diff --git a/knowledge/AUTHORING.md b/knowledge/AUTHORING.md index fdfc493..adff0ec 100644 --- a/knowledge/AUTHORING.md +++ b/knowledge/AUTHORING.md @@ -44,7 +44,13 @@ Before approving new or materially changed Standing Knowledge: exact-candidate Founder Decision contract; Authority effect never lowers the receipt standard. 7. Run the mechanical checks and review the exact Git diff. -8. In an Instance, confirm the exact change carries the Founder ruling required +8. Confirm each invariant the change adds or amends is **enforced or + advisory**: it names the check that fails when it stops being true — a + doctor rule, a CI check, or a per-process Check — or the rule itself states + that it is guidance. A rule with no checker decays + ([enforcement](docs/enforcement.md#a-rule-with-no-checker-decays)); a + checker whose failures are routinely ignored is the same defect. +9. In an Instance, confirm the exact change carries the Founder ruling required by `ORG.md` and `AUTHORITY.md`. In the Seed source, confirm the branch or pull request received the repository's required maintainer review. diff --git a/knowledge/docs/enforcement.md b/knowledge/docs/enforcement.md index 497f391..92a35fb 100644 --- a/knowledge/docs/enforcement.md +++ b/knowledge/docs/enforcement.md @@ -57,3 +57,50 @@ not the merge button or mutable pull-request metadata. The doctor's D6 check flags a missing CODEOWNERS file or a Standing Knowledge path that the file does not cover. + +## A rule with no checker decays + +CODEOWNERS is one instance of a general finding, and the general finding is +the reason to bother with any of layer 3. + +An Instance ran the experiment by accident. A four-dimension audit of its own +repository — duplication, staleness, contradiction, graph structure — sorted +every rule the organization held by one question: *is there a script that +checks it?* + +| Rule | Mechanically checked? | Outcome | +|---|---|---| +| Links must resolve | yes | zero dangling, across 749 files | +| Snapshots must be under 30 days old | yes | held — hard-stopped a stale purchase order | +| No concurrent overwrite | yes | held — no lost write | +| One fact, one home | no | the same rule found living in six places | +| A cadence actually runs | no | three processes had never run once | +| A control gets checked | no | every control's `last-checked` field empty | +| A ruling propagates | no | a withdrawn fix still live in two governed files | + +**Every rule with a checker held. Every rule without one decayed — several +within a day of being written.** The doctrine was not wrong and the operators +were not careless; the rules with checkers and the rules without were written +by the same people in the same week. + +Three consequences worth designing for: + +1. **Writing more doctrine does not fix a decay problem.** The decayed rules + were already written down, clearly, in Standing Knowledge. Restating them + adds a copy, which is itself the failure mode in row 4. +2. **A field nothing writes is worse than no field.** An always-empty + `last-checked` reads as *not yet stale* to every consumer, so adding the + field without adding the writer made the gap harder to see, not easier. +3. **The checker has to key on the thing that is true, not on a proxy for + it.** A governance route that ends "…and one recorded ruling" needs the + check to be *ruling artifact present*, not *commit message mentions a + ruling* — the route was followed three steps out of four several times, and + only the fourth step was the one that made the change findable later. + +So the practical test when adding any rule — asked by +[AUTHORING.md's Standing Knowledge review](../AUTHORING.md#standing-knowledge-review): +**name the script that will fail if it stops being true.** If there is none, +either write one, or write the rule knowing it is guidance rather than an +invariant — and say which it is, in the rule itself. A checker whose failures +are routinely ignored has stopped being a checker; a red check nobody reads +decays exactly like a rule nobody checks.