ontoref — Case 0/318: the validator that never ran

🩺 Show the full clinical history → 📋 Session protocol →

Clinical record · Department of Software Pathology

Seventy-two ADRs. Three hundred and eighteen constraints, two hundred and forty-nine of them marked 'Hard. A command that exists precisely to enforce them: ontoref adr validate. And zero completed runs in the repository's entire history. Not one. No Hard constraint was ever enforced by the command that exists to enforce them — and not because of a recent regression, but since the initial commit, which git show fef21f4 signs without argument. The patient did not deteriorate. It was never alive.

History No. 0/318Diagnosis: ANTI-PAP · THE UNWIRED CONTRACTStatus: RESOLVED · WITH DECLARED DEBT

«They are all green.» In fact nobody had ever said so — and that is the picture. There was no check that lied, no inflated number, no forged receipt. There was a silence, and the silence was read as consent. Seventy-two ADRs, each with its Hard rules carefully drafted, each with its typed check beside it. The command to run them existed, was documented, and died on the first file. Nobody noticed, because nobody called it, and nobody called it, because it died.

Show clinical picture

constraint: A rule an ADR declares, and that a check must be able to falsify. It carries a severity: 'Hard binds, 'Soft is audited. The severity says how much the rule OBLIGES. It does not say — and this is the whole case — whether anyone checks it.
contract: In Nickel, a predicate APPLIED to a field, which rejects the file on export. Its virtue is that it cannot be ignored: either the data passes, or there is no data. A contract that is written and not applied is not half a contract: it is a comment.
dialect: Two ways of writing the same datum that no schema distinguishes: `cmd` and `command`, `paths` and `files`, `must_be_empty` and `absent_ok`. They appear only where nobody types the record. And they are discovered only when something tries to read it.
declared debt: A rule that binds and that nothing verifies, WHICH SAYS SO. Not green, not red: a third word that did not exist until today. Without it, everything that could not be checked simply passed — or crashed — and either way it read as health.

The protocol to declare, version and verify this → ontoref.dev

The double ledger — what it cost, and what it left

The figures on the left are the clinical picture. Those on the right, the discharge. And the zero presiding over them deserves a straight look: «completed runs of the validator, in the repository’s entire history: 0». It is not a small zero. It is the exact measure of the distance between declaring a rule and enforcing it — and that distance had been, until today, invisible by construction, because the system had no word with which to name it.

What the crime cost

ADRs in the corpus 72
Constraints they declare 318 · 249 of them 'Hard
Completed runs of the validator, in the repo's entire history 0
Typos acting as a master switch 2
Constraints each of those typos switched off all 318
Commit in which both were already present fef21f4 · «init repo»
Incompatible dialects of the same record 5
Failures revealed on the first completed run 93
…that could not pass on ANY machine, ever 39 of 93
Checks invoking a shell alias instead of a binary 33
Tags in the enum the executor never implemented 1 · 'Cargo · 3 Hard constraints dispatched to nothing
Shadow executors with their own definition of the same tag 1 · with 0 callers
Gates that could not fail by construction 3
ADRs with bash syntax inside a NuCmd 5 · two of them found by the repaired rule, not by me
Real violations underneath all of it 2

What the case left behind

The rule a contract that is not applied is not a contract: it is a comment
The master switch an unrunnable check is a FINDING about its ADR, never a crash
The third word ⊘ it binds, and nothing verifies it — not green, not red: debt
The price of confessing gate_source: name what would settle it, or you are rejected
The negative case, committed 14 assertions · one per defect exhumed
…and in the chain just test-adr-contract · just ci-adrs
The validator, today 169 Hard ✓ · 35 ✗ · 22 ⊘ · 60 Soft audited

The point of abandonment — what the table doesn't show

The point of abandonment was here, and it was close. With the validator finally starting and ninety-three failures on screen, the comfortable exit was obvious: they are old failures, they are layout, they are environment, the repository moved, we will look at them some day. That is: leave the number at ninety-three and never ask what it is made of. And doing so would have lost the only thing that matters about the case — because thirty-nine of those ninety-three are not failures. They are constraints that could not pass on any machine, ever, and that had been reading as enforcement for months. The temptation was not to ignore the problem: it was to report it without taking it apart. A ninety-three is a number; a thirty-nine that cannot be falsified is a diagnosis.

