Governed Delivery — the Work-Order Unit Promoted to an Enforcing Executor: the Check Decides, Never the Reporter
Accepted
Context
ADR-063 accepted the Work-Order Governance Unit as an APPROACH and explicitly gated its promotion to a built substrate on a second realized instance exercising signed witnesses end-to-end. That gate is now discharged twice over: hand-wired instances in the provisioning constellation (its ADR-050, signed L1/L3 receipts), and — decisive — a falsación run on ontoref itself (2026-07-04, `.coder/2026-07-04-governed-delivery-falsacion.done.md`) that drove the ACTUAL mode-DAG mechanism through eight refutation attempts.
Before this work, the executor did not enforce what the mode narrated — the exact failure shape ADR-063 records, reproduced one level down, inside the enforcement machinery itself: `'Block` guards only printed WARN (`run start` never evaluated them, contradicting both ADR-011's decision text and the schema's own comment); `steps[].verify` was dead code in BOTH executors — `step report --status pass` was taken on faith even on steps declaring a check, so an agent could report `witness-pre pass` without invoking the witness; `postconditions` were prose `mode complete` never read, while the mode's own step text claimed a signature verification that did not exist; committer-identity ratification could not distinguish actors sharing one git config. The falsación found three more defects the reviews had missed: a contract check that vacuous-passed from any wrong cwd (`! grep` on a missing file exits 0), exempt-matching by substring that exempted unrelated violations, and first-wins step reads that made 'resolve and re-run this step' structurally impossible.
Decision
Promote governed delivery to a built, enforcing substrate. The semantic core, frozen as three design gates before executor work started:
ONE RULE ABOVE ALL — where a machine check exists, the check decides; a reporter's word can refuse to be contradicted but never override.
- Run variables (⛓G-1): a mode declares `vars_required`; `run start` receives each as a KEY=VALUE argument, refuses to start when one is missing, persists them in run.json; the executor substitutes exactly the declared `${KEY}` occurrences in guard/verify/postcheck commands — undeclared `${…}` passes through to the shell untouched.
- Guards are preconditions: evaluated once at `run start`, post- substitution, fail-closed — a failing `'Block` guard aborts before any run state exists; `'Warn` prints and continues. This makes ADR-011's "'Block aborts execution" true for the run/step-report path.
- Verify decides (⛓G-2): a step declaring `verify` has its status DERIVED from the check's exit code — the executor runs it; an explicit --status contradicting the derived one is refused with nothing recorded; `skip` on an executed verify is refused; `cmd` is informational and never executed by `step report`. A verify still carrying a bare `{word}` form placeholder after resolution is form-scoped: not runnable in that context, explicit --status required. steps.jsonl records `status_source` (`verify` / `reported` / `reported-form-scoped-verify`) so the audit trail states who decided every status.
- Completion is machine-checked: `postchecks | Array { desc, cmd }` run at `mode complete`, fail-closed, each failure a named blocker; an incomplete run exits 1 (CI can gate on it). `postconditions` remains human prose. The latest report of a step supersedes earlier ones — matching the executor's own 'resolve and re-run' instruction.
- Every signature is a separate, human-executed, out-of-band act (⛓G-3): ratification is a detached minisign signature over the SOW, verified against `.governance/witness.pub` (data in the governed repo, not env) — never committer identity; the receipt gets a second detached signature; the witness NEVER signs its own output; no schema ever carries an embedded signature field (a file cannot reference a signature computed over its own bytes including that reference).
- The witness is honest about location and exemption: contract checks run with cwd pinned to the governed repository root (the parent of the `.governance/` the SOW lives in), so a relative path can never vacuous- pass from an unrelated cwd; an exempt-bearing contract must emit one violating path per stdout line and exemption subtracts exact paths — the verdict is `exempt` only when EVERY violation is exempt.
