo 8, 31 Aug | **Proposed — CORRECTS the site agent's own MVP proposal, put to the project lead as N20 across four releases** |
| GM-D68 | **Cost needs assets; stage 1 needs asset CLASS and not asset VALUE.** Class is declared and marked as such; value in time, money, recoverability and liability is stage 2's requirement and outside this estate's competence | v0.33.79 §2 | **Proposed — a level is relative, so ranking needs no absolute value** |
| GM-D69 | **The world shows its own emptiness.** Unmeasured places look unmeasured, fixtures look like fixtures, and absent mechanisms are visibly absent rather than smoothly rendered | v0.33.79 §5 | **Proposed — the estate's own *a control that overstates itself is worse than none*, arriving in the user interface** |
| GM-D70 | **Insurer, underwriter and claim join the actor set**, each declaring fixture-or-real like every other identity. The claim is `loss-event/v0` and still does not exist | v0.33.79 §4 | **Proposed** |
| GM-D71 | **Build the 2D world before the 3D one.** The explanatory risk is spatial rather than dimensional | v0.33.79 §6 | **Proposed — engineering advice rather than doctrine** |
| GM-D72 | **The positioning is "make your agents insurable"** — with the guard-rail that it must not become *make your agents LOOK insurable*. Insurability comes from narrowing the delta or covering it, never from documenting it, and finding a placement that should not be insurable is a success of the method | v0.33.80 §2 memo 9, 31 Aug | **Proposed** |
| GM-D73 | **The declared-versus-measured gap is the shape of material non-disclosure** — so the card-versus-twin gap decides *voidability*, not merely a worse level, and is the single most consequential quantity an underwriter would want computed | v0.33.80 §3 | **Proposed — UPGRADES GM-D40 from a rating rule to a cover rule; computable today, since twin and card are both held** |
| GM-D74 | **A market observation is a dated, re-runnable measurement with evidence classes** — `measure.py`'s discipline pointed at a market: unknown is never absent, the survey is a floor not a census, its age is printed, and it reports what vendors publish rather than what anyone said in a call | v0.33.80 §4 | **Proposed** |
| GM-D75 | **The survey's most valuable output is the format underwriters accept**, because that format is the connector specification — and the connector must carry evidence classes across, or it creates GM-D73's non-disclosure by itself | v0.33.80 §6 | **Proposed** |
| GM-D76 | **A warranty is a fact plus a maximum age**, failing three ways — false, stale, or unknown — with unknown on the same side as false. The opposite of the rating rule, deliberately: for a rating, assuming absence manufactures comfort; for cover, assuming presence manufactures liability | v0.33.81 §1 memo 10, 31 Aug | **Proposed — the estate's twin-age and three-valued-fact machinery already computes this shape** |
| GM-D77 | **Cover is continuous, and the warranty's check interval is a THIRD clock** beside the policy interval and twin/world freshness. A policy in force against a fresh twin with a stale warranty is NOT covered | v0.33.81 §2 | **Proposed** |
| GM-D78 | **Metering uses is sound where metering verifications is not** (*a verification is not a use*) — but a usage-boxed policy needs an **in-line counter**, which this project is not. We define the counting schema; the relying party or broker holds the counter | v0.33.81 §3 | **Proposed — the collision with GM-D55 is RESOLVED by GM-D90: the counter already exists, run by the supplier for billing** |
| GM-D79 | **This project defines schemas, not APIs.** An API is operated, a schema is implemented; the policy lifecycle ships as documents and transitions, with creation, amendment, activation and ending all as **appends, never edits** | v0.33.81 §5 | **Proposed — the answer to *what APIs do we need* is mostly: none that we build** |
| GM-D80 | **A recurring cover window states its timezone.** Ambiguity in a cover condition is the ground disputes are fought on, and daylight saving moves an unqualified window twice a year | v0.33.81 §4 | **Proposed** |
| GM-D81 | **A printed count is a claim and is derived, never typed.** `insurance/llms.txt` reads the decision count out of this log, and only the highest-numbered memo may be called the last | v0.33.82 — audit of the eleven insurance readings; **amended v0.33.83** | **Proposed — amended by GM-D96. Checking a hand-typed denominator still leaves a hand-typed denominator, which memo 11 proved by firing the gate on all eight footers at once** |
