You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
By the time this stage of #527 is reached, a program walks the definitions, the corpus is compiled ahead of any session, and every name in a definition resolves. What is still true is that the rules a definition must obey are written outside the definitions: 33 checking scripts totalling 6,471 lines, 148 catalogued anti-patterns and 34 design principles, none of which can run where a definition changes.
Read those scripts together and what they are becomes plain. One checks that two declarations of a variable agree on its type — that is type unification. One checks that no step consumes a value no earlier step produces — that is use-before-definition. One checks that a gate never reads a decision made after it, with five hand-argued exemptions that each correspond to a standard narrowing or control-flow join. The largest, at 856 lines, checks the whole binding graph. These are not lints. They are the meaning of the language, written where nothing forces them to stay true — which is how the recorded judgements about one of them came to sit 249 corpus commits behind the definitions they judge.
This epic gives the definitions a language that states its own rules, adds what a step is permitted to do to what it declares, and makes the corpus a package that runs its own tests. It is the last stage and the largest by item count, because it is where everything the earlier stages made possible gets collected.
The four gaps
The definitions cannot state their own constraints. Every rule about them lives in a script, a catalogue entry, or prose. A rule with no artifact behind it is a rule that ships broken silently, and ten of the fifteen rules governing how a test is written were in exactly that position before the one-predicate epic.
What a step may do is a rule, not a property. One workflow's whole guarantee is that nothing it does discloses anything, and that guarantee rests on a 280-line reachability analysis over seeded values. Nothing in the definition says the workflow may not disclose; a script works out that it cannot.
A shared body has no home. When the same rule text or the same gate body is needed at more than one place, the corpus extracts it and imports it by reference — nine such bodies serve nineteen sites, and a guard keeps them honest. What the mechanism lacks is any notion of where a body belongs. A body lives on whichever workflow declared it first, so generic rules end up owned by a domain workflow and borrowed across a boundary neither workflow's subject covers. The guard that forbids duplicate text offers extraction as its only remedy, so the shape reproduces itself every time an author is told to fix it.
The corpus cannot check itself. The definitions live on a branch of their own, deliberately, so a change to what the workflows say is separate from a change to the code that runs them. The tests that exercise what the workflows say do not: 16 of 72 test files read the real corpus from the code branch, and four recorded measurements sit beside them, each carrying the identifier of the corpus commit it was taken against because nothing else ties the two together. One of those recordings is a file of human judgements sitting 249 corpus commits behind its subject. And the boundary drops a class of check entirely: a corpus pull request during recent work could not be verified at all, because the definitions used a schema field that existed only on the code branch, so every schema-reading guard called the corpus invalid.
The work
W1 — The authoring language. The definitions are authored in a language whose checker enforces what the scripts enforce today. The bag of session variables is a record type; an activity's declared reads and writes are its signature; an instruction set is a function with typed inputs and outputs whose body is prose; a test is an expression checked against the variables it names. It compiles to the structure named earlier in the transition, so the program that walks definitions is unaffected by the change of front end.
W2 — What a step may do becomes part of its type. Alongside its inputs and outputs, a step declares which kinds of effect it may have — reading the repository, writing to it, reaching the network, spawning an agent, asking a person, publishing. An activity's permissions are the union of its steps'; a workflow declares a ceiling; compiling checks containment. The disclosure guarantee becomes a declared ceiling with no publishing permission in it, and a step that would disclose fails to compile. The declaration says what is permitted; where permission must be enforced rather than declared, the host sandboxes, and this item states which is which rather than implying the type does both.
W3 — Every check is dispositioned. Each of the 33 scripts, 148 catalogue entries and 34 principles gets a verdict: retired because the type system subsumes it, kept because it checks a convention no type expresses, or declined with the reason recorded. A check with no verdict is a check nobody can remove later.
