# OpenProse Reactor Pattern ###### How to write OpenProse for a Reactor-class harness — the language layer beneath evented reconciliation. The OpenProse corpus divides labor exactly, and each document maps to what ships: - [01-Language.md](./01-Language.md) — **the Language & Framework**, bundled as the **SKILL**: syntax, kinds, sections, compile model, std/co. - [02-ReactorHarness.md](./02-ReactorHarness.md) — **the Reactor Harness**, bundled as the **CLI/Server**: the runtime control architecture (loop, invariants, the reconciler, memoization, forecast, receipts, composition). It answers _what the runtime must do_. - [03-ReactorPattern.md](./03-ReactorPattern.md) — **this document, the Reactor-Native Authoring Pattern**: **SKILL-bundled but harness-governed**. Where the Harness doc says what the runtime does, this says **what the author writes** so the runtime can do it. It bridges the Language doc and the Harness doc and is the definitive guide to writing `*.prose.md` for a Reactor-class harness. - [ReactorFeedback.md](../history/ReactorFeedback.md) — **the decision log**, not shipped: the dialectic that produced the Harness doc; the clean statements live in the docs above and it does not repeat them. - [00-Tenets.md](./00-Tenets.md) — **the constitution**. When any document tensions with a tenet, the tenet wins. The relationship is the same as the one between a language reference and an effective-style guide. The harness doc tells you the machine has memoization, forecast-gated quiescence, deterministic commit-gating, and receipt composition. This doc tells you how to write contracts so those mechanisms actually engage instead of degrading to "cron plus a prompt." This file has three parts, mirroring the harness doc: 1. The ideal Reactor-native authoring pattern. 2. What the OpenProse skill implements today. 3. What must change in the skill before the pattern is fully authorable. The single most important principle, stated once up front so the rest is read in its light: > **The Reactor paradigm does not change OpenProse syntax. It inverts which > kind is the program.** Every section, kind, and keyword the pattern needs > already exists. What changes is doctrine: the responsibility is the > top-level authored object, the render is where the work happens (there is no > separate fulfillment system), and two contract sections (`### Maintains` and > `### Continuity`) carry a cost-and-reconciliation obligation they did not > visibly carry before. --- ## I. The Ideal Reactor-Native Authoring Pattern ### The inversion `01-Language.md` settles the mental model: the **responsibility is the program**. A standing goal, written as durable intent, is the top-level authored object; everything else is derived from it. ```text The responsibility is the program. A gateway is how the world reaches it. A function is a helper one render calls; the DAG is how responsibilities compose. Forme, the canonicalizer, and the VM are the substrate, never the unit of authoring. ``` The authoring consequence: **you do not start by writing a system. You start by writing one sentence of durable intent and what makes it true** — a `### Goal` and a `### Maintains`. A responsibility is _served_, not _run_, but that is not a limitation: "not directly runnable" means "continuously reconciled," which is the entire point. The render of a single responsibility still runs standalone (language sovereignty), so there is no lesser, non-executable artifact here. ### The canonical contract A Reactor-native unit of work is, at its smallest, **one file**: a `kind: responsibility` whose `### Maintains` declares the truth to keep current. It grows only as the work demands: | File | `kind:` | What the author is really writing | | --- | --- | --- | | The standing goal | `responsibility` | One `### Goal` sentence + the `### Maintains` world-model that makes it true (type, facets, canonicalization, postconditions) | | Event ingress | `gateway` | How and when the world is allowed to wake the loop | | A helper | `function` | A called, ephemeral computation a render invokes — `### Parameters` → `### Returns` | There is no separate "fulfillment system," no "sense service," no "verdict service," and no "ledger service": the render *is* the fulfillment, the canonicalizer *is* how change is sensed, `gateCommit` *is* the admissibility check, and the signed receipt ledger *is* the storage — all owned by the harness, not authored. A reader who understands the responsibility understands the program; the rest is _how_, and may change without the intent changing (invariant 1, at authoring time). ### Authoring derived from the invariants Each harness invariant produces a concrete, checkable authoring rule. This table is the spine of the pattern; the prose after it only elaborates. | Harness invariant | Authoring rule it imposes | | --- | --- | | 1. Markdown is intent | The responsibility carries all semantic weight. Never push intent into a prompt or a tool config. If it matters, it is in `### Goal` / `### Requires` / `### Maintains`. | | 2. Materiality is compiled and shared | Declare *what counts as a material change* as natural language inside `### Maintains` — which fields matter, how they normalize, where the facets fall. The compile phase lowers that into a deterministic canonicalizer; you state the materiality, not