2026-08-25 22:56:07 +00:00
2 changed files with 153 additions and 0 deletions
@@ -220,6 +220,12 @@ This document is governed. It does not change by commit message or unilateral de
 No drive-by edits. Every change traces to a recorded decision.
 **Review means a person who is not the proposer.** The enforced page carried a stricter bar —
 a design meeting with at least two node operators — which has never been met and cannot be, as
 there is one operator. A rule that cannot be satisfied is not a high standard; it is a rule
 everything silently violates. Recorded here as resolved in favour of what is achievable, and
 what has in fact been practised ([ADR 0040](../02-DECISIONS/0040-the-constitution-absorbs-what-is-enforced.md)).
 ---
 ## 7. Overrides
@@ -229,3 +235,46 @@ They may never relax them.
 An override says which rule it tightens, or which gap it fills, and follows the same amendment
 process. Absence of an override means these rules apply unmodified.
 ---
 ## 8. Code quality
 *Absorbed 2026-08-26 from the enforced page, which carried these rules while this document did
 not — [ADR 0040](../02-DECISIONS/0040-the-constitution-absorbs-what-is-enforced.md).*
 **These rules are recorded because they are enforced, not because this repository earned them.**
 Every other rule here states the incident or measurement behind it. These state nothing,
 because nothing is written down. That is a gap, not a style choice, and it is marked rather
 than dressed up: a rule whose reasoning nobody recorded is one nobody can argue with correctly,
 which is the condition §2 exists to avoid.
 ### Structure
 - **One reason to change** per module, class or function.
 - **Extend by composition**, not by editing what already works.
 - **Depend on abstractions**, and inject the concrete thing rather than reaching for it.
 - **Small, focused interfaces** over one large one.
 - A substitute for a type must not break the behaviour its users rely on.
 ### Layering
 Data access, business logic and the interface layer are separate.
 - No queries in route handlers, tool definitions or daemon loops — those belong in repositories.
 - No orchestration or validation in repositories — that belongs in services.
 - Shared logic belongs in the SDK. Duplicating it into a surface is how two answers to one
  question start to exist.
 ### Types
 - TypeScript throughout; no new untyped JavaScript.
 - Strict, with no implicit `any` and no unchecked index access.
 - Public functions state their return type. Prefer `unknown` with a guard over `any`. Errors
  are typed, never thrown as strings.
 ### Restraint
 - **Do not over-abstract.** Three similar lines beat a premature abstraction.
 - **Build what is needed now.** A hypothetical future is not a requirement.
 - Names reveal intent, functions fit on a screen, and boundaries fail fast.
@@ -0,0 +1,104 @@
 ---
 status: accepted
 date: 2026-08-26
 deciders: jochen
 reconstructed: false
 ---
 # 40. The constitution absorbs what is already enforced
 ## Context
 [ADR 0025](0025-hq-is-the-source-of-the-constitution.md) makes this repository the source
 and the knowledge base a derived copy, and playbook
 [05](../00-META/process/05-constitution-sync.md) publishes the copy whenever a rule changes.
 Three rules were accepted on 2026-08-25 and the sync came due. Reading the target before
 overwriting it — as [§2](../00-META/how-we-build.md) requires — found the two documents had
 diverged in a way nobody had recorded, and that a literal republish would have **deleted rules
 the mesh currently enforces**.
 | | source (`how-we-build.md`) | enforced page |
 |---|---|---|
 | §4 | naming and boundaries | **code quality** — structure, layering, types, restraint |
 | §5 | four evidence rules | one runtime-evidence rule |
 | §6 | review by a non-proposer | a design meeting with **two node operators** |
 The enforced page was last written 2026-07-10, is agent-authored, and its code-quality section
 appears in no decision record anywhere. It has been checked against for six weeks regardless.
 Two facts made this urgent rather than tidy:
 **Removal is not the safe option.** The orchestrator reads *"when absent, no constitution is
 injected (backward-compatible)"* — so deleting the page would not fail, it would silently
 inject nothing, and every design meeting would run unchecked with no error anywhere. Three
 unenforced rules would become all of them.
 **The stricter review bar has never been met.** The enforced page requires two node operators,
 neither the proposer. There is one operator. Every amendment ever made violated it.
 ## Considered options
 1. **Republish wholesale.** What the playbook literally says. Rejected — it deletes the
   code-quality rules, which exist nowhere else.
 2. **Merge surgically** — update §2, §3, §5 in the copy and leave §4 alone. Nothing is lost and
   it is quick, but the source becomes authoritative for some sections and the copy for others,
   which is the drift being fixed.
 3. **Absorb, then republish.** Chosen.
 ## Decision
 **What the mesh enforces and cannot cite is written down here first, then republished.**
 The code-quality rules become §8 rather than §4, because appending renumbers nothing and every
 existing citation stays valid.
 **They are recorded as inherited, and marked as such.** Every other rule in the document states
 the incident or measurement that earned it. These state nothing, because nothing was ever
 written down. Importing them silently would have made the document claim a provenance it does
 not have, and this repository's whole argument is that the reasoning is the expensive half.
 **The review bar is resolved in favour of what is achievable.** A rule requiring two operators
 where there is one is not a high standard, it is a rule everything silently violates — the same
 shape as a firewall key declared in five manifests and read by no code
 ([04-ISSUES/003](../04-ISSUES/003-firewall-scope-is-read-by-no-code/00-report.md)). Review means
 a person who is not the proposer, which is both achievable and what has been practised.
 ## Consequences
 - **The copy can now be a faithful projection**, which is what makes "the source is the source"
  true rather than aspirational.
 - **§8 has no reasoning behind it and says so.** Anyone may propose replacing an inherited rule
  with an earned one; until then the marking is the honest state. It is also a standing
  invitation to delete any of them that turn out to serve nothing.
 - **Six weeks of drift went unnoticed** because nothing compares the two. The sync is manual and
  runs only when someone remembers a rule changed. **Nothing detects divergence**, and this
  record does not fix that — it is worth an issue.
 - **The operator's instinct to remove the copy was right about the direction and wrong about the
  method.** The end state where the mesh reads this repository directly — rendered and operable
  through the board — removes the second copy rather than blanking it. That is not designed and
  is not decided here.
 - **Section numbering is now append-only in practice.** §8 sits after the overrides section
  purely because renumbering would break citations, which is a cost of the copy existing at all.
 ## Sync
 Run 2026-08-26, and the read-back earned its place in the playbook.
 **The first publish reported success and changed nothing.** It created a new revision and
 updated the title, and the body did not apply — a malformed argument was dropped silently. Had
 the sync been marked done on the strength of the tool saying *"updated; new revision created"*,
 three accepted rules would have gone unenforced while every record said otherwise, and nothing
 would ever have contradicted it.
 That is §5 demonstrating itself during its own publication: a green result proves transport,
 not effect. The republish was verified by reading the rule back out of the live page, not by
 trusting the second success message either.
 ## References
 - [ADR 0025](0025-hq-is-the-source-of-the-constitution.md) — source and copy.
 - [ADR 0009](0009-the-mesh-is-governed-by-a-constitution.md) — why the copy is injected at all.
 - [Playbook 05](../00-META/process/05-constitution-sync.md) — the sync this record interrupts.
 - [ADR 0034](0034-a-test-defends-a-decision.md), [ADR 0035](0035-a-picture-is-read-from-what-runs.md),
  [ADR 0018](0018-the-mesh-creates-no-symlinks.md) — the three rules whose sync surfaced this.