W4 — A named preset over a base workflow. Some uses of a workflow need certain values fixed before the first step runs — a remediation that must stay private from step zero, a review run that must advance without a person. Today the only way to ship a different starting state is to clone the workflow, and one production workflow is a roughly 200-line wrapper whose real payload is three fixed values, three isolation rules and one starting activity. A preset is a constructor over the initial state: values only, never a different starting activity and never content of its own. A fixed value may be locked, and a write to a locked value is dropped and reported rather than recorded. Reachability is checked per preset, so the disclosure guarantee is proved against the preset's values rather than trusted at runtime.
W5 — Named alternatives inside one instruction set. Authors already write two kinds of structure the server cannot see: alternatives — one operation with several mutually exclusive ways to run it — and the drift that follows when the arms of such a set are maintained separately. Under a language an alternative set is a sum type and selection is checked. With it comes the catalogue entry for arms that have drifted apart, keyed on the declared construct rather than growing its own way to find sibling arms: where a common consumer reads across all the arms, each arm's contribution must be traceable to a declared output rather than to a sentence.
W6 — A shared body has a home because modules do. Generic bodies live in modules named for what they are, not on whichever workflow declared them first. The nine bodies at nineteen sites are rehomed, the six orchestrator-only rules removed from the worker bundle earlier are disposed of rather than parked, the three interaction rules move out of the domain workflow hosting them, the four activity-scoped rules stay on the activity whose constructs they name, and the remaining inline copies are converted. The rule that activity-file rules cannot reference a shared body — a scoping asymmetry rather than a design — goes with the mechanism it constrained.
W7 — The corpus checks itself. The corpus becomes a package depending on the runtime package, so the tests exercising what a definition says run where the definition changes. The line is stated once in the contributing guidance: tests that exercise machinery live with the code, tests that exercise what a definition says live with the definitions. The 16 corpus-reading test files move, the four recordings move with them, and the commit stamps, freshness assertions, re-stamping step and pointer-comparison check are refunded rather than rewritten. The few machinery tests that read the real corpus only for convenience take fixtures, which is what they should have had.
W8 — Instruction sets that only wrap a tool call. A set of instructions whose entire content is "call this tool" is a layer with nothing in it once a program makes the call. Decide each such set: it becomes a direct call, or it keeps a body because it interprets a result, which is the part a tool cannot hold. An earlier attempt at this was withdrawn before any file was touched, because it could not be accepted on its own stated terms; under a typed language the terms are different and the question is worth reopening.
Why now is cheap
Every earlier stage removed a reason this was hard. One predicate form means the expression type has one meaning. Resolved references mean the call graph is already checked. A named structure means the language has a target to compile to. A program that walks definitions means the checks that graded an agent's report are already gone.
Two of the four gaps have their evidence gathered. The rehoming register was produced entry by entry during a canon audit — every rule on the surface with its verdict and proposed destination — and the corpus-test counts come from a specific merge on the code branch.
The wrapper workflow already isolates exactly what a preset needs to carry. Its difference from the base workflow is the first preset's content, written and shipped.
The alternative is not free either. Every recording that stays with the code needs a stamp, every stamp needs a freshness check, and each is a place the two can separate silently — which the 249-commit drift shows already happening.
Acceptance criteria
Definitions are authored in a language whose checker enforces what the current scripts enforce, compiling to the structure named earlier in the transition.
Every one of the 33 scripts, 148 catalogue entries and 34 principles carries a verdict — retired, kept, or declined with the reason.
A step declares the kinds of effect it may have; an activity's permissions are the union of its steps'; a workflow declares a ceiling; and compiling checks containment.
The disclosure guarantee is expressed as a ceiling and holds at least as strongly as the 280-line analysis it replaces, with the boundary between what the type declares and what the host enforces stated explicitly.
A preset can be declared, listed alongside workflows, and named at session creation; the values it fixes are recorded and survive a continuation; a write to a locked value is dropped and reported; and reachability is checked per preset.
The wrapper workflow carries only what a preset cannot — its starting activity and its remaining setup — with its variable declarations inherited rather than restated.
An alternative set is declared, selection is checked in both directions, and the drift entry keys on the declared construct.
Every shared body lives in a module named for what it is; no generic body is owned by a domain workflow; and activity-file rules reference shared bodies on the same terms workflow rules do.
