StaveWørk®

StaveWørk

Rull ned

Rules rule.

An instruction is not a guarantee. We build the instruction set your teams share, and the mechanisms that enforce it in your workspace. Guards fail the build, and agents argue with the code before production does.

The nine-stage loopNine workflow stages arranged as a clockwise ring — foundation, define, research, specify, decide, plan, build, reconcile, improve — each labelled with the artefact it leaves behind. Dashed spokes run inward from every stage to one shared workset at the centre, where every artefact is kept in a single copy. Reconcile is marked as the stage that catches drift.01Foundationrule files, a graph, guards02Definea brief, and a declared mode03Researcha note, one source per answer04Specifya spec, requirements numbered05Decidea numbered decision record06Plansteps, each with its test07Buildcode, and the tests for it08Reconcilespecs signed against a parent09Improvenew skills, tighter guardsThe common worksetevery artefact, one shared copyno private revisionLEGENDWORK ADVANCESTHE STAGE WRITES ITS ARTEFACT BACKWHERE DRIFT IS CAUGHTSHARED STATE
Fig. 1 · Work advances clockwise. Every stage leaves its artefact in one shared workset.

Two sides

We hold the instructions. You hold the workspace.

An agent is not deterministic. It reads one instruction twice and acts twice. So we do not trust that the instruction is heard. We build the mechanisms that govern people instead: iterations, bounds, rules, and deterministic tools — calculators, for robots.

One pass, and what governs itA swimlane with three lanes — the person, the agent, and the workspace — and six steps in time order. The person states the task. The agent reads the rule file that applies, governed by a rule and a permission. The workspace answers with a convention and a route, governed by its structure and its knowledge graph. The agent writes the change, governed by a skill, a hook and a deterministic tool. The workspace runs the guard, governed by a guard that runs on the write and again in the pipeline. The person reads the result. The person reads the same instruction set as the agent, but no guard runs against a person mid-pass, so the person's steps carry no mechanism. A dashed return path runs from the guard back to the step where the agent reads the instruction set, so use changes the instructions.01 TASK02 ORIENT03 ANSWER04 WRITE05 GUARD06 RESULTPERSONNO GUARD RUNS HEREAGENTINSTRUCTION SETWORKSPACEYOUR REPOSITORYTHE TASKREADSANSWERSWRITESTHE RESULTTEACHESStates the taskwhat, not howReads the rule filethe closest one winsRULE · PERMISSIONAnswers backa convention, and a routeSTRUCTURE · GRAPHWrites the diffthe test comes firstSKILL · HOOK · TOOLGuard decidespass, or failGUARD · CIReads the resultand states the nextLEGENDUSE CHANGES THE INSTRUCTION SETTHE MONO LINE NAMES WHAT GOVERNS THE STEP
Fig. 2 · One task, not the whole loop. Every step a machine takes has a mechanism on it.

Agent side

Mechanisms, not advice

Instruction file
the judgment an agent cannot infer
Rule
the same, narrowed to one part of the tree
Skill
a work process we repeat
Permission
what an agent must not touch
Hook
if this, then that
Deterministic tool
A answers with B, every time

A workflow is the order the six run in. A bound sits at each step.

Workspace side

The structure is a bound

Structure
a folder states what belongs in it
A rule file per area
the one closest to the code wins
Knowledge graph
a route to one fact, not a whole file
Spec and record
the behaviour, and the choice behind it
Guard
it fails the build

The rule that is prose on our side is a check on yours.

A person states the task. The agent reads the workspace, and the workspace answers — with a convention, a route, or a failed build. The agent writes, and reads the answer again. Each pass narrows the next one, and what the passes teach us returns to the instruction set. So the workspace is not a copy of the instruction set. It is the second half of it.