Differential diagnosis — what was ruled out

The two typos	“«It was two typos.» It was: `command =` where the executor reads `cmd`, and `paths =` where it read `path`. But a typo that breaks ITS OWN constraint is a typo. A typo that breaks THE OTHER 317 is a master switch — and that is no longer the typo: it is that the executor died with `column_not_found` instead of saying «I cannot read this check». The typo was the trigger. The weapon had been loaded long before.”	ruled out — the trigger, not the weapon
The fragile executor	“«The executor was badly written.» It was, and it is still the symptom. It crashed because it met shapes it did not expect — and it met them because NOBODY TYPED THE RECORD. `check` was an open record: `command`, `files`, `absent_ok`, a `Grep` wearing `FileExists`' vocabulary. Five dialects, all of them legal Nickel. Hardening the executor without closing the contract is teaching the patient to survive the infection.”	ruled out — the symptom
Nobody ran the validator	“«Nobody ran the validator.» Almost. Nobody ran it BECAUSE IT COULD NOT COMPLETE — it died on the first malformed ADR and returned a column error that says nothing. A command that crashes does not become a habit. But the real finding is underneath: nothing in the CI chain called it, so its death hurt nobody. A gate outside the chain is a private ritual.”	ruled out — and the finding shows through
«'Hard means it is guaranteed»	“«'Hard means it is guaranteed.» GUILTY, and it is the diagnosis. `'Hard` says how much the rule OBLIGES. It does not say — it did not say — whether anyone checks it. Thirty-nine constraints marked Hard could not pass on any machine, ever: thirty invoked validators that were never built, six carried no check at all, three used a tag with no executor. They read as enforcement. They were wishes with a severity field. The system had no word for «it binds and nothing verifies it», and everything a system cannot name is counted as health.”	GUILTY — and it is nobody's: it is the vocabulary's

Etiology — the cause — adr-schema.ncl — a contract announced in a comment and wired to nothing

// adr-schema.ncl

// Required fields per tag (validated by EachCheckWellFormed in adr-constraints.ncl):
//   'Grep -> pattern : String, paths : Array String, must_be_empty : Bool
//   'NuCmd -> cmd : String, expect_exit : Number
let constraint_check_type = {
  tag | check_tag_type,
  ..                      // ← OPEN record: any field goes
} in

...

constraints | Array constraint_type
            | c.NonEmptyConstraints
            | c.EachConstraintHasCheck
            //  ↑ and EachCheckWellFormed is NOT here

// The contract exists. It is exported. It is announced in the comment
// above. It is wired to nothing.

And it is not only check. 'Cargo had been in the tag enum since the first commit and the executor never implemented it — while a SECOND run-check, hidden in adr.nu, defined the same tag in another, incompatible way. Two meanings for one word, in two files, neither aware of the other. The three Hard constraints that use the schema’s shape answered «Cargo: cmd is empty», forever. I checked adr.nu’s two private dialects against all 72 ADRs: no ADR uses either. They were maintained for zero callers, and the price was hijacking the tag of the three that do exist.

Treatment — Wire the pipe, disarm the master switch, and give the system the word it did not have

# 1. The contract, wired. What was legal stops being legal, at export.

constraints | Array constraint_type
            | c.NonEmptyConstraints
            | c.EachConstraintHasCheck
            | c.EachCheckWellFormed     # ← the pipe that was missing

# 2. The master switch, disarmed. A check the executor cannot read is a
#    finding AGAINST ITS OWN ADR — and the other 264 keep running.

  UNRUNNABLE CHECK — NuCmd check has no `cmd` (has: command, expect_exit).
  This constraint has never been enforced.

# 3. The third word. And a confession COSTS:

  'Hard + gateable      →  enforced. Red = the code is wrong.
  'Hard + NOT gateable  →  IT BINDS AND NOTHING VERIFIES IT. Not green.
                           `gate_source` names what would settle it,
                           and without it the contract REJECTS the file.
                           With a check, too: a check admitted not to
                           gate anything is theatre.

And there is a confession that belongs in the case file because it is the evidence, not the anecdote: the gateable/gate_source mechanism is declared mandatory by ADR-071 — «a rule the checker cannot falsify MUST be marked uncheckable IN THE DATA» — and it did not exist. Not one field. Its check ran a test of a different oracle, so it went green over a mechanism that was never built. And ADR-072 then cited it as prior art. A promise in the future tense, cited as precedent, inside the two ADRs that denounce that very class. It exists now, and confessing costs: without gate_source the contract rejects the file.

Prognosis

The series asks: with ontoref, would it not have gone like this? And this case forces an uncomfortable answer, because the mechanism was not missing: it was written and disconnected. The contract that would have caught the five unreadable shapes had been in the repository since the first commit, exported, under its own name, announced in a comment three lines above the field it was meant to guard. Nobody wrote it wrong. Nobody deleted it. It simply was not connected — and a contract that is not applied is not half a contract: it is a comment. The rest follows on its own. Five dialects of the same record become legal. The executor dies on the first one it meets, and it dies in the worst possible way: not by reporting that it cannot read it, but by crashing and taking all three hundred and eighteen down with it. And since no CI recipe called it, its death hurt nobody. Seventy-two ADRs went on declaring Hard rules for months, and the rules were true, and they were well written, and nothing checked them. What makes this case worth publishing — what separates it from an anecdote about a badly connected pipe — is what surfaced underneath once the validator finally started: thirty-nine Hard constraints that could not pass on any machine, ever. Thirty invoked validators that were never built. Six carried no check at all. Three used a tag the executor does not implement. They were not broken: they were written in the future tense, and marked with the word that reads as a guarantee. The protocol had no way to distinguish «a gate checks this» from «somebody will check this some day». And everything a system cannot name, it counts as health.