No test on the code branch reads the corpus, and something enforces that rather than stating it.
No recorded measurement carries a corpus commit identifier, because none needs one.
A corpus change measures its own coverage, walks and delivery cost before it merges, and can be verified without the code branch having merged anything first.
Every instruction set that only wraps a tool call is dispositioned — direct call, or a recorded reason its body stays.
Non-goals
Rewriting instruction prose. The bodies describing judgement are the payload and stay as they are. The corollary is a real constraint: 436 of the corpus's 2,459 protocol bullets open with a conditional or a repetition, so control flow lives inside those bodies and a call to an agent stays atomic.
Splitting the repository. The two branches stay as they are; the corpus becomes a package depending on a runtime package, which is a dependency relationship.
Changing what any check measures. Coverage, the walks and delivery cost keep their definitions and expectations; what changes is where they run.
Verified call joints. Marked blocks with checked seams were designed and held dormant against future evidence. The misbinding they would catch is caught by construction here, so the design is closed as answered rather than left waiting.
A general configuration system. A preset carries values and nothing else — never a different starting activity, never content of its own — so the wrapper stays the documented pattern for a specialisation that has real content.
Parallel execution. Independent subtrees become visible under a typed step graph, which makes this worth revisiting. It is not opened here: the corpus does not yet express which work is independent, and a second concurrent position changes what the session record has to guarantee.
Tracking
Each work item is delivered as its own pull request when picked up.
Work item
Agent time
Gate
[ ]
W1 — the authoring language
25–45 h
Definition-shape W1 and W2; One-predicate W1
[ ]
W2 — what a step may do becomes part of its type
9–14 h
W1
[ ]
W3 — every check is dispositioned
7–11 h
W1, W2
[ ]
W4 — a named preset over a base workflow
6–9 h
W1
[ ]
W5 — named alternatives, and the drift entry
6–9 h
W1
[ ]
W6 — a shared body has a home because modules do
5–8 h
W1
[ ]
W7 — the corpus checks itself
6–9 h
W1
[ ]
W8 — instruction sets that only wrap a tool call
3–5 h
W1, Mechanical-execution W1
Epic total
11–18 days
Item hours and epic effort-days are defined in #527.
The largest epic in the transition, by item count and by both measures of time, and that follows from its position rather than from its ambition: it is where every deferred item lands. W7 is independent of W2 through W6 and can be taken as soon as W1 is stable. W4 through W8 are independent of each other, so the day count compresses considerably if they are worked in parallel — the sequential figure above is the upper shape.
Treat this epic's estimate as the least reliable in the transition. W1's hours are for building a language and its checker against a structure that does not exist yet, and W3's are for dispositioning 33 scripts, 148 catalogue entries and 34 principles whose individual verdicts are unknown until the type system is real. Both should be re-estimated after the definition-shape epic lands, along with the case for doing this at all.
This epic should be re-argued before it is committed to. The stages before it deliver a working system, and the case for this one rests on measurements the earlier stages have not yet taken. That is stated in the running order's own non-goals and repeated here.
Carries #526 W6 and W7, #497, #519, #401 W1, #492, #397 W1 and W4, #338 W2, #402 W2, and the remainder of #518. Closed issues are captured verbatim in the planning folder; #397 and #338 stay open for their remaining items.
Investigation detail
The design this epic completes, the disposition of every open work item, and the alternatives weighed and dropped: 2026-08-31-typed-execution-redesign
Summary
By the time this stage of #527 is reached, a program walks the definitions, the corpus is compiled ahead of any session, and every name in a definition resolves. What is still true is that the rules a definition must obey are written outside the definitions: 33 checking scripts totalling 6,471 lines, 148 catalogued anti-patterns and 34 design principles, none of which can run where a definition changes.
Read those scripts together and what they are becomes plain. One checks that two declarations of a variable agree on its type — that is type unification. One checks that no step consumes a value no earlier step produces — that is use-before-definition. One checks that a gate never reads a decision made after it, with five hand-argued exemptions that each correspond to a standard narrowing or control-flow join. The largest, at 856 lines, checks the whole binding graph. These are not lints. They are the meaning of the language, written where nothing forces them to stay true — which is how the recorded judgements about one of them came to sit 249 corpus commits behind the definitions they judge.