What the conversation looks likeThree conversations compared, each between a person, an agent and a workspace, with time running down. With neither side instructed, the person asks, the agent writes whatever it inferred, and the workspace never replies; only the person checks it, and only after the fact. With the agent side instructed, the agent reads its instruction first but the workspace is still silent, so compliance varies by run. With both sides instructed, the workspace refuses the first write and names the rule, the agent corrects and passes, and the person is asked only about judgement — a three-way exchange rather than a request and a report.01 · NEITHER SIDEOnly the person checks itDO THE THINGWRITES A GUESSREPORTS DONEREADS IT LATERSILENTPersonthe inputAgentthe stepWorkspacethe stateWHAT LANDSWhatever the agent inferredNOBODY CHECKED IT INSIDE THE TURN02 · AGENT SIDE ONLYBetter aimed, still unenforcedDO THE THINGREADS THE SETWRITES TO THE RULEREPORTS DONEREADS IT LATERSILENTPersonthe inputAgentthe stepWorkspacethe stateWHAT LANDSWhat the agent rememberedAN INSTRUCTION IS A PREFERENCE03 · BOTH SIDESA three-way dialogueDO THE THINGTRIES A WRITEREFUSES THE WRITEWRITES AGAINTHE GUARD PASSESASKS THE JUDGEMENTPersonthe inputAgentthe stepWorkspacethe stateWHAT LANDSWork that passed every boundAND THE VERDICT TEACHES THE SETLEGENDA CALLA REPLYTHE WORKSPACE ANSWERS BACKONE SIDE IS NOT A DIALOGUE
Fig. 3 · One side instructed leaves the person as the only check. Two sides makes it a dialogue.

The benefit

The result stops depending on who ran it.

The nine stages are how

The workflow

Nine stages. Every one leaves a record.

A stage produces one artefact, and one mechanism holds that artefact true. Read them in order. Each stage narrows the one above it.


  1. 01

    Foundation

    The team works from one instruction set.

    Every person and every agent reads the same instructions. A rule file carries the conventions for one area, and the file closest to the code has priority. The set is one, and it does not arrive whole. A rule file names the paths it applies to, so it enters a session when the work touches those paths. A rule file that never enters has no effect, so we measure what a session loads. Each one carries a second file name, so all tools read one file and not two. A guard checks the set after each change. It fails the build when a rule file is missing, and when no parent points to it. Members keep no private copy of the instructions.

    The rule files say which conventions apply. A knowledge graph says what enforces them. It records how the parts of the workspace connect, so an agent follows a route to one fact instead of reading a file to find it. The same guard rebuilds the graph after each change, so the graph cannot describe a tree that has moved.

    The tasks are unique. The foundation is common.