the hash. | | 3. Adapters are the only reason homes differ | Author no host-specific logic in contracts. Declare needs in `### Tools` / `### Environment` by name only. The same contract must run local and cloud. | | 4. Activations are bounded | Never write a render that assumes it keeps running. No "while true," no in-session waiting for the next event. Continuity lives in the receipt ledger, not a session. | | 5. Cost scales with surprise | Write `### Maintains` so "did anything material change?" is **cheaply decidable** — give the truth a stable content identity and facet it so an unrelated change wakes nobody. Declare freshness (`valid_until`) in `### Continuity` so silent staleness still wakes the node. This is a rule authors often violate. | | 6. The commit gate is deterministic | State satisfaction as **postconditions inside `### Maintains`** — deterministic where you can express a validator, self-attested by the render where it is semantic. There is no separate judge and no `### Criteria`. | | 7. Receipts are content-addressed | Trust the harness's signed receipt ledger as the audit / composition / exit unit. Do not hand-roll a scratch log. | | 8. State is replayable and exitable | Keep all durable truth in the responsibility's `### Maintains` world-model, in plain structured records. A reader must be able to take the contract and its trail to another harness. | ### Rule 1 — `### Goal` is one standing-intent sentence A goal is a state that should remain true, not a task or a deliverable. Not "triage the inbox," not "produce a report," but an invariant: "the research inbox is deduplicated, prioritized, and converted into action." The test is no longer "could a judge score it" — there is no judge. The test is: **can you name the maintainable truth and declare its shape in `### Maintains`?** If the sentence describes an _activity_ rather than a _state_, rewrite it until it describes a state. A sentence whose truth has nothing observable to maintain against is the highest-value early signal: the first render fails, its receipt names the gap, and the contract author hears about it — front-loaded, then silent. ### Rule 2 — `### Continuity` declares the wake source; `### Maintains` carries the materiality These were once one rule; they are two jobs, and conflating them is a common authoring mistake. `### Continuity` answers **when, beyond an input change, this node should re-render**: - **Input-driven (default).** The node wakes when a subscribed `### Requires` facet moves. You write nothing extra. - **Self-driven.** The truth goes stale on its own. Declare a `valid_until` freshness window — "a stargazer count older than one business day is stale." When it lapses, the continuity clock mechanically moves the facet's fingerprint and wakes the node; you do not hand-write a cron. - **External-driven.** A `kind: gateway` turns an ingress event (webhook, queue, schedule) into a wake. The *memoization* half — what counts as a material change, and whether "nothing changed" is cheaply decidable — belongs in **`### Maintains`**, not here. Write `### Maintains` so an unchanged world produces an unchanged fingerprint: give the truth a stable content identity (a content hash, a max-timestamp, a revision) and facet it so an unrelated change wakes nobody. If the only way to know whether anything changed is to redo the full expensive render, you have written a contract whose cost scales with the clock, not surprise — say so deliberately (the node will run at freshness cadence), exactly as projection-only is a deliberate choice rather than a degenerate Reactor. ### Rule 3 — satisfaction is a postcondition in `### Maintains`, not a `### Criteria` judge There is no `### Criteria` and no judge. State what "satisfied" means as **postconditions inside `### Maintains`**: - **Deterministic where you can express it.** "The release-notes file's last commit is newer than the latest merged PR touching `src/`" compiles into a validator the harness runs at commit. If it fails, the render commits nothing. - **Self-attested where it is semantic.** Where the obligation cannot be reduced to a validator, the render must attest it satisfied its own `### Maintains` before it signs. `gateCommit` fails closed: no attestation, no commit. (Part II: the deterministic gate is built but currently unwired, so the live commit rides the render's self-attestation until the compiled validators are threaded on.) When the truth genuinely has *nothing observable to maintain against*, the render cannot satisfy its postcondition and writes a `failed` receipt naming the gap — routed to the contract author. Author postconditions *expecting* this on the first few activations; that front-loading is the promise, not a defect. There is no `up`/`drifting`/`down`/`blocked` status to encode and no "undecidable" enum — the `failed` receipt and its reason carry it. ### Rule 4 — `### Invariants` draws the actuation boundary `### Invariants` (the section that absorbs the old `### Constraints`) is where the author quarantines world-mutation — the authoring-time expression of the render/commit split: a render may act, but only the canonicalized published truth re-enters the memo, and `### Invariants` is where the author bounds what the render may touch — the actuation boundary the harness is to enforce at the render/commit split. (Part II: authored but not yet lowered into the render.) Two boundary shapes recur: - **Full Reactor.