A contract written and not applied	It gets wired. EachCheckWellFormed was written, exported, and announced in a comment three lines above the field it was meant to guard. A comment is not consulted, is not verified, and cannot contradict anyone.
A malformed check that kills the executor	It is reported as UNRUNNABLE against the ADR that wrote it, and the rest keep running. A check that cannot look and also annihilates everyone else's looking is worse than an empty list: it is a master switch.
A rule that binds and that nothing verifies	gateable = false + gate_source. Not green, not red: declared debt, with the address of whoever settles it. And the confession is not free, or it would be a back door for turning any red gate green.
A check whose oracle lives in your shell profile	ore and onre are aliases, not binaries. The executor runs nu --no-config-file; CI has no aliases either. A constraint that can only pass on its author's laptop is not a constraint.
A tag the contract admits and the executor does not implement	Implement it, or take it out of the enum. 'Cargo sat in the enum since the first commit with no executor — and a second run-check, in the shadows, defined it in another, incompatible way. Three Hard constraints dispatched to nothing.
A falsification done by hand evaporates	It gets committed. Every repair in this autopsy was falsified by hand, and a hand-falsification leaves nothing that would refuse the same defect tomorrow. Fourteen assertions, in the chain.

The regimen — the session, replayed with protocol

What was asked — reconstructed from outreach/.coder/2026-07_12_spanish_terms_complete_done.md

read .coder/2026-07_12_spanish_terms_done.md
finish the ADR left pending at the end

What should have been asked

Finish ADR-072, left pending at the end of .coder/2026-07_12_spanish_terms_done.md.

Before touching the prose:
1. Run `ontoref adr validate` over the ENTIRE corpus and paste the result —
   the complete run, or the exact error it dies with. An ADR about coverage
   is not finished on top of a validator that does not run.
2. Every claim you add names its verifiable: the command that falsifies it today,
   or gateable = false + gate_source with the address of what will settle it.
3. If a microtask surfaces an undecided contract — a field an ADR promises
   that does not exist — STOP and report it. Do not cite it as precedent.

At close: adr? — evaluate whether the session leaves decisions with architectural weight.

Microtask	Verifiable
Run the full validator before reading or writing any prose	`ontoref adr validate` completes — the count of complete runs stops being 0
Break every failure down: does the code violate, or is the constraint unfalsifiable?	each of the 93 classified — real violation, unrunnable check, or promise with no oracle — with its count
Build the missing primitive BEFORE using it	`nickel export` refuses a `gateable = false` without `gate_source` — seen to refuse, not assumed
Mark the 22 unfalsifiable ones by script, never by hand	all 72 ADRs satisfy the contract and `just test-adr-contract` passes
Leave the negative case of every defect unearthed	14 assertions in `just ci-adrs`, one per defect — a hand falsification evaporates

The gate before delegating: The contract and its test exist BEFORE the agent is let loose on the 72 ADRs: adr-constraints.ncl exports and just test-adr-contract runs. Without the gate closed, the agent improvises the contract it is missing — and cites it as case law. It happened: ADR-072 cited as precedent a mechanism of ADR-071 that was never built.

The ADR trigger: The third word — binds, and nothing verifies it — changes the protocol's vocabulary, and reversing it would touch all 72 ADRs: adr? scores strong on all five criteria. It landed in ADR-071/072.

Prophylaxis — what enforces the lesson today

✓
A rule that binds and that nothing verifies is declared in the data — neither green nor red: debtcontract:.ontoref/adrs/adr-constraints.ncl#gateable-gate_source
✓
The gate declares what it cannot checkadr:071/the-gate-declares-what-it-cannot-check
✓
An extended check must be SEEN to refuse the failure mode it coversadr:072/falsify-against-the-new-capability
✓
The negative case's fourteen assertions, in the chaingate:just test-adr-contract · just ci-adrs
✓
The validator's pass COMPLETES over the whole corpus as a condition of acceptance — an unrunnable check is a finding, never a crashmode:validate-adrs/run-checks

Discharge and prophylaxis

The discharge is signed by two facts that stand on their own. The first: on being wired, the contract made nickel export catch a malformed ADR that I had not found by reading carefully — the pipe, freshly connected, saw before its plumber did. The second: on pointing ADR-010’s rule at the corpus where it actually applies, it found five ADRs with bash inside a NuCmd, and two of those I had not found either. That is the difference between reviewing and enforcing. Reviewing is an act that depends on whoever reviews, and is exhausted with them. A wired contract does not tire, does not get distracted, and remembers nothing — because it does not need to.