framework:
  name: Ladder (self-governance)
  version: 0.1.0
  adapter: null
authorities:
  - id: AUTH-STEWARD
    name: Project steward
    kind: human
    may_ratify_invariants: true
  - id: AUTH-BUILDER
    name: Claude Code
    kind: ai
    may_ratify_invariants: false
layers:
  intent:
    - id: INT-01
      statement: |
        Make the mechanics of deliberate change — propose, review, ratify, deviate, roll back, with history and rationale — legible and usable by anyone who governs anything, in any domain.
      authority: AUTH-STEWARD
      rationale:
        text: |
          Version control solved trustworthy change for software and stopped there. The same primitives, behind a domain-neutral UI (the ladder), generalize to all normative work. This is the interpretive key for every element below.
        confidence: high
        sources:
          - docs/adr/0001-event-sourcing.md
  objectives:
    - id: OBJ-01
      statement: A domain specialist orients in an unfamiliar adapter in under 60 seconds.
      authority: AUTH-STEWARD
      rationale:
        text: 'Cross-domain recognizability is the founding UI thesis: position and color carry meaning, vocabulary is skin.'
        confidence: high
        sources:
          - SPEC.md#ladder-screen
    - id: OBJ-02
      statement: Any historical state is reconstructable on both time axes (world time and system time).
      authority: AUTH-STEWARD
      rationale:
        text: 'Audit defensibility IS bitemporal answerability: ''what did the framework require'' vs ''what did we believe it required''.'
        confidence: high
        sources:
          - docs/adr/0002-bitemporality.md
    - id: OBJ-03
      statement: A second domain adapter ships with zero changes to core code.
      authority: AUTH-STEWARD
      rationale:
        text: Extensibility-by-configuration is the falsifiable test of the meta-ontology claim.
        confidence: medium
        sources:
          - ROADMAP.md#m4
    - id: OBJ-04
      statement: A non-technical user completes propose → review → ratify without encountering any versioning or database vocabulary.
      authority: AUTH-STEWARD
      rationale:
        text: 'The ''git for normies'' criterion, stated positively: capability without jargon.'
        confidence: high
        sources:
          - SPEC.md#vocabulary
  invariants:
    - id: INV-01
      statement: History is append-only in all environments. No event is ever deleted or mutated; corrections are new events.
      scope: all environments
      authority: AUTH-STEWARD
      rationale:
        text: If engineers habitually treat history as mutable anywhere, the habit leaks. Redaction events (event.redacted) exist precisely so this never needs an exception.
        confidence: high
        sources:
          - docs/adr/0004-hash-chain.md
    - id: INV-02
      statement: Every element carries a rationale and a named authority. No orphan rules.
      scope: all elements, all layers
      authority: AUTH-STEWARD
      rationale:
        text: Authority answers 'says who'; rationale answers 'says why'. Separating and mandating both is the core audit primitive.
        confidence: high
        sources:
          - GLOSSARY.md#rationale
    - id: INV-03
      statement: Versioning and database vocabulary never appears in end-user UI. (Propose, not commit; review, not merge request; history, not log.)
      scope: all user-facing surfaces
      authority: AUTH-STEWARD
      rationale:
        text: No successful product for non-engineers has ever exposed git. The moment jargon leaks, OBJ-04 is dead.
        confidence: high
        sources:
          - docs/adr/0005-git-as-export.md
    - id: INV-05
      statement: Every event records agency class (human / ai-independent / human+ai-assisted) and decision-level provenance (framed / generated / selected / approved by).
      scope: all events
      authority: AUTH-STEWARD
      rationale:
        text: Artifact-level attribution failed in dogfood session 2 (the braid problem). Decision roles stay distinguishable under any mixed authorship. Regulators ask who decided, not who typed.
        confidence: high
        sources:
          - docs/adr/0006-overrides-as-events.md
          - GLOSSARY.md#provenance
    - id: INV-06
      statement: Ratification of Invariants requires a human authority. AI contributors may propose at any layer and hold bounded, flagged discretion.
      scope: all frameworks on the platform, v0
      authority: AUTH-STEWARD
      rationale:
        text: Founding-era caution, explicitly marked as such. Relaxation requires evidence, proposed through the framework itself — not vibes.
        confidence: medium
        sources:
          - GLOSSARY.md#agency-class
  constraints:
    - id: CON-01
      statement: Postgres is the substrate. Event sourcing, bitemporality, hash-chaining are patterns on top of it, not exotic infrastructure.
      authority: AUTH-STEWARD
      rationale:
        text: Boring, proven, operable by a tiny team. XTDB rejected in ADR-0003 on operational-maturity grounds, not capability.
        confidence: high
        sources:
          - docs/adr/0003-postgres.md
    - id: CON-02
      statement: Team capacity is one human steward plus AI contributors. No component may require a specialist to operate.
      authority: AUTH-STEWARD
      rationale:
        text: Honest resourcing bounds the feasible space; violating this constraint is how side projects die.
        confidence: high
        sources: []
  standards:
    - id: STD-01
      statement: Every event type has a JSON Schema and a migration note before any code consumes it.
      authority: AUTH-STEWARD
      rationale:
        text: The event catalog is the contract; schemaless events are unpayable debt in an append-only store.
        confidence: high
        sources:
          - schemas/events.yaml
    - id: STD-02
      statement: All UI meets WCAG 2.1 AA.
      authority: AUTH-STEWARD
      rationale:
        text: A universality product that excludes users refutes its own intent.
        confidence: high
        sources:
          - https://www.w3.org/TR/WCAG21/
    - id: STD-04
      statement: Full projection rebuild from genesis completes in under 10 minutes.
      authority: AUTH-STEWARD
      rationale:
        text: Rebuild speed is the practical ceiling on schema evolution; slow rebuilds ossify the event catalog.
        confidence: medium
        sources: []
    - id: STD-07
      statement: Every rationale states confidence and checkable sources. AI-authored rationale with unverifiable sources is a schema violation.
      authority: AUTH-STEWARD
      rationale:
        text: Dogfood session 2 caught a confabulated rationale via this rule. A rationale trail poisoned with plausible fictions is the one failure mode the system cannot survive.
        confidence: high
        sources: []
  preferences:
    - id: PRF-01
      statement: Boring technology over clever. Server-rendered over SPA where viable.
      authority: AUTH-STEWARD
      rationale:
        text: Tradeable, weighted want — yields when a Standard or Objective demands otherwise.
        confidence: medium
        sources: []
    - id: PRF-02
      statement: When two designs satisfy all higher layers, choose the one a non-engineer can explain back.
      authority: AUTH-STEWARD
      rationale:
        text: Tiebreaker aligned with INT-01.
        confidence: high
        sources: []
  discretion:
    - id: DSC-01
      statement: Naming, visual detail, and internal module boundaries are delegated to whoever holds the pen. Rationale logged; flag anything touching the event log.
      authority: AUTH-STEWARD
      rationale:
        text: Bounded judgment where rules run out, made visible via discretion.exercised / discretion.flagged events.
        confidence: high
        sources:
          - schemas/events.yaml
override_protocol:
  request_requires:
    - element_id
    - trigger
    - bounded_until
    - requested_scope
  closure_requires:
    - rationale
  note: |
    An override is a sanctioned deviation, not an amendment. It never edits the element; it records a legal path around it. Frameworks die from silent erosion, not violations — this protocol gives slippage a visible channel.