    Output
    A rule file for each area, a graph of how they connect, and the guard set
    Bound by
    A structure guard, run on every write
    Where the instructions liveSeven stacked enforcement layers, from instruction files that only advise an agent down through path-scoped rules, skills, permissions, hooks and continuous integration, to a deterministic tool at the floor, where the rule is not checked but built in, because the tool cannot produce the wrong result. Each layer also states its trigger, and the advisory layers wait for the agent to read a file that matches, so only a hook reaches a file that does not exist yet. A closing strip states how the classification procedure asks its question: it starts at the floor and asks whether a tool call can observe the violation, it rises one layer at a time through a denied path, a rule and a skill, it leaves judgement as prose, and it ends at a deterministic tool, which checks nothing because it builds the rule in.ADVISORYENFORCEDL1Instruction filesjudgement an agent cannot inferCLAUDE.md · AGENTS.mdEVERY TURN · ADVISORYL2Path-scoped rulesa convention for one part of the tree.claude/rules/*.mdON A READ-TOOL MATCH · ADVISORYL3Skillsa procedure, a rubric, a checklistSKILL.md · descriptionON INVOKE · ADVISORYL4Permissionsa path or command that must not runsettings.json · denyBEFORE THE CALL · PLATFORML5Hooksa condition a machine can decidePreToolUse · PostToolUseON THE TOOL EVENT · CODEL6Continuous integrationthe same check, for every author.github/workflowsAT MERGE · CODEL7Deterministic toolsno judgement left to get wrongthe script the agent callsON EVERY CALL · CODEHOW THE PROCEDURE ASKSThe question starts at the floor.is the violation observable in a tool call?a hook takes it, and the asking stopsIt rises one layer at a time.a denied path, then a rule, then a skilleach layer costs more context than the lastProse takes what is left.reuse before you create. test where risk sitsa hook on judgement teaches a workaroundThe floor checks nothing.a deterministic tool builds the rule inthe same input returns the same outputLEGENDWHERE A REQUEST BECOMES A GUARANTEEONLY A HOOK REACHES A FILE THAT DOES NOT EXIST YET
    Fig. 4 · A rule goes in the lowest layer that can decide it. A layer that does not fire has no effect. Point at a layer.
    When each layer firesThree lanes group the triggers. The first lane reads the person's prompt. The second lane reads a file path. The third lane reads a tool call. Time goes from left to right through one session, over six moments: the session starts, a new prompt arrives, the agent reads a file with the Read tool, the agent reads a file through a shell, the agent makes a new file, and the agent calls a tool. Each lane holds the mechanism that fires at its moments. A path glob reads a Read-tool match only, so a shell read of the same file fires no rule. The accent marks the new file, because no path glob reads a file that does not exist. Only a hook fires there. A closing strip shows what only a hook does: it fires before the agent reads a file, it puts text into the context, and it fires again after a compaction.TIMESESSION STARTA NEW PROMPTA FILE IS READA SHELL READA NEW FILEA TOOL CALLPERSON INPUTit reads the promptA PATH GLOBit reads the pathA TOOL EVENTit reads the callThe resident setthe platform loads itit loads before the promptPrompt hookit reads the promptit advises the modePath-scoped rulethe Read tool matchesone part of the treeNo rule firescat and sed, not Readthe glob never runsWrite hookPreToolUse Write|Editonly a hook fires hereTool guardPreToolUse blocks itPostToolUse advisesWHAT ONLY A HOOK DOESA hook fires before the agent reads a file.at session start, at the prompt, at the first writea rule and a skill wait for a fileA hook puts text into the context.hookSpecificOutput.additionalContextthe instruction set uses the same channelA hook fires again after a compaction.the platform re-attaches 5,000 tokens per skilla rule loads again only on a new fileLEGENDONLY A HOOK FIRES AT THIS MOMENT
    Fig. 5 · Three events cause a load. Only a hook fires before the agent reads a file.
    What governs one fileA ranked graph over one file. At the top is a component file. Below it is the rule file that governs it, because that rule file declares the paths it serves and the file matches one. Below that are the three conventions the rule file states: no raw hex, no inline fluid scale, and spend the accent once. Two of them point down to one guard, tokens.test.ts, which declares the conventions it enforces and fails the build. The third points to nothing, and an accented open circle marks it: no guard enforces it, so it is a preference. A solid edge is derived from the tree. A dashed edge is declared in the asset. A closing strip states the three questions this shape answers and a search does not: what governs this file, what enforces this convention, and what is unenforced.0 inSidesSection.astrosrc/features/sides/1 indesign-system.mda rule file · paths:1 inNo raw hexa convention1 inNo inline fluid scalea convention1 inSpend the accent oncea convention2 intokens.test.tsa guard · fails the buildGOVERNED BY · DERIVEDSTATESENFORCES · DECLAREDNO GUARDWHAT ONLY THIS SHAPE ANSWERSWhat governs this file?the rule file declares its pathsa glob match derives the edgeWhat enforces this convention?the guard declares the conventiona build fails when the name does not resolveWhat is unenforced?the edge that is not thereno search returns an absent edgeLEGENDDERIVED FROM THE TREEDECLARED IN THE ASSETA CONVENTION NO GUARD ENFORCES
    Fig. 6 · A convention that reaches no guard is a preference. Only this shape returns an absent edge.

  2. 02

    Define

    We ask until the request is unambiguous, then choose how the work will run.

    A request arrives as one sentence, and the sentence carries less than the person means. An agent fills the difference with an invention, so we close the difference with questions first. The answers become a brief, and the brief sets the mode the task runs in.

    The mode then selects the assets. An asset is a skill, a rule, or a hook the workspace already holds, and the knowledge graph is the route to it. The agent follows that route instead of reading the workspace to find one. An asset can also name the paths it serves. It then arrives on its own when the work reaches those paths. An asset the workspace lacks is a gap, and the gap goes to Improve.

    The brief closes every question about the task. It does not close a question about practice, because nobody in the room settles which library or which version is current. The brief lists those questions instead, and it answers none of them.

    A hook reads the first prompt, and it stops a task that declares no mode. So the choice of mode is a mechanism, and not a habit.

    The brief states what the person wants. It does not state how the software behaves. That is the spec, and the spec comes after Research.