** The render may mutate the world (send the email, update the briefing, write the register). `### Invariants` bounds _how_ (rate, scope, prohibited actions, "leave the final send to a human"). - **Projection-only Reactor.** The author forbids all world-mutation except writing the published truth itself: an observe-only overseer, a dashboard that must stay true, an audit that watches but never touches. Say so explicitly: "the only writable surface is the published truth; never modify, signal, or write into the observed system." A projection-only contract is not a degenerate Reactor. It keeps every cost and audit property; it simply declines the reconcile-the-world payoff. Choose it deliberately, not by backing into it. ### Rule 5 — write `### Maintains` so the harness can memoize Authors most often write the anti-pattern: a render that re-derives everything every time. The fix is not a service decomposition — it is shaping `### Maintains` so the dumb reconciler can skip. The reconciler keys each render on the 3-tuple `(contract_fingerprint, input_fingerprints, freshness_epoch)`; your leverage is to make the input fingerprints move only on real change. (Shipped v1 realizes the freshness term as a forecast self-receipt over a 2-tuple key — identical decision semantics; see [02-ReactorHarness.md](./02-ReactorHarness.md) Part II.) 1. **Give the truth a stable content identity.** The canonicalizer fingerprints the published truth; make sure an unchanged world yields an unchanged fingerprint (drop volatile fields — a re-poll timestamp, a request id — from materiality). This is what lets the reconciler skip *before* any render runs (quiescence behavior 1). 2. **Facet the truth.** Split `### Maintains` into `####` parts so a consumer subscribing to one facet is not woken by a change in another (quiescence behavior 3). A diamond reconverges to a single wake. 3. **Declare freshness.** Put `valid_until` windows in `### Continuity` so silent staleness still wakes the node (quiescence behavior 2). Variable-depth work, where you genuinely need it, is ordinary control flow *inside the one render* — a `call` to a `function` for an expensive sub-step, gated by an `if` in `### Execution`. It is not a "judge tier" and not an autowired service graph. ### Rule 6 — composition is subscribing to an upstream facet, not a new primitive "Responsibility B depends on responsibility A" needs no new syntax. B names the upstream facet in `### Requires`; Forme matches it to A's `### Maintains` facet and draws the subscription edge. B's render wakes on A's receipt when that facet's fingerprint moves — identical to consuming a webhook. Two authoring obligations make it safe: - **Reference, don't embed.** B's `### Requires` names A's responsibility id / facet as a declared subscription, not a copied value. - **Pin revision and trust.** For cross-trust-domain composition, pin which revision of A you accept and an acceptable signer set; unpinned composition is a supply-chain attack the author closes, not the runtime. (Part II: v1 "signed" is meaning-layer chain-consistency over a null signer; the cryptographic byte-hash signer is deferred.) Freshness needs no special authoring: each facet carries its own `valid_until`, so a stale upstream facet's fingerprint lapses and wakes B through the ordinary path. There is no transitive-freshness function to shape and no per-cycle staleness comparison to hand-write. This is how a downstream responsibility consumes an upstream one — a subscription edge, not a special case. ### Patterns that are Reactor-native The std pattern library is use-case agnostic, but a subset recurs in Reactor-native contracts and should be the author's default vocabulary: | Pattern | Reactor-native role | | --- | --- | | `fan-out`, `map-reduce` | Sensing a wide world cheaply, in parallel, inside one render | | `guard` | A precondition gate before an expensive `call` or a world-mutating step | | `worker-critic`, `proposer-adversary` | A built-in check a render runs before it attests and commits | | `oversight` | The actor / observer / arbiter split — the canonical projection-only shape | These coordinate `call`s to `function`s *inside a render*; none is a separate node or an autowired graph. Depth — running a critic only on the uncertain branch — is ordinary `### Execution` control flow. ### A worked example: the competitor-activity monitor The running example across the harness and world-model specs: keep a current picture of a set of competitors, where downstream consumers care about *different parts* of that picture and should wake only when their part moves. **The responsibility** (the whole program): ```markdown --- name: competitor-activity-monitor kind: responsibility id: 067NC4KG01RG50R40M30E20918 --- ### Goal The activity of the tracked competitors — their funding, hiring, and product launches — is current. ### Requires - `competitors`: the watchlist (names + domains) this monitor tracks. - `pages` from `competitor-sources-gateway`: the latest fetched source content, staged with a cheap content identity so unchanged sources don't wake the extraction. ### Maintains A `competitor-activity` world-model with three independently-subscribable parts: #### funding