A brand family is declared once and inherited: the mechanism is the protocol's, the family's values are the principal's, and every departure is declared

Context

ADR-125 made one identity declared once and generated. It said nothing about identities that share a look. Seven projects of the constellation (custody, iter, isolation, signatio, specdossier, openbyname, wuwei-observer) did, by copy: measured on 2026-10-25 across their visual/style.ncl, the light neutrals and the light logo ink were identical in 7/7, the dark neutrals in 6/7, the legibility pairs in 5/7, and every accent followed one luminance rule while being written by hand.

That day one family criterion — the light logo's pair: a slate ink #5B6472 and each accent lifted to Y 0.23, held to 3:1 on the ground — took the same hand edit in seven style.ncl, seven brand.ncl and two local Theme contracts, plus seven rationale sentences saying the same thing. The copies had already drifted in what they claimed: openbyname documented a lifted light accent while its siblings' rationale kept saying every accent sat at the family's luminance, and nothing compared the two claims.

Decision

A BRAND FAMILY IS DECLARED ONCE AND INHERITED. branding.ncl ships the mechanism: a `Family` (palette, legibility pairs, a logo rule — one ink per theme and an accent luminance with a tolerance — and shared rationale) and `inherit`, which builds a member's style from the family under the member's own declaration, field by field, and links it (`family`). The contract refuses a member's departure from what its family declares unless `family.exceptions` names it with its reason, and refuses an exception that names no departure. The family's VALUES are the principal's: a family is a file under the installed contract's `ontology/families/` (the first, `constellation-style`), read where it is installed like the contract itself (adr-108), never written into the schema. The branding index publishes the family's rationale once and each member's declared departures. Opt-in: a style that names no family is checked exactly as before.

Constraints

• Hard branding.ncl refuses a family member's undeclared departure and a stale exception, and accepts a declared one.
• Hard branding.ncl declares no colour value; a family's colours live in its own file under ontology/families/.

Alternatives considered

• Keep the values as per-project copies — rejected: Measured drift and a seven-file edit for one criterion; the copies are the problem this decision removes.
• Ship the family's palette in branding.ncl — rejected: The protocol would choose colours; ADR-125 forbids taste by validator. The schema carries the mechanism, a family file carries the principal's values.
• A family as a domain the members bond to on a 'Dependency plane — rejected: Heavier for what is shared data: it keeps the values out of the install, at the cost of a new domain authority. The principal chose the install (2026-10-25).
• Inherit by merging at `| default` priority — rejected: A member that overrides one key replaces the whole inherited record; measured.

Anti-patterns

• A family value copied into a member — A member restates a colour, a pair or a rationale its family declares, so the family's next change misses it.
• A silent departure — A member overrides what its family declares without saying why, and the family's claim about every member stops being true.

Related ADRs

ADR-125 · ADR-108 · ADR-070