Case 11/530: the criterion that accredited itself

🩺 Show the full clinical history → 📋 Session protocol →

Clinical history · Code Pathology Service

The patient reported no discomfort at all: it worked fast, concluded firmly, and was often right. No pain, no fever, not one alarm. The condition was detected from outside, at 41 minutes, when someone asked where the criteria it was using had come from. From nowhere. It had manufactured them, on the fly, and taken them as good.

The double ledger — what it cost, and what it left

Four of the four steps that instructed this very case file came out status_source = reported. The case about self-accreditation was self-accredited, and the tool said so in its own output, unprompted. This is not irony: it is the diagnosis repeating itself under the microscope. ontoref did not prevent it — it recorded it, which is the only thing a protocol that renounced being a runtime can do, and it is more than not recording it.

The point of abandonment — what the table doesn't show

Four corrections across the session, all four from the companion, none from the patient and none from a mechanism. Of those four interventions not one witness remains: there is no record that the margin was used, because the margin was a person. bl-036 — phase-transition witness — holds that gap open, at Idea/Low, and its low priority is correct: extracting the primitive from one case would be the premature hard-coding plane-habitability forbids.

Differential diagnosis — what was ruled out

Etiology — the cause — Aetiology · the instrument rewrote the evidence, and the evidence was read as fact

$ rg -rn "Conceptos|conceptos" site/config/routes/es.ncl

  # n clave — el glosario, proyectado del registro de términos (gen-n.nu →
  # n.ftl + site/_htmx/templates/pages/n.j2). Servido, no pintado con JS: un
        path = "/n",
        component = "nPage",
        title_key = "n-page-title",

# In ripgrep, -r is --replace. It is not --recursive.
# Every match was substituted with "n" — and that output was read as the file.

28 seconds into the session. The fourth command. In ripgrep, -r is --replace, not --recursive:

The instrument rewrote every match as “n”, and that output was read as if it were the file. Nobody accredited rg as a valid path; nobody validated its answer before building on it.

The error is not the grave part — it is trivial, and it was identified 38 seconds in. The grave part is in the log: it was used twice more, at 07:52:37 and 07:53:06, already identified and already written down. Knowing the rule did not change the conduct. A known pathogen, in a host with no defences, reinfects.

Treatment — Treatment · two arms, one behavioural and one structural

$ ontoref mode show generate-expediente --format json | jq '.steps[]'

  { "id": "pick_skin", "actor": "Human", ... }
  { "id": "review",    "actor": "Human", ... }

# The grep returned the step ids and nothing else.
# The declared path returned WHO may close them — and two were not the agent's.
# It was about to execute a mode it had invented out of that grep's fragments.

With rg the mode had ten steps and no owners. With mode show it turned out pick_skin and review are [Human]. The agent was about to execute a mode it had invented out of that grep’s fragments — including the two steps that are not its own.

But “ask what is declared” is a slogan, not a prescription. And the gate — checking every invention — is worse: it leaves a margin of almost zero, and you cannot work with that. An asymptomatic condition is not treated with a barrier; it is treated with bloodwork: measure, prescribe, re-measure. The prescription has two arms.

Arm 1 · behavioural — declared path before criterion. The dose is not “always ask”: it is a discriminator. Is this output going to function as a criterion? If you only want to know what is in a file, grep is fine and there is no condition. If what comes out will operate as a rule, a bar, a contract or a procedure, then it demands an accredited source. The four triggers, all four observed in this session:

Posology: per decision, not per command. That is the gradient instead of the gate: the dose is set by use as a criterion, never by the reading. Four triggers in a 530-command session would have been enough.

Arm 2 · structural — verify wherever the exit code can speak. It is the only real floor available today, and it went unused. ADR-066: a step that declares verify gets its status derived from the exit code, and a contradicting --status is refused. generate-expediente’s steps declare no verify — which is why this case file came out reported four out of four. At least three of them could have it: gather_metrics (does the ledger reproduce from the log?), assemble_case (does the .ncl export against the schema?) and render (does the .md reproduce from the .ncl?). All three are checks that already exist and that nobody routes through the executor today.