Rounds, amounts, investors, and dates. Material: a new or changed round. Immaterial: re-ordering, prose phrasing, the timestamp of the last poll. #### hiring Open roles and headcount signals by function. Material: a role appears or closes, or headcount crosses a band. Immaterial: list order, exact view counts. #### product-launches Announced launches and ship dates. Material: a new launch or a moved date. Postcondition: every entry cites the source it was derived from; an entry with no observable source is not committed (the render attests this). ### Continuity - Input-driven: wake when `pages` (new staged source content) or the `competitors` watchlist changes. Unchanged sources leave the `pages` fingerprint still, so the expensive extraction memo-skips at zero render tokens. - Self-driven: each part carries a `valid_until` of +1 business day as a safety net, so a silently stale part is re-checked even if the gateway missed a change. ### Invariants - Read-only on the outside world: never contact a competitor or alter a source. - The only writable surface is the `competitor-activity` world-model. ### Tools - cli:fs-read # reads staged source content; the gateway owns web-fetch ``` **The gateway** that feeds it — cheap, deterministic ingress with a stable content identity, so the monitor's render only fires on real change: ```markdown --- name: competitor-sources-gateway kind: gateway id: 067NC4KG01RG50R40M30E2091A --- ### Goal The latest fetched source content for each tracked competitor is staged for extraction — fetched and staged only, never interpreted here (extraction is the monitor's render). ### Continuity external-driven: the competitor sources cannot push, so the gateway re-checks them on a *freshness-paced* cadence — a `valid_until` of +6h on the staged `pages`, not a blind heartbeat (invariant 5). ### Maintains #### pages The fetched source content per competitor, normalized to its stable main text. Material: the content hash of a competitor's normalized text changed. Immaterial: fetch timestamp, request ids, response headers, ads, and boilerplate. ### Schedule - Re-fetch each competitor's funding, careers, and product pages when the staged `pages` freshness window (+6h) lapses — the freshness-paced recheck for sources that cannot push, not a fixed-interval poll. ``` The gateway does the cheap, deterministic half (fetch + normalize + hash); the monitor does the expensive, semantic half (extract funding / hiring / launches), and only when the gateway's `pages` fingerprint actually moves. **A downstream consumer** subscribes to one facet, and wakes only on that facet: ```markdown --- name: weekly-competitor-brief kind: responsibility id: 067NC4KG01RG50R40M30E20919 --- ### Requires - `funding` from `competitor-activity-monitor` # subscribes to ONE facet ### Maintains A short brief summarizing the latest funding activity for the watchlist. ### Continuity - Self-driven: a `valid_until` of +7 days, so the brief refreshes weekly even if funding stays quiet. ``` What an ideal Reactor harness does with this: - A gateway poll that finds **no changed source content** leaves the `pages` fingerprint unmoved, so the monitor's extraction **memo-skips at zero render tokens** (the gateway pays only a cheap, non-LLM fetch + hash) and the brief never wakes — *cost scales with surprise.* When sources change but the funding *facet* does not, the monitor renders, re-derives an unchanged `funding` fingerprint, and still leaves the brief asleep. - A new **hiring** signal moves only the `hiring` fingerprint; the brief subscribes to `funding`, so it stays asleep — *facets make subscription selective.* - When `funding`'s `valid_until` safety net lapses, the continuity clock advances the monitor's freshness epoch and wakes it with a zero-token self-receipt; the monitor re-extracts from the latest staged `pages`, and only real news propagates to the brief. - A render that cannot cite a source for an entry fails its postcondition, commits nothing, and leaves a `failed` receipt — the prior truth stands. Two of these are ideal harness behavior the contract is authored to, not yet delivered: forecast-paced freshness arming (today `serve` polls a flat interval) and the gateway's `### Schedule` cadence (today dropped by the compiler) are Part II deferrals — the contract above is correct; the harness climbs to it. No `kind: system`, no `### Services`, no judge, no ledger service: the render maintains the world-model, the canonicalizer senses change, `gateCommit` gates the commit, and the signed receipt ledger is the trail. ### Anti-patterns Each is the natural non-Reactor instinct and why it breaks an invariant: - **Modeling the work as a graph of services instead of one responsibility.** Inverts the model; the wiring becomes the source of intent (breaks invariant 1). Start from the `### Maintains` truth, not a system. - **A render with a `loop until done` that waits for events in-session.** That is a long-running agent loop, not bounded activations (breaks invariant 4). - **A `### Maintains` with no material/immaterial split, so every re-poll looks changed.** The canonicalizer's fingerprint moves every cycle; the reconciler can never skip and cost scales with the clock (breaks invariant 5). This is the most common and most expensive mistake. - **A contract whose only "did anything change" test is the full render, written as if it memoizes.