This epic gives the definitions a language that states its own rules, adds what a step is permitted to do to what it declares, and makes the corpus a package that runs its own tests. It is the last stage and the largest by item count, because it is where everything the earlier stages made possible gets collected.
The four gaps
The definitions cannot state their own constraints. Every rule about them lives in a script, a catalogue entry, or prose. A rule with no artifact behind it is a rule that ships broken silently, and ten of the fifteen rules governing how a test is written were in exactly that position before the one-predicate epic.
What a step may do is a rule, not a property. One workflow's whole guarantee is that nothing it does discloses anything, and that guarantee rests on a 280-line reachability analysis over seeded values. Nothing in the definition says the workflow may not disclose; a script works out that it cannot.
A shared body has no home. When the same rule text or the same gate body is needed at more than one place, the corpus extracts it and imports it by reference — nine such bodies serve nineteen sites, and a guard keeps them honest. What the mechanism lacks is any notion of where a body belongs. A body lives on whichever workflow declared it first, so generic rules end up owned by a domain workflow and borrowed across a boundary neither workflow's subject covers. The guard that forbids duplicate text offers extraction as its only remedy, so the shape reproduces itself every time an author is told to fix it.
The corpus cannot check itself. The definitions live on a branch of their own, deliberately, so a change to what the workflows say is separate from a change to the code that runs them. The tests that exercise what the workflows say do not: 16 of 72 test files read the real corpus from the code branch, and four recorded measurements sit beside them, each carrying the identifier of the corpus commit it was taken against because nothing else ties the two together. One of those recordings is a file of human judgements sitting 249 corpus commits behind its subject. And the boundary drops a class of check entirely: a corpus pull request during recent work could not be verified at all, because the definitions used a schema field that existed only on the code branch, so every schema-reading guard called the corpus invalid.
The work
W1 — The authoring language. The definitions are authored in a language whose checker enforces what the scripts enforce today. The bag of session variables is a record type; an activity's declared reads and writes are its signature; an instruction set is a function with typed inputs and outputs whose body is prose; a test is an expression checked against the variables it names. It compiles to the structure named earlier in the transition, so the program that walks definitions is unaffected by the change of front end.
W2 — What a step may do becomes part of its type. Alongside its inputs and outputs, a step declares which kinds of effect it may have — reading the repository, writing to it, reaching the network, spawning an agent, asking a person, publishing. An activity's permissions are the union of its steps'; a workflow declares a ceiling; compiling checks containment. The disclosure guarantee becomes a declared ceiling with no publishing permission in it, and a step that would disclose fails to compile. The declaration says what is permitted; where permission must be enforced rather than declared, the host sandboxes, and this item states which is which rather than implying the type does both.
W3 — Every check is dispositioned. Each of the 33 scripts, 148 catalogue entries and 34 principles gets a verdict: retired because the type system subsumes it, kept because it checks a convention no type expresses, or declined with the reason recorded. A check with no verdict is a check nobody can remove later.
W4 — A named preset over a base workflow. Some uses of a workflow need certain values fixed before the first step runs — a remediation that must stay private from step zero, a review run that must advance without a person. Today the only way to ship a different starting state is to clone the workflow, and one production workflow is a roughly 200-line wrapper whose real payload is three fixed values, three isolation rules and one starting activity. A preset is a constructor over the initial state: values only, never a different starting activity and never content of its own. A fixed value may be locked, and a write to a locked value is dropped and reported rather than recorded. Reachability is checked per preset, so the disclosure guarantee is proved against the preset's values rather than trusted at runtime.
W5 — Named alternatives inside one instruction set. Authors already write two kinds of structure the server cannot see: alternatives — one operation with several mutually exclusive ways to run it — and the drift that follows when the arms of such a set are maintained separately. Under a language an alternative set is a sum type and selection is checked. With it comes the catalogue entry for arms that have drifted apart, keyed on the declared construct rather than growing its own way to find sibling arms: where a common consumer reads across all the arms, each arm's contribution must be traceable to a declared output rather than to a sentence.