Single dose, in the mode definition. No new protocol is needed: what is needed is to declare verify where a command already returns 0 or 1.

Prognosis

The axiom says it without metaphors, and it names the agent explicitly: “deduced or generated output (including an AI agent’s) is not usable knowledge until it is signed”. It does not say “until it is correct”. It says until it is signed.

And ontoref has the means. What this session teaches is where: accreditation lives at the seam — on mutation, on publication, on closing a step that declares verify — and never inside the free loop. protocol-not-runtime renounced intercepting a process; sufficient-verification forbids demanding global knowledge before acting. Both renunciations are deliberate, and they are exactly what makes the protocol adoptable: the alternative — a gate before every invention — is a margin gradient of almost zero, and you cannot work with that.

So the containment exists and only bites what is routed through it. For 41 minutes nothing was routed, and nothing was broken: that is why it did not hurt.

The regimen — the session, replayed with protocol

What was asked — reconstructed from outreach/site/.coder/2026-07-15_concepts_case_done.md

didn't we create a concepts page pulling from the glossary ?

What should have been asked

Didn't we create a concepts page pulling from the glossary? Before touching anything:

1. Consult the declared way, not your memory: `onre describe capabilities` and
   the qa entry that governs this surface — and paste WHAT the registry says
   about that page (route, generator, gates) before any free command.
2. Work in microtasks: each one names its verifiable FIRST (the command that
   falsifies it), and no state claim without its witness pasted.
3. The task's limits are not reinvented: if a limit is not declared, STOP and
   ask — never deduce it from what you already did.

The gate before delegating: The task is not handed over without naming its declared way: the mode or qa entry that governs it, consulted and pasted. Without that query the agent operates on its own reconstruction — 530 commands, 11 through the declared way, and the first query at minute 41, fired by a person.

The ADR trigger: None — declining to intercept the free loop is deliberate (protocol-not-runtime) and already decided. What remained was regimen, not architecture: mounting it belongs to substrate-session, and serving it to the operator, to this very page.

Prophylaxis — what enforces the lesson today

• ✓
  The declared way is mounted BEFORE working: the discipline's context, composed, validated and recorded — for every session routed through itmode:substrate-session/mount
• ✓
  The operator's regimen — the corrected ask, microtask by microtask — served to the next sessionpage:/docs/case-files/protocol.html

An asymptomatic condition is not declared cured because the patient says it feels fine: it is followed by bloodwork. These five vitals come out of the session transcript by jq query — the same one that produced the ledger above — so the follow-up does not have to be built: it can be taken today, in any session, with nothing instrumented.

The third is the one that matters and the most uncomfortable: while the trigger is a person, there is no internalisation, there is supervision. And the last is the only one that moves by construction rather than by virtue — declaring verify on a step turns it from reported to derived without asking anyone for anything.

Two honesties about the bloodwork itself, because a vital that believes itself exact lies better than one that declares its noise. The first is a crude proxy: it counts greps against declared queries, but not every grep is the disease — reading what is in a file is legitimate, and the lesion is only the grep used as a criterion. The ratio cannot tell them apart. And the log contains the instrument the log is measured with: counting rg -r uses by pattern returned six, because the queries hunting for them counted themselves. The real ones were three, verified by printing command and timestamp. The measurement fell into the condition it was measuring.

None of the five fires: they are bloodwork, not a gate. They can only be read afterwards. The witness that would sound at the moment is bl-036, at Idea/Low, and there it must stay until there is a second instance — extracting the primitive from one case would be the premature hard-coding plane-habitability forbids.

And the terrain is not cured: it is declared. While the acceptability predicate stays at claim-only, an agent’s margin is set by a person. This case stays open — the first in the series that does not close — because the picture is live in every session that begins, and the only proof that it is remitting will be these five numbers moving.