** Not an invariant-5 _correctness_ break (the continuity clock still makes it safe) but a false cost claim. The Reactor-native form names the absence of a cheap identity and accepts freshness-cadence cost deliberately — exactly as projection-only is a deliberate choice, not a degenerate Reactor. - **Hand-coding a cadence in `### Execution`** instead of declaring the wake in `### Continuity` (an input subscription or a `valid_until`). It hides the schedule from the harness and defeats forecast-paced quiescence (breaks invariant 5). - **Putting volatile fields in `### Maintains`** — a poll timestamp, a request id, a re-ordered list — so the fingerprint moves on noise (breaks invariant 5). - **Consuming another responsibility's value by copying it into the contract.** Not a verifiable, revision-pinned subscription; a supply-chain hole (breaks Rule 6 composition and invariant 7's content-addressed receipts). Name the facet in `### Requires` instead. - **"Swarm of subagents that continuously watches."** The cron-plus-prompt shape the Reactor replaces. The Reactor-native form is: a subscribed input or a lapsed `valid_until` wakes one bounded render; nothing watches in between. ### Precedence for authors When authoring rules tension, follow the harness precedence stack: ```text correctness > safety > cost > interrupt-minimization ``` If a correct, safe contract surfaces more `failed` receipts to the author early, accept them. If making a contract cheaper would make it unsafe (dropping a postcondition on a high-stakes goal so it commits without checking), pay the cost. Silence is a target, never a constraint the other rules bend around. --- ## II. What The OpenProse Skill Implements Today The current model in Part I — intelligent compile (per-node canonicalizer + Forme topology + postcondition validators, fired only on a contract-set change) over a dumb deterministic run (compare `(contract_fingerprint, input_fingerprints)` → skip / render / `gateCommit` / propagate) — is the model the shipped skill authors against. This section is the conformance ledger: what the skill routes today, measured honestly against that pattern. The reference harness backing the skill is the three packages that ship together — `@openprose/reactor` (the engine SDK, `0.3.1`), `@openprose/reactor-cli` (command `reactor`, `0.2.2`, thirteen commands), and `@openprose/reactor-devtools` (the replay viewer, `0.2.0`). The skill's `responsibility-runtime.md` and `concepts/{responsibility,reactor}.md` are already written to this model; the retired judge/verdict/status/pressure/fulfillment vocabulary is gone from the authoring surface, not merely deprecated, and the legacy `prose` CLI binary has been removed (the language is embodied by the SKILL in-session). ### The authoring surface that already exists The headline finding still holds: **the Reactor-native pattern requires no new syntax** — but the syntax it requires is the *current* one. The skill routes the kinds and sections Part I names, and only those. | Pattern element | Skill support today | | --- | --- | | `kind: responsibility` with `### Goal` / `### Requires` / `### Maintains` / `### Continuity` / `### Invariants` (+ `### Tools` / `### Shape` / `### Runtime`) | Present and canonical (`concepts/responsibility.md`, `contract-markdown.md`); `id:` is tooling-minted and stable across `name:`/filename renames | | `kind: function` with `### Parameters` / `### Returns` — a stateless called helper (the former `service`) | Present; run as a lone render with no Forme phase | | `kind: gateway` — sugar for an external-driven responsibility; Forme's entry-point set | Present; `reactor serve` registers it and stages ingress (fetch → extract → stage + a durable idempotency cursor) | | `kind: pattern` / `kind: test` | Present; patterns expand at compile time, tests route to the in-session `prose test` semantic (there is no `reactor test` subcommand) | | Facets: `####` parts under `### Maintains` — name = fingerprint unit + subscription symbol; atomic default | Present and **facet-granular propagation is live in production** (the v2 named-parts model); a downstream subscribed to one facet does not wake when another moves | | `### Maintains` as the world-model schema doing four jobs (type, canonicalization spec, facets, postconditions) | Present; the postconditions live **inside `### Maintains`**, compiled to validators (there is no separate `### Criteria` section — it was removed) | | `### Continuity` as the structural wake-source declaration (input / self / external) | Present; self-driven recheck and the gateway entry point are both wired (Phase 4) | | `### Execution` ProseScript for variable-depth work inside one render | Present — an `if`-gated `call` to a `function` is the depth mechanism, not a judge tier | | Compile as SKILL-loaded sessions (Forme / canonicalizer / postcondition) → deterministic lowering → content-addressed IR cache | Present; a `.prose` set mounts without hand-authoring via a true semantic `Requires ↔ Maintains` match | | Run: dumb reconciler — memo-skip on unmoved `(contract_fp, input_fp)`, single-flight + coalescing, failure = no-commit, propagate only on a `rendered` moved fingerprint | Present (`@openprose/reactor`); restart-survival proven (truth + ledger survive a fresh process) | | `gateCommit`: deterministic postcondition validators + render self-attestation of `### Maintains`; receipt status in `{rendered, skipped, failed}` | Partial; no judge, no verdict, no status enum — but the commit rides the render's **self-attestation** today: the deterministic `gateCommit(...)