    Output
    A brief, the mode the task runs in, and the questions it cannot answer
    Bound by
    A prompt hook advises the mode, and a write guard holds what the mode forbids
    How a request picks its modeA request from one person meets a prompt hook, which names the assets that match it, and then a round of questions. The questions settle one of three modes: a discussion when the design is open, a plan when the shape is known, or a direct change. Each mode states what it forbids and which assets it loads, and all three produce one brief. The brief carries the questions the task cannot answer on its own, and that list is what the next stage, research, receives.The requestone sentence from a personit carries less than the person meansPrompt hookreads the requestnames the assets that match itON THE FIRST PROMPT · CODEThe questionsone at a time · options namedTHE DESIGN IS OPENTHE SHAPE IS KNOWNONE CHANGE, ONE TESTDiscussionBOUNDNo agent writes a fileASSETSA brainstorming skill, and a question protocolEXIT · AN AGREED SHAPEPlanBOUNDNo write before the person approves the planASSETSA plan template, and the tier tableEXIT · AN APPROVED PLANDirectBOUNDThe guards still run on every writeASSETSThe rule for the area the file sits inEXIT · A CHANGE, AND ITS TESTThe briefwhat the person wants · what they rejectedwhat stays outside the task · the mode it runs inthe questions it cannot answer on its ownNO BEHAVIOUR HERE · A SPEC STATES THAT03 Researchone answer, one ranked sourceeach answer returns to the briefTHE NEXT STAGELEGENDWHERE THE CHOICE BECOMES A MECHANISMAN OPEN QUESTION LEAVES WITH THE BRIEF · RESEARCH CLOSES IT
    Fig. 7 · A hook advises the mode, and a guard holds what it forbids. A task with no mode does not start.

  3. 03

    Research

    We confirm a practice before it becomes a convention.

    Research starts from the brief. The brief lists the questions the task cannot settle on its own, and Research answers that list and nothing else. A question the brief does not carry is research nobody asked for, and it costs the same as the research we need.

    An agent repeats the content of its training data. Some of that content is old, and some of it is wrong. So every answer names a source, and the higher source wins when two sources disagree. The note also records the claims we tested and rejected, so a later session does not repeat the test.

    Each answer changes one document, and a guard holds it there. The spec guard fails a requirement that rests on an outside practice and cites no source. The structure guard fails a convention that carries none. The note stays the parent of both, so a convention cannot outlive the source that set it.

    Research also runs without a task. We adopt a language or a tool, and its conventions enter the instruction set before a feature needs them. We write each convention next to the behaviour it replaces. A default the agent already follows gets no convention, because a rule that changes nothing still costs context. A convention that names its paths costs context only in the part of the tree it names. The test stays what the convention changes.

    A convention without a source does not enter the instruction set.

    Output
    A research note: one answer, one source, and one destination for each question
    Bound by
    The spec guard: a requirement that rests on an outside practice cites its source, or it fails
    How a question gets an answerAn open question from the brief meets four ranked sources in order: official documentation, library maintainers, named practitioners, and the wider community. The question falls one rank each time a source does not settle it, and it leaves on the first source that does. The answer then changes one document — a spec requirement for this task, or a convention for every task — and the research note is the parent of both. The spec requirement takes the want from the brief and the practice from the note, so research is where the two combine. A question that no source settles becomes a decision record at stage 05, because nobody guesses. The model's own memory sits outside the ladder, because it sets no convention.An open questionone line the brief carries, and does not answer01Official documentationthe vendor states it · settles api, limit, defaultNOT SETTLED02Library maintainersthe authors state it · settles idiom, versionNOT SETTLED03Named practitionersan engineer shows it · settles pattern, trade-offNOT SETTLED04The wider communitya post reports it · settles nothing on its ownNOT SETTLEDNo source settles itit becomes a decision recordNOBODY GUESSES · 05 DECIDE TAKES ITModel memorythe agent already holds it · it settles nothingSETTLEDThe answerone source, named and ranked, in the noteA spec requirementthe brief, plus the noteTHIS TASKA conventionit carries its sourceEVERY TASKThe research note is their parenta source moves, and we re-issue the noteRECONCILE THEN FLAGS EVERY CHILDLEGENDTHE QUESTION TRAVELSTHE NOTE IS THEIR PARENTNOT A SOURCE · IT SETS NO CONVENTION
    Fig. 8 · A question takes the highest source that settles it. Model memory settles nothing.