Distribution rides the EXISTING adoption channel, no new mechanism: the mode ships in the installed reflection tree; the witness stays single- source in the code repo and is PROJECTED by install into `reflection/bin/witness.nu` (one source, frontier inside the build — never vendored into consumer repos); SOW validation is an opt-in contract (`ontology/schemas/sow.ncl`); migration 0041 (protocol 0.1.17 → 0.1.18) carries adoption, its check passing for projects that never adopt.
Constraints
- Hard A step declaring `verify` MUST have its status derived from the check's exit code by the executor; an explicit --status contradicting the derived one MUST be refused with nothing recorded.
- Hard `'Block` guards MUST be evaluated at `run start`, post-substitution, and a failure MUST abort before any run state exists. A WARN-only evaluation of a 'Block guard is a regression to narrated enforcement.
- Hard No script, witness, or executor may sign artifacts; every signature is a human act in the human's own shell, verified as a detached sidecar against a public key stored as data in the governed repository. No schema may carry an embedded signature field.
- Hard Contract checks MUST run with cwd pinned to the governed repository root, and SOW checks SHOULD assert file existence before inverting a match on it — a check that can pass vacuously from a wrong cwd is not a contract.
- Soft An exempt-bearing contract MUST emit one violating path per stdout line; exemption subtracts exact paths and the verdict is `exempt` only when every violation is exempt. Substring matching against check output is forbidden.
- Soft The witness ships single-source from the code repository, projected by the install pipeline into the shipped reflection tree. It MUST NOT be vendored by copy into consumer repositories.
Alternatives considered
- Ratification by git committer identity (the original guard) — rejected: Cannot distinguish actors sharing one git config — the exact environment agents run in. A detached signature against a key the agent provably cannot drive is actor separation by cryptography, not by configuration.
- Keep --status authoritative and treat verify as advisory documentation — rejected: That is the pre-existing state, disproven live: an agent can and did report a gate step it never executed. Advisory checks are ADR-063's 'typed-but-unforced is still prose-unforced' one level down.
- Evaluate guards on every step report (where the old WARN loop lived) — rejected: Guards are preconditions; re-running them N times per run is the wrong lifecycle point, costs N shell executions, and still gated nothing. Once at run start, before any run state exists, is where refusal is cheap and clean.
- Embed the signature (or a signature field) in the SOW/receipt schema — rejected: A file cannot correctly reference a signature computed over its own bytes including that reference. Detached sidecars keep signing fully out-of-band and survive byte-exact restores — proven in falsación F3/F7.
- A new distribution channel (per-project vendoring of mode+witness) — rejected: Vendor-by-copy is the drift the constellation already forbids (provisioning ADR-046/050, §7.4). The installed reflection tree already reaches every consumer; the witness is projected from one source at install time — no copy to drift.
- First-wins step records (the pre-existing behavior) — rejected: Made the executor's own instruction ('resolve and re-run this step') structurally impossible — a failed step blocked its run forever. Latest-wins matches the instruction and preserves the full fail→pass history in the append-only log.
Anti-patterns
- Prose Claiming a Check the Executor Does Not Perform — A schema comment, step action text, or postcondition asserts that something is verified ('Block aborts', 'mode complete verifies the signature') while no code path performs it. The narration reads as safety while gating nothing — the ADR-063 failure reproduced inside the enforcement machinery.
- A Contract Check That Passes for the Wrong Reason — A check whose failure mode is indistinguishable from success — `! grep` on a file the cwd does not contain, a test against a path that silently does not exist. The receipt records 'pass' while nothing was examined.
- One Exemption Silencing Unrelated Violations — Exemption matched by substring against the whole check output marks the entire contract exempt when any exempt path appears — real violations ride out under a neighbor's exemption.
- A Self-Reported Human Act Whose Effect Nothing Checks — Human-actor steps are self-reported by necessity; the design stays sound only because their EFFECT is machine-verified downstream. A mode whose human step has no subsequent verify or postcheck recreates done-by-assertion for exactly the acts that matter most.