` validators are built and tested yet have **zero live callers** (02-ReactorHarness gap cluster 1) | | Content-addressed, chain-verifiable receipt ledger; cost = `tokens.fresh` vs `tokens.reused` + `surprise_cause` | Present (`reactor receipts` chain-verifies and tamper-detects; the devtools meter renders "cost scales with surprise") | | Composition: a downstream responsibility names an upstream facet in `### Requires`; Forme draws the subscription edge | Present; the reconciler reads the topology `edges` to resolve propagation | The skill can already express a Reactor-native program end to end *in the current model*: one responsibility with a faceted `### Maintains`, a gateway for ingress, a `function` helper for an expensive sub-step, an actuation boundary in `### Invariants`, postcondition-gated commit, and a composition edge that is a real subscription rather than a copied value. Two honest caveats the author must hold (see limits): the `### Invariants` actuation boundary is **authored but not yet harness-enforced** — it is never lowered into the render, so it constrains the model only as prose; and the postcondition gate currently rides the render's self-attestation, not the deterministic `gateCommit(...)` validators. ### Current authoring limits Part I states the pattern as an unqualified north star. This is where authoring reality is honest, rule by rule. | Authoring rule (Part I) | State | What the author must currently know | | --- | --- | --- | | 1. Intent lives in the responsibility | Conformant | Fully authorable today | | 2. Materiality stated semantically in `### Maintains` | Conformant (authoring) | The author states materiality in prose; it is lowered to a deterministic canonicalizer. The lowering runs **only spec→code** — a compile session reads the `### Maintains` prose and emits the canonicalization spec, which the deterministic producer compiles. There is no `.prose` *parser*; compile is sessions, not a grammar | | 3. No host-specific contract logic | Conformant (authoring); harness resolution deferred | `### Tools` (`cli:` / `mcp:`), `### Environment`, and `### Skills` are authored name-only and never install or contact at compile — but the Reactor harness does not yet **consume** them: compile reads only `### Requires`/`### Maintains`/`### Continuity`/`### Execution`, and the render runs a fixed built-in toolset, so declared capability names are inert today. Fail-closed resolution/enforcement of the declared surface is a forward item (02 Part III §10) | | 4. Bounded activations | Conformant | Idiomatic; the "loop until done" anti-pattern is author error, not a skill gap | | 5. Written for memoization / variable depth | Conformant | The reconciler's skip on `(contract_fp, input_fp)` is live (cost scales with surprise, including an immaterial-churn re-poll that still skips); facet selectors are live; depth is an `if`-gated `call` in `### Execution`. The author's leverage is real today | | 6. Composition via a subscribed upstream facet | Conformant (meaning-layer) | A downstream names the upstream facet in `### Requires` and Forme wires the edge; receipts are content-addressed and the chain is verifiable. The **cryptographic** signer is a null-state — v1 "signed" is meaning-layer chain-consistency, not a byte-hash — so cross-trust-domain *pinning to a signer set* is not yet enforceable | | 7. Receipts as the audit / composition / exit unit | Conformant | The ledger is flat `/receipts.json`, content-addressed, chain-verifiable; `cost` (fresh/reused/surprise_cause) and `status` are first-class. No hand-rolled scratch log is needed | | 8. Replayable and exitable | Conformant | Contract + world-model + ledger are plain and portable; `reactor-devtools ` replays a saved run with zero running reactor and zero key | ### Honest current limits for authors - **`### Continuity` self-driven recheck exists, but `serve`'s freshness clock arms nothing by default.** The bridge is real (a lapsed `valid_until` flips a fact's status, moves the facet fingerprint, and wakes the node — a **zero-token** fingerprint move, not a model re-render), and the SDK computes each node's soonest `next_self_recheck`. But the shipped `serve` daemon's freshness reader defaults to none and no node emits `valid_until` by default, so it sleeps a flat `--poll-interval` (default 60s) and does the fixed-interval work the ideal forbids. Forecast-paced / adaptive idle is the deferred next step. Declare `valid_until` now; the cadence tightens later without a source change. - **The `### Invariants` actuation boundary is authored, not enforced.** The authored rate/scope/prohibited-action quarantine is never lowered into the render — neither compiled, attested, nor harness-checked — so it constrains the model only as prose, bounded in practice by the cwd-rooted workspace sandbox and the turn cap. There is also no world-mutation actuation sink yet (render tools are fs/shell over a private workspace; connectors are read-only ingress). - **A gateway's `### Schedule` cadence is not yet honored.