  4. 04

    Specify

    We define the behaviour before anyone writes the code.

    Each feature has a spec. The spec states the behaviour and the contract. The team reads the spec more often than any other document, so the spec carries the most discipline.

    The spec also states what it does not cover. An agent fills a silence with an invention, so we close the silence in writing.

    The keywords stay inside the spec. The instruction set states judgement instead, because an agent follows an emphatic rule too literally. A spec describes the software. An instruction set describes the work.

    One guard holds the shape. An agent then drafts the spec, a second agent reads it against the parent, and the author re-issues it. A spec with an open question stays in review. A spec with a closed contract goes to Decide.

    If you cannot name the parent document, the scope is invented.

    Output
    An epic spec, then a feature spec, each narrowing a named parent
    Bound by
    A spec guard: a named parent and its hash, numbered requirements, and a source for each outside practice
    What a spec must containAn entity model of a feature spec. The spec narrows a parent spec and records its hash, states numbered requirements that each carry one normative keyword and a named test, passes a review that re-issues the spec until no question stays open, and opens a decision record.NARROWS1NSTATES1NIN REVIEW1NRE-ISSUEOPENS10..NPARENTParent spec# idslugcontent_hashshascopeproseSPECFeature spec→ parentslugparent_hashshagoalone sentencerequirements[]numberednon_goals[]explicitverificationcommandsources[]urlREQRequirement# numberintkeywordenumstatementtestabletestnamedJUDGEMENTReviewchecked_againstparentopen_questionscountverdictopen | closedOUTCOMEDecision record# numberintalternatives[]rejectedcostprosewrong_signalproseLEGENDTHE DOCUMENT EVERY PLAN CITESMUST OBLIGATION · MUST NOT PROHIBITION · SHOULD PREFERENCE, DEPARTURE RECORDED · MAY PERMISSION
    Fig. 9 · One number, one keyword, one test for each requirement.

  5. 05

    Decide

    We record a choice when it is expensive to undo, or when much rests on it.

    Two measures set the threshold. The first is the cost to undo the choice. The second is how much later work rests on it. A choice goes unrecorded only when both are low, because the next commit undoes it and nothing notices.

    A decision record states the price of the choice, and not only the choice. It names what the decision makes easier, and what it makes harder, so a later reader can price it. It names the alternatives we rejected, so nobody argues them a second time. Last it names the signal that would show the decision is wrong. We then reopen the choice on purpose, and not by accident.

    A record for every choice teaches a team to skip records. So the threshold is fixed, and a rule states which choices meet it.

    Output
    A numbered decision record
    Bound by
    A language lint on every record, and a rule that states which choices need one
    Which choices need a recordA plot of the choices made during the work. The horizontal measure is the cost to undo a choice, from one commit to months of work. The vertical measure is how much rests on it, from nothing to every later task. A choice is recorded when either measure is high. Only the bottom-left cell is exempt, and the shading marks that one cell. A choice there is cheap to undo, and nothing rests on it. A data object's shape, a technology swap and a boundary between areas sit in the recorded region; a helper's name and a local refactor do not. Beside the plot, the decision record lists its own fields and the three uses a later reader has for them.RECORD ITNO RECORDthe next commit undoes itPERMANENTFOUNDATIONALa data object's shapea migration is the only way backa technology swapa store, a framework, a vendora boundary between areaswho owns what, and who calls whata naming rule everything readsthe work under it is not cheapa vendor commitmentthe term runs a yeara migration already runthe old shape is gonea helper's nameone rename, and nothing noticesa local refactorthe commit undoes itTHE GUARD FAILS THE BUILD WHEN A CHANGE OUTSIDE THE SHADED CELLLANDS WITH NO RECORD. THE CLASSES ARE FIXED, SO NOBODY ARGUES THEM.RECORDDecision record# numberintcontextwhat forced the choicedecisionthe option we tookalternatives[]rejected, and whymakes_easierwhat is now cheapmakes_harderwhat is now expensivewrong_signalwhen to reopen itWHAT IT IS FORa later reader prices the choicenobody argues the alternatives twicethe signal fires, and we reopen itLEGENDNO RECORD NEEDEDA CHOICE GOES UNRECORDED ONLY WHEN BOTH MEASURES ARE LOW
    Fig. 10 · Two measures decide it. A choice goes unrecorded only when both are low.