W6 — A shared body has a home because modules do. Generic bodies live in modules named for what they are, not on whichever workflow declared them first. The nine bodies at nineteen sites are rehomed, the six orchestrator-only rules removed from the worker bundle earlier are disposed of rather than parked, the three interaction rules move out of the domain workflow hosting them, the four activity-scoped rules stay on the activity whose constructs they name, and the remaining inline copies are converted. The rule that activity-file rules cannot reference a shared body — a scoping asymmetry rather than a design — goes with the mechanism it constrained.
W7 — The corpus checks itself. The corpus becomes a package depending on the runtime package, so the tests exercising what a definition says run where the definition changes. The line is stated once in the contributing guidance: tests that exercise machinery live with the code, tests that exercise what a definition says live with the definitions. The 16 corpus-reading test files move, the four recordings move with them, and the commit stamps, freshness assertions, re-stamping step and pointer-comparison check are refunded rather than rewritten. The few machinery tests that read the real corpus only for convenience take fixtures, which is what they should have had.
W8 — Instruction sets that only wrap a tool call. A set of instructions whose entire content is "call this tool" is a layer with nothing in it once a program makes the call. Decide each such set: it becomes a direct call, or it keeps a body because it interprets a result, which is the part a tool cannot hold. An earlier attempt at this was withdrawn before any file was touched, because it could not be accepted on its own stated terms; under a typed language the terms are different and the question is worth reopening.
Why now is cheap
Every earlier stage removed a reason this was hard. One predicate form means the expression type has one meaning. Resolved references mean the call graph is already checked. A named structure means the language has a target to compile to. A program that walks definitions means the checks that graded an agent's report are already gone.
Two of the four gaps have their evidence gathered. The rehoming register was produced entry by entry during a canon audit — every rule on the surface with its verdict and proposed destination — and the corpus-test counts come from a specific merge on the code branch.
The wrapper workflow already isolates exactly what a preset needs to carry. Its difference from the base workflow is the first preset's content, written and shipped.
The alternative is not free either. Every recording that stays with the code needs a stamp, every stamp needs a freshness check, and each is a place the two can separate silently — which the 249-commit drift shows already happening.
Acceptance criteria
Non-goals
Tracking
Each work item is delivered as its own pull request when picked up.
Item hours and epic effort-days are defined in #527.
The largest epic in the transition, by item count and by both measures of time, and that follows from its position rather than from its ambition: it is where every deferred item lands. W7 is independent of W2 through W6 and can be taken as soon as W1 is stable. W4 through W8 are independent of each other, so the day count compresses considerably if they are worked in parallel — the sequential figure above is the upper shape.
Treat this epic's estimate as the least reliable in the transition. W1's hours are for building a language and its checker against a structure that does not exist yet, and W3's are for dispositioning 33 scripts, 148 catalogue entries and 34 principles whose individual verdicts are unknown until the type system is real. Both should be re-estimated after the definition-shape epic lands, along with the case for doing this at all.
This epic should be re-argued before it is committed to. The stages before it deliver a working system, and the case for this one rests on measurements the earlier stages have not yet taken. That is stated in the running order's own non-goals and repeated here.
Carries #526 W6 and W7, #497, #519, #401 W1, #492, #397 W1 and W4, #338 W2, #402 W2, and the remainder of #518. Closed issues are captured verbatim in the planning folder; #397 and #338 stay open for their remaining items.
Investigation detail
The design this epic completes, the disposition of every open work item, and the alternatives weighed and dropped:
2026-08-31-typed-execution-redesign
The preset candidates, the schema sketches and the twenty-seven deep-dive decisions: 2026-08-02-session-presets-consolidation. The rehoming register: 2026-08-27-rule-homes-and-shared-bodies. The alternatives-and-delegation doctrine: 2026-08-02-protocol-structure-consolidation.