| GM-D82 | **The enforcement tier ranks REACHABILITY, not severity.** Insurance splits a loss into how often and how bad; an incident-response team is the second, and the tier is neither — it changes how many attempts become losses. Blast radius is used as a proxy for severity, and the proxy is named as one | v0.33.82 — audit; narrows GM-D52 | **Proposed — GM-D52 identified the tier with the memo's quantity, and they are not the same quantity** |
| GM-D83 | **Any party claiming to reduce somebody else's exposure should carry cover against being wrong about it.** Broker, platform or model vendor — the argument does not care which, and memo 3 asked it of the model vendor three memos before GM-D58 asked it of a broker | v0.33.82 — audit; memo 3 restored to doctrine 03 §8 | **Proposed — vendors disclaim liability today, so this describes what such cover would MEAN, not that it is coming** |
| GM-D84 | **Removing the payout removes one channel of moral hazard and opens another.** A level is a badge, and a badge substitutes for control without a carrier — which is GM-D72's *look insurable* hazard, arriving in stage 1 | v0.33.82 — audit; corrects doctrine 02 §5's claim of structural immunity | **Proposed** |
| GM-D85 | **An endorsement is an append.** A rider amends cover after issue without rewriting the policy, which is the register's rule since v0.1.26 — so the estate held the endorsement mechanism before it had a policy to attach one to | v0.33.82 — audit; memo 2's ambiguous *rider*, read the second way at last | **Proposed — brief v0.33.73 promised this connection and never made it; GM-D79 reached it independently from memo 10** |
| GM-D86 | **Consumption is a second axis beside capability**, and a resource pool is a **fourth primitive** beside grant, mandate and fact — *a grant that depletes*, carrying a `remaining` no existing node has and no re-measurement produces | v0.33.83 §2 memo 11, 1 Sep | **Proposed** |
| GM-D87 | **A pool bounds volume, never reach.** The cheapest catastrophic action is cheap: a budget catches the expensive-and-harmless case and is blind to the cheap-and-catastrophic one | v0.33.83 §3 | **Proposed — CORRECTS the memo, which says the pool defines the grant** |
| GM-D88 | **A token pool is risk pooling in a currency that is not money.** Variance absorption across a population needs no carrier, capital or authorisation — the first mechanism in this pivot that does what insurance does rather than what underwriting does | v0.33.83 §4 | **Proposed** |
| GM-D89 | **Consumption is the loss data this estate can actually obtain.** A budget overage is dated, quantified, attributable and independently recorded, so `loss-event/v0` is drafted against a real instance | v0.33.83 §5 | **Proposed — answers GM-D36's undrafted shape and the missing primitive of doctrine 08** |
| GM-D90 | **The counter already exists, so GM-D78's collision dissolves.** Every token is metered for billing regardless of insurance; reading a meter somebody else runs for commercial reasons does not put this project in the line | v0.33.83 §6 | **Proposed — RESOLVES GM-D78** |
| GM-D91 | **The resource supplier is the first natural relying party**, because it is the one paying — the first candidate in eleven memos that did not have to be argued into caring. A meter's natural home is outside the agent, so the tier reaches `boundary` without arranging independence | v0.33.83 §6 | **Proposed — answers doctrine 07 §7's *who checks first*** |
| GM-D92 | **A metered budget is the only warranty that cannot fail the unknown way.** GM-D76's three failures are false, stale and unknown; a meter is authoritative and continuous, so `remaining > 0` fails one way only — and is the cheapest per-action check in the pivot | v0.33.83 §9 | **Proposed** |
| GM-D93 | **A pool without a per-occurrence limit converts one runaway into an outage for every member.** The structure is excess-of-loss — deductible, per-occurrence limit, aggregate — and the memo names three of the four | v0.33.83 §9 | **Proposed — the unnamed component is the one that prevents shared-fate failure** |
| GM-D94 | **The shape generalises only to a resource metered by a non-consumer, fungible, and depleting.** Capability fails two of three, which is why the grant tree needed different machinery | v0.33.83 §7 | **Proposed — bounds *you could apply this to almost anything*** |
| GM-D95 | **A desirable currency makes *never declared, only derived* load-bearing.** Tokens are wanted where points were not, so the two-channel rule becomes an anti-fraud control | v0.33.83 §9 | **Proposed — the same upgrade GM-D73 made for non-disclosure** |
| GM-D96 | **A doctrine document names its memo and never the series total.** Gating a hand-typed denominator still leaves a hand-typed denominator: the v0.33.82 gate fired on all eight footers the moment memo 11 arrived. **Don't gate a claim you can simply not make** — the count lives only where it is derived from the manifest | v0.33.83 §8 — amends GM-D81 | **Proposed — the series has been declared complete twice and grown twice; a document should not assert the future** |
| GM-D97 | **A draw on the pool is a claim, paid in the resource, settled by the check itself.** The money in a policy was a metric for what the claim buys; pay the claim in the thing and the payment is the permission to proceed. The ledger is the claims file | v0.33.84 §1 memo 12, 2 Sep | **Proposed — finishes GM-D88** |
| GM-D98 | **A claim settles in milliseconds when trigger, cover and payment are fields of one document read by one function.** The speed is a property of the mapping, not the software — and the reason this stage waits on nobody | v0.33.84 §1 | **Proposed** |
| GM-D99 | **The pool is per repository, shared by every agent pushing to it**, because the ledger lives there. Pooled fate is policy, not accident; the per-occurrence limit stops one agent spending it alone | v0.33.84 §2 | **Proposed — gives GM-D93 its mechanism** |
| GM-D100 | **A skill that runs the check on the agent itself is a SETTING and says so on its face.** The boundary is the same policy and arithmetic run by a party the agent cannot reach: a required CI status or a host push rule | v0.33.84 §3 | **Proposed — GM-D42 applied to the first MVP** |
| GM-D101 | **The ledger is the loss data.** Policy numbers are placeholders until re-fitted from it; the checker's replay of history is the first fit | v0.33.84 §4 | **Proposed — makes GM-D89 concrete** |
| GM-D102 | **Bytes are measured before the push as uncompressed new objects — a floor, never a bill.** Wire bytes belong to the host's meter | v0.33.84 §7 | **Proposed** |
| GM-D103 | **A release that touches every page is a policy breach in slow motion.** Twelve of twelve site releases replayed through the policy were refused, at 10–43× the per-push maximum, because `chrome.py` stamps the version into ~180 pages. The fix is in the release, not the policy; until then the hook is shipped and not installed | v0.33.84 §6 — `check.py --backtest 12 --ref origin/dev` | **Proposed — the first MVP's first finding, and it is about this estate** |
| GM-D104 | **The levels of enforcement are the tier test refined**: nothing, prompt and skill are expectations; a hook is a setting; the destination is a boundary; and out-of-band verification is **detection**, a tier the test had not named because it does not prevent, it finds out | v0.33.85 §1 memo 13, 3 Sep | **Proposed** |
| GM-D105 | **Assurance per level is measured, never asserted**: the ledger stamps every verdict with its level, and the catch rate per level on ordinary work is a derivation | v0.33.85 §2 | **Proposed — a prompt's worth is a number, and until it exists the tier test's answer stands** |
| GM-D106 | **A catch at a level above the one that should have refused is an incident, not a volume event**: no draw, a different policy with no buffer, an escalation, and a candidate for suspension of the licence to operate | v0.33.85 §3 | **Proposed — a setting's failure is what the higher level detects** |
| GM-D107 | **Out-of-band reconciliation of the ledger against the system of record turns a setting into a detector**, and it is the maintainer's job; a commit that carries no claim is the detection | v0.33.85 §4 — `tools/reconcile.py`, eleven commits, no catch | **Proposed — built and run the same day** |
| GM-D108 | **The object stays *policy*; the ladder is *the levels of enforcement*; the product name is the project lead's.** *Agent policies* collides with IAM and OPA; *agent insurance policies* borrows the regulated word | v0.33.85 §7 | **Proposed — a naming decision belonging to the project lead** |

---

*CC BY 4.0.*