  6. 06

    Plan

    We turn an approved spec into steps in order.

    The plan lists the steps in order. Each step names the files it changes, the test that proves it, and the requirement it satisfies. A step with no test is either trivial or too vague, and you decide which before you start.

    Each step also declares its model tier and its effort. The precision of the plan sets the cost of the work. A step that leaves nothing open runs on a small model, and judgement stays on the largest one.

    The shape of the dispatch is a choice with a price, so the plan states which shape it uses. The cost is then a decision, and not an accident.

    An executor does not replan. A step that meets an unknown returns to the plan, and the plan changes at the tier that wrote it.

    Output
    A plan, with one test for each step
    Bound by
    A dispatch guard that stops a step with no model, and a drift report at every stop
    Two ways to dispatch one planTwo agent dispatch topologies side by side. On the left, one orchestrator drives two top-tier leads, and each lead drives two low-tier executors. On the right, one orchestrator drives three mixed-tier executors, and every result passes through a single top-tier review. The left pattern spends more tokens and less wall-clock time; the right pattern spends less and takes longer.Deep fan-outONE LEAD PER BRANCHFlat, mixed tierONE REVIEW ON THE TOP TIERTOPOrchestratorplans · dispatchesTOPLeadowns one branchTOPLeadowns one branchLOWExecutorone stepLOWExecutorone stepLOWExecutorone stepLOWExecutorone stepTOPOrchestratorplans · dispatchesLOWExecutorstep fully specifiedLOWExecutorstep fully specifiedMIDExecutora step needing judgementTOPReviewreads the diff only3 TOP-TIER AGENTS · NO SHARED REVIEWTOKENS HIGH · WALL-CLOCK LOW1 TOP-TIER REVIEW · 1 MID STEPTOKENS LOW · WALL-CLOCK HIGHERLEGENDTHE ONE JUDGEMENT STEP · ONE REVIEW READS EVERY RESULTA STEP THAT MEETS AN UNKNOWN RETURNS TO THE PLAN
    Fig. 11 · Two shapes for one plan, and two prices.

  7. 07

    Build

    The test comes first. A guard checks what a machine can decide.

    We write the failing test before the code. The guards then run twice. The first run happens after each write, so the error appears next to the keystroke that caused it. The second run happens in the pipeline, so the same rule applies to every person and every tool. We write a guard only for a condition a machine can decide. Judgement stays in prose. A guard that reports a false error teaches the team to ignore guards.

    Output
    Working code, and the tests that hold it
    Bound by
    Invariant guards, command hooks, and path denials
    One step of the plan, builtA swimlane with four lanes and six steps in time order. The top lane holds three artefacts that earlier stages wrote: the plan step, the spec requirement with its decision record, and the guard set. Each one feeds down into the step it governs. The executor lane writes a failing test, then the code, and later reports the step green. The guard lane runs on every write and returns the error to the code step, which is a short loop inside the step. The same guards run again in the pipeline. The review lane reads the diff once, after the step is green, and a dashed return path carries its findings to the next step. The failing test is the one accented element, because it exists before the code does.01 TEST02 CODE03 GUARD04 GREEN05 PROVE06 REVIEWARTEFACTSWRITTEN BEFORE BUILDEXECUTORONE STEP · ONE TIERGUARDSRUN ON THE TOOL EVENTREVIEWTOP TIER · ONE PASSWRITESPASSESTHE DIFFCLEANTHE ERRORFINDINGS · THE NEXT STEPPlan stepone test per stepSpec req.and its recordGuard setfrom stage 01Failing testno code exists yetTHE PLAN NAMES ITThe codethe smallest changeSPEC REQ · RECORDOn the writeerror, at the writeA MACHINE DECIDESNO JUDGEMENT HEREStep greenthe test passesGUARDS ARE SILENTThe pipelineevery machineTHE SAME GUARDSAND EVERY PERSONThe reviewit reads the diffAT THE GOAL ONLYGUARD CLASSES · TYPES · TESTS · SECRETS · PATH DