Governance and Constitution

Governance & the Constitution

A safety mechanism that its own makers can quietly edit protects nothing. So the final discipline is that governance binds even the powerful — including the architect and the agent.

The Constitution

The system's rules — the registered policies, the ABI version, the active judge, the ownership rules for state, the standing orders. Parts that can be checked are checked (tripwires); parts that need judgement go through ceremony.

The amendment ceremony

An agent may propose. Only the human principal may ratify.

This asymmetry is the backbone of human authority. The agent is expected to propose amendments and argue with evidence — but the pen that changes the Constitution stays in the human's hand.

flowchart LR
    A[Agent PROPOSES] --> D[Deliberation<br/>council · evidence · ADR]
    D --> R{Human PRINCIPAL<br/>ratifies?}
    R -->|yes, signed| C[Constitution updated]
    R -->|no| K[Rejected / revised — recorded either way]

Loading

Amendments are multi-party, signed, append-only — a recorded, attributed act, not a silent code change. Even a founding-values document enters "proposed, pending ceremony"; it does not self-ratify.

Tripwires — making drift structurally illegal

Where ceremony governs judgement calls, tripwires govern invariants: CI-style checks that fail the build if the architecture drifts. The canonical one is state ownership:

assert discover_all_state_stores(repo) ⊆ chartered_stores   # a new shadow store fails CI

The point is the modality: "don't create shadow state" as a guideline is forgotten under deadline; as a tripwire it cannot merge. Discipline moves from human diligence (unreliable) into the build (reliable).

The State Ownership Principle

There is one canonical store of truth; every other store is a read-only projection over it, never a second source.

This is what makes the provenance graph trustworthy — if beliefs could originate in six places, "trace this belief to its evidence" would be unanswerable.

Restraint as governance

Observation precedes optimization. Highest leverage ≠ do it now.

During an evidence-gathering window, a standing order freezes architectural change — the backlog may be analysed and recorded but not built until the evidence is in. The sole exception is an integrity fix (losing data, destroying evidence, or no longer producing validated episodes). This keeps a system from optimising away from the truth before it has met the truth even once.

Related habit: during such a window, things the system does are recorded as observed phenomena (recurring / contextual / incidental), not "bugs" — at n=1 you haven't earned the word "systemic."

---

📖 Full document: docs/06 · 🧩 Code: subsystems/governance.py → Next: How To Extend