Governed delivery: commission, statement of work, work order and witness

How work is commissioned without trusting the report of whoever does it: the terms are declared before and outside the executor, a person signs the statement of work, the checks decide whether it is done, and the witness leaves a receipt that can be verified.

← The ladder · Develops: 5 · Accreditation, 2 · Reflection

Why it matters

Two axes. One is the subject — what the project is: axioms, decisions, state. The other is the act — what the project does: the typed DAGs that run against that subject and check whether it still tells the truth. Ontology and reflection are co-equal axes: neither is primary. But co-equal is a claim about rank, not about connection. Two axes of equal standing, floating beside each other, are not a system. They are two filing cabinets in the same room.

What makes them one thing is a seam — and the seam is not a concept. It is a signature.

The act must be accountable to the subject

Every time the act-side changes the subject — a state transition earned, a decision accepted, a harvest applied — something has to make that change accountable. Not "was it a good change" (that comes later, and from humans). First and structurally: who made it, on top of what, and when. Without that, the reflection can rewrite the ontology and leave no trace of authorship — and an ontology you can rewrite anonymously is not a subject, it is a whiteboard.

So every tier-2 state mutation carries an Ed25519 witness: a signature over the actor, the parents (the mutation's causal predecessors), and the time, folded into a replayable oplog DAG. The seam between the two axes is cryptographic. You do not take the loop's word that the update happened honestly — you check it.

Signing the mutation, not the artifact

This is the move that separates ontoref from everything adjacent, and it is worth being precise about, because the neighbors all sign something:

ADR tooling (adr-tools, Log4brains) captures the why — the decision — and never the act that followed it.
Supply-chain attestation (SLSA, in-toto, cosign) signs the binary — the output — not the moment the architectural state changed.
Git optionally signs the commit — the diff — with no typed preconditions and no notion of the state it mutated.
GRC / SIEM keep process logs, mutable, with no per-mutation proof.

Each signs a noun. The witness signs the verb at the seam — the instant a decision becomes a mutation of the subject. That is why "why it was decided" and "who mutated it, signed" end up in the same replayable graph: you can walk from a state change to the decision that authorized it and the actor that performed it, and every edge is provable. No other tool puts the reason and the act in one witnessed structure.

What the signature does not prove

Here the discipline matters more than the cryptography. A witness proves who changed what, from what prior state, when. It does not prove the change was correct, wise, or true. The validators sealed by the witness are structural, not truthful — they attest that a bounded slice of state holds a declared shape, never that the decision behind it was good.

This is the tool-boundary axiom applied to a signature: a witnessed mutation can still be a mistake. What you gain is not infallibility — it is accountability you cannot repudiate. You know exactly whose mistake it was, on top of what, and when, and you can replay the graph to the moment it entered. Confusing "signed" with "correct" is the error the seam is designed to forbid: it bounds blame, not judgment. Knowing that boundary is what keeps the crypto honest.

The seam is what makes the loop trustworthy

Recall the loop's warning: an update no one can trace is worth no more than the stale claim it replaced — a rewrite you cannot audit is just drift with a fresher timestamp. The witness is the answer to that warning. The ontology at t+1 can trust what the reflection at t handed it because the handoff is signed: actor, parents, time. The loop is not merely a cycle that runs; it is a cycle whose every turn leaves a trace you can audit. Take the seam away and on+re is a rumor that happens to repeat. Put it back and the rumor becomes a record.

And the seam is built to outlive its own primitive. The witness scheme is tagged, so the day Ed25519 must give way to a post-quantum signature, the replayable history survives the migration — the form of the proof persists while its content, the algorithm, is swapped underneath. That is the form-vs-content tension made mechanical: the shape of accountability is permanent; the math that implements it is replaceable.

The thread is a signature

Form and flow do not merge at the seam — they are sewn. The ontology stays the noun, the reflection stays the verb, and between them runs a thread you can pull to trace every stitch back to the hand that made it. That is the whole difference between a system that claims coherence and one that can prove it: not a better argument, a signed one. Two axes become one system exactly where you can no longer change one without the other knowing who you are.

What holds it up

Architecture decisions

ADR-063 — The Work-Order Governance Unit — Constrain an Agent by an Externally-Owned Contract and a Witnessed Deliverable, Not by Trust
ADR-066 — Governed Delivery — the Work-Order Unit Promoted to an Enforcing Executor: the Check Decides, Never the Reporter
ADR-070 — Delivery Trees Declare Owner, Reproduction and Witness — the Site's Publication Pipeline Is Governed, Not Remembered
ADR-047 — Cryptographic Agility — Scheme-Tagged Witnesses with Ed25519 Default and ML-DSA-65 FIPS Plug-In

Procedures

governed-delivery — 8 steps, 2 carried by a person
coordinated-delivery — 11 steps, 1 carried by a person
ordinary-act — 3 steps, 0 carried by a person

Vocabulary

Encargo (work commission) — Umbrella for the governance unit that constrains an agent by checking the deliverable against explicit terms instead of trusting the operator.
Statement of Work (SOW) — The terms layer of an Encargo: scope (minimal context + one-sentence objective), a falsifiable contract (a machine check, schema or constraint), and the validation mode ('Machine | 'Adversarial, signed or not).
Work Order (WO) — The execution layer of an Encargo, run under one SOW: disposable, contained, owned by the agent.
Verified witness — A content-addressed, Ed25519-signed receipt of an act, deposited at the witness-as-axis seam.

Graph nodes

governed-delivery — Governed Delivery — Witnessed Work Orders
witness-as-axis-seam — Witness as Axis Seam

How it is exercised

ontoref mode show governed-delivery
minisign -S -m .governance/<SOW>.ncl
minisign -V -p .governance/witness.pub -m .governance/<SOW>.ncl -x .governance/<SOW>.ncl.minisig
minisign -V -p .governance/witness.pub -m .governance/receipts/<WO>.jsonl -x .governance/receipts/<WO>.jsonl.minisig

What no check answers

5 · Accreditation Whether the accredited path is REACHABLE, which for this project it is only in half. The commitment half runs (extraction stamps _refs.ncl and a pre-commit gate asks for it), while the per-actor witness is tier-2 behind POST /ops and no service runs it — so the checks above pass over a schema and a public key while the act they exist for is dormant. That gap is a decision waiting, not effort waiting, and no FileExists will ever say so.

2 · Reflection Whether the declared modes are actually RUN. A mode nobody invokes is inert rather than still, and the distinction is invisible to a check over declarations: measured 2026-08-14, governed-delivery ran twice in six weeks while generate-article ran twenty-six times, and both were equally present on disk.

This page is not written here: it is projected from .ontoref/positioning/keys.ncl, from the rungs it develops in .ontoref/reflection/ladder.ncl, and from the decisions, procedures and terms it names.