Context-provision is governed — ontoref is the single source of truth about the protocol; carriers invoke it live and hold no protocol content, pointers, or verifiers of their own
Accepted
Context
A session — a person or an agent — arrives needing to know how the protocol works: how a project self-governs its relation to a domain, what vocabulary is mandatory, how bonds are declared and retyped. The convenient move, and the one this session nearly took, is to answer where the session already looks: write the how-to into the project's CLAUDE.md, propagate a bond-vocabulary block into every consumer's CLAUDE.md, plant a topic-specific line into a SessionStart hook under `~/.claude/`, add a verifier next to it. Four turns of the same reflex: put the truth where the reader is standing.
That reflex is drift by construction, and the ontology already names why. `dev-internal-overlay` classes `.claude/` as dev-internal OPERATIONAL CONFIG — a carrier, not a home for governed content. `ontoref-three-layer-model` states the rule generically: protocol truth is Layer 1 / protocol-qa, and "this entry exists so adopters discover the layering from protocol documentation, not by re-deriving it across three projects"; Layer 3 (per-caller, per-machine wiring) is OUTPUT of a relationship, "never in this project's repo", referenced by "explicit pointers, never copy-paste". ADR-028 already forbids the clone: the ontology is addressable independently and a consumer verifies BY WITNESS, NOT BY COPY.
The sharp form of the requirement, as stated in-session: we do not want channels, pointers, declarations, or verifiers SCATTERED across the universe and its constellations on one particular machine's disk. ontoref is the one that governs, and is responsible for the truth about questions like these AS SUCH. The failure is not that carriers exist — an agent does read CLAUDE.md first, and that is legitimate reach. The failure is content, pointers, and verifiers ACCRETING in those carriers as a second authority that no witness keeps in sync with the governed surface. Two copies, no witness, guaranteed divergence the first time one is edited and the other is not.
There is already a correct shape in production and it was almost overlooked: the generic on+re conduits (the SessionStart orient hook, the UserPromptSubmit routing that answers "esto ya está gobernado — `ontoref qa show <id>`"). They carry NO protocol content. They ASK ontoref, at read-time, which governed entry houses the current topic, and surface a live pointer INTO the governed surface. The content stays in ontoref; the routing is decided by ontoref; the carrier is a thin, generic, topic-agnostic conduit. That is the pattern this ADR ratifies and generalizes — and it is the pattern whose alternative (topic-specific truth accreting per carrier, per machine) it forbids.
Decision
CONTEXT-PROVISION ABOUT THE PROTOCOL IS GOVERNED. ontoref's own surface — the ontology, reflection (qa, modes, disciplines, substrate views), adrs, the CLI/daemon/MCP that serve them — is the SINGLE SOURCE OF TRUTH and the SINGLE RESPONSIBLE AUTHORITY for how the protocol works. The answer to a "how does X work in the protocol" question is a QUERY answered by ontoref, reached by asking ontoref at one addressable locus, not a copy read from wherever the asker happened to be standing.
Three rules follow, and they are the contract:
1. TRUTH LIVES ONLY IN THE GOVERNED SURFACE. Protocol knowledge is authored once, in ontology or reflection, where ontoref can type it, validate it, witness it and version it. A qa entry, a discipline, a schema, an ADR — these are homes. A carrier is not.
2. CARRIERS INVOKE; THEY DO NOT REPLICATE. An external carrier (a project or global CLAUDE.md, MEMORY.md, a SessionStart/UserPromptSubmit hook, an agent memory index) may hold at most a THIN, GENERIC, TOPIC-AGNOSTIC invocation that resolves against ontoref at read-time — the shape the orient/routing hooks already have. It holds NO protocol content, NO topic-specific pointer table, NO per-topic declaration. Routing is ontoref's job (the hook asks ontoref which entry is relevant), never a hand-maintained map in the carrier.
3. THE GOVERNOR VERIFIES; VERIFIERS ARE NOT SCATTERED. If a check is needed that a carrier has not accreted duplicated truth, that check is ONE command inside ontoref auditing its own carriers — the governor doing its job — never a validator planted per-machine, per-repo, next to each carrier as its own little authority. Centralized-in-ontoref is the cure; scattered-across-disk is the disease, and a scattered verifier is the disease wearing the cure's clothes.