** Gateways poll external sources, but a per-gateway `### Schedule` (e.g. "every 6h") is dropped by the compiler today; cadence is the serve loop's flat poll interval. Declare the intended schedule now; it binds once the compiler carries it. - **The deterministic commit gate is unwired.** `compilePostconditions(...)` runs on the compile path, but the gate that evaluates it, `gateCommit(...)`, has zero live callers; the commit rides the render's `### Maintains` self-attestation (02-ReactorHarness gap cluster 1). - **Serve ingress is local cron-poll + HTTP only.** Gateway poll connectors and an HTTP trigger surface ship; **queues, file watches, and provider subscriptions** do not. A worktree/planning-dir watcher must use a poll `### Continuity` today and note the intended file-watch form. - **The cryptographic signer is a null-state, and the dependency edge pins no signer set.** Composition pins a content-addressed *revision* and is chain-verifiable at the meaning layer, but the topology edge carries no *acceptable-signer-set* pin, and the byte-hash signer that would enforce one is deferred. Functionally adequate within one trust domain; cryptographically weaker than the ideal across domains. - **Materiality is authored, not yet inferred.** The author writes the material/immaterial split in `### Maintains` prose and the compile session lowers it. The skill does **not** infer facets or materiality from the truth's shape; that inference loop is deferred. The store also does not materialize a per-facet `published//…` subtree on disk (it persists `published.json` + content-addressed blobs) — facet-granular propagation holds regardless; only the on-disk subtree mirror is absent. > The pattern is fully writable today, in the current model. Its remaining > climb is harness cadence and cryptographic hardening (forecast-paced rechecks, > richer ingress adapters, the byte-hash signer), not retired vision. Author to > the ideal; do not claim the runtime delivers the deferred items it does not. --- ## III. What Must Change In The Skill The retired-model framings are gone: the skill already routes the current kinds and sections, the examples are migrated, and `concepts/{responsibility,reactor}.md` teach the no-judge model. What remains is the climb from "fully authorable in the current model" to "every Part I payoff is also *delivered*" — a mix of finishing the authoring story for the newest sections and the genuine harness deferrals. ### 1. Finish the facet authoring story Facet propagation is live and the named-parts model is canonical, but two seams are open: - **Facet inference is deferred.** Today the author writes the `####` parts and the material/immaterial split by hand. The skill should eventually offer a lint that flags an under-faceted `### Maintains` (one giant atomic truth whose consumers clearly want selectors) — and, post-v1, an inference pass that proposes facets from the truth's shape. - **The on-disk subtree mirror is absent.** The store fingerprints each facet's material field-paths and persists `published.json` + content-addressed blobs; it does not materialize a `published//…` subtree. Author doctrine should not promise a subtree on disk — describe facets as the *subscription and fingerprint* unit, which is what actually ships. ### 2. Complete the no-judge postcondition doctrine in `contract-markdown.md` `### Maintains` now carries four jobs (type, canonicalization, facets, postconditions) and `### Continuity` is a structural wake-source declaration. These are documented in `concepts/responsibility.md`; `contract-markdown.md` should mirror the load they bear: - `### Continuity` is the author's input to memoization and cadence — name the freshness referents (`valid_until`) and the wake sources (input / self / external), and make "nothing changed" cheaply observable. - Postconditions are the author's commit gate. State them as observable referents; when the truth has *nothing observable to maintain against*, that is an expected, high-value `failed` receipt routed to the author — **never** a `blocked`/`drifting` status enum (those are retired). - The failed receipt that *names the gap and routes it to the author* depends on the harness widening the durable receipt with `as_of`, a `reason`, and an author-addressing field (02 gap cluster 2); until that lands, the doctrine is authorable but the routed reason is dropped at commit. Author to it now. ### 3. Land the materiality lowering's prose→spec half Compile runs as SKILL-loaded sessions and the **spec→code** canonicalizer lowering is real (a compile session emits the canonicalization spec; the deterministic producer compiles it). The remaining work is hardening the **prose→spec** step — reading the author's `### Maintains` materiality prose into the spec reliably — so that "state the materiality, not the hash" is trustworthy across more contract shapes. This is a compile-session quality effort, not a new grammar; there is no `.prose` parser to build. ### 4. Wire the deterministic commit gate The author states satisfaction as postconditions inside `### Maintains`, and the compile phase lowers them to deterministic validators (`compilePostconditions` runs on the compile path). But the gate that would evaluate them at commit, `gateCommit(...)`, has zero live callers — the commit rides the render's own `### Maintains` self-attestation. So the author's postconditions are *compiled* but not yet the *enforced* commit gate. Threading the compiled validators onto the live commit step (02 gap cluster 1) makes Rule 3's "no attestation, no commit" a deterministic guarantee rather than a render self-report. The author writes postconditions to it now; the enforcement tightens harness-side. ### 5. Lower and enforce the `### Invariants` actuation boundary Rule 4's actuation quarantine is authored prose today: `### Invariants` declares the rate/scope/prohibited-action bounds, but the section is never lowered into the render — it constrains the model only as prose, bounded in practice by the cwd-rooted workspace sandbox and the turn cap, with no world-mutation actuation sink. Lowering it into the render (02 gap cluster 3) makes a projection-only contract's "the only writable surface is the published truth" a harness-enforced guarantee rather than an author's request. Author the boundary now; it binds once the harness lowers it. ### 6. Forecast-paced continuity cadence The self-driven recheck path is wired (freshness-lapse → synthetic self-receipt, a zero-token fingerprint move), but `reactor serve` polls it on a flat `--poll-interval`. The deferred work is arming each node's soonest `next_self_recheck` off its freshness so an idle reactor sleeps to the next real expiry instead of waking every interval — the *forecast-paced quiescence* Part I implies. The same step is owed for a gateway's declared `### Schedule`, which the compiler drops today (so the gateway runs on the flat serve poll, not its authored cadence); honoring it as a freshness-paced cadence rides with this work. The author already writes the `valid_until` (and the `### Schedule`) that feeds it; the cadence tightens harness-side, without a source change. ### 7. Richer serve ingress adapters `reactor serve` supports local cron-poll and HTTP, plus gateway poll connectors with a durable idempotency cursor. Queues, file watches, provider subscriptions, and webhook authentication remain later runtime phases. Until they land, a file-watch-shaped responsibility is authored as a poll `### Continuity`; the intended ingress form should be noted in the contract so it migrates cleanly. ### 8. The cryptographic signer (cross-trust-domain composition) The receipt ledger is content-addressed and chain-verifiable, and the `signer` is an explicit null-state (`{ scheme: "none", null_reason: ... }`; the signature union ships only the null branch). v1 "signed" means meaning-layer chain-consistency. The deferred milestone is the cryptographic byte-hash signer, after which a downstream can pin an *acceptable signer set* in `### Requires` and have it enforced — closing the cross-trust-domain supply-chain edge that is, today, the author's discipline rather than the runtime's guarantee. ### Definition of done for the authoring layer - `contract-markdown.md` documents `### Continuity` as the cadence/memo input and `### Maintains` postconditions as the commit gate, with the retired-status-enum doctrine explicit. - A facet under-faceting lint exists; doctrine never promises an on-disk `published//…` subtree. - The prose→spec materiality lowering is hardened across the example corpus. - The compiled postconditions are wired onto the live commit (`gateCommit`), so the author's `### Maintains` postconditions are the enforced commit gate, not only the render's self-attestation. - The `### Invariants` actuation boundary is lowered and harness-enforced, so a projection-only contract's "only the published truth is writable" is a guarantee, and the failed receipt carries the routed `reason`. - `reactor serve` arms `next_self_recheck` (forecast-paced cadence) so an idle reactor sleeps to the next real expiry. - The cryptographic signer lands and a pinned signer set is enforceable for cross-trust-domain composition. ### Open authoring items Deferred by design, tracked so they are neither invented nor dropped: 1. **The fixpoint (topology-as-responsibility).** Mounting the compile-phase renders — Forme above all — as ordinary nodes so the reconciler wakes them on a contract-set-change receipt, and the system maintains itself, is the closing recursion. It is **post-v1** by design; v1 runs compile as a batch step on contract change with the topology a fixed input per scheduling epoch. This is the deliberate deferral, not an oversight. 2. **Facet / materiality inference.** The author states facets and materiality today; an inference loop that proposes them from the truth's shape is v-next. 3. **Ledger compaction.** A signed-snapshot-plus-truncate path for high-churn nodes is deferred; today the ledger is the full append-only trail. 4. **The default `valid_until` freshness projector for serve.** A first-class serve-time projector that surfaces soonest-expiry across nodes (the input to adaptive idle) rides with the forecast-paced cadence work above. > `02-ReactorHarness.md` says what the machine must do. > `03-ReactorPattern.md` says what to write so it does it. The pattern is > fully writable now in the current model; its full power lands as the harness > climbs from flat-poll continuity and a null-state signer to forecast-paced > rechecks and a cryptographic chain — and, last, to the fixpoint. Author to the > ideal, document the climb honestly.