Corollary for the bond work that surfaced this (adr-073): the bond how-to lives as ONE governed qa entry (`bond-carrier-layout-howto` in `reflection/qa.ncl`) and as the `bonding` discipline/substrate view that references it — NOT as a bond section propagated into consumer CLAUDE.md files, NOT as a bond-specific hook line, NOT as a per-repo bond verifier. The existing bond vocabulary block in the producer-level CLAUDE.md is legacy duplication under this ADR and is to be thinned to the generic "ask ontoref" conduit, not extended.
SCOPE — TRUTH, NOT INSTRUMENTS. This ADR governs protocol TRUTH: definitions, directives, vocabulary, how-the-protocol-works knowledge. OPERATIONAL INSTRUMENTS — fill-in-the-blanks forms, materializable templates, prompt scaffolds, mode step-sequences (reflection/forms/, reflection/templates/, reflection/modes/) — are NOT carriers of truth: filling one produces a disposable work product, not a second authority, and materializing one is not replication. An instrument crosses into this ADR's territory only when it INLINES governed content instead of referencing it. That boundary is watched SOFTLY, from one place — the instrument registry (reflection/instruments.ncl) read by `sync instruments check` — and softly on purpose: an instrument may legitimately NUANCE or EXPLAIN governed content with no intent to stand over the governance; a match is a finding for a human to judge, never an automatic verdict of drift.
This ADR is itself an instance of its own rule: it is authored once, here, in the governed adrs/ surface; every carrier that needs it points a session at `ontoref` to read it, and copies nothing.
Constraints
- Hard The bond context-provision how-to lives in the governed qa surface, not in a carrier.
- Hard The governed provision channel exists as ontoref infrastructure — the substrate-view/discipline registry through which a session is provisioned by asking ontoref.
- Soft No protocol content, pointer table, or independent verifier lives in any external carrier (CLAUDE.md, MEMORY.md, hooks) as a second source of truth; carriers hold only a thin generic invocation.
- Soft Session instruments (forms, templates, prompt scaffolds) reference governed entries instead of inlining governed content; the instrument registry exists and the governor audits it from one place, softly.
Alternatives considered
- Propagate the content into every consumer's CLAUDE.md (and a hook line, and a memory entry) so a session has it inline without asking. — rejected: This is the reflex the ADR exists to stop. It duplicates governed truth into N per-machine carriers with no witness; the first edit that misses one copy is silent drift. dev-internal-overlay classes CLAUDE.md as a carrier, and three-layer-model forbids re-deriving protocol truth across projects.
- Keep content in the governed surface but maintain a per-carrier POINTER TABLE (topic -> entry id) in each CLAUDE.md/hook. — rejected: A pointer table is governed content in disguise — it encodes what-houses-what and drifts as the surface changes. Routing belongs to ontoref (the orient/routing hooks already decide relevance live); a hand-maintained map fragments that authority across carriers.
- Enforce no-duplication with a verifier installed alongside each carrier, per repo and per machine. — rejected: That is the scattered-verifier the requirement names explicitly: each deputy carries its own model of the truth, per disk, competing with the governor. One audit inside ontoref keeps the authority singular; scattering it recreates the fragmentation it was meant to prevent.
- Abolish content-bearing carriers entirely — forbid CLAUDE.md/hooks from surfacing protocol knowledge at all. — rejected: Collapses formalization-vs-adoption toward formalization: carriers are how the protocol reaches a session before any command runs. The synthesis keeps the conduit and empties its payload, rather than removing the reach.
Anti-patterns
- Answering Where the Reader Stands — Governed protocol knowledge is copied into a carrier the reader already looks at — a project or global CLAUDE.md section, a MEMORY.md entry, a hook body — so a session finds it inline without asking. The copy has no witness binding it to the governed surface; the first edit to one side that the other misses is silent, undetectable divergence, and the carrier now confidently serves a stale truth.
- Deputies With Their Own Badge — To stop carriers drifting, a verifier is installed next to each carrier — per repo, per machine — each encoding its own model of what the truth should be. The remedy fragments the very authority it was meant to protect: now there are many little verifiers scattered across disks, each a candidate second source of truth, none of them the governor. Enforcement itself becomes the thing that drifts.
- Trusting the Photocopy — A session treats a carrier's inline copy as authoritative and never asks ontoref, so it cannot tell whether what it read is current. Drift becomes invisible not because it is absent but because nothing ever compares the copy to the source. The carrier was meant to point at the governor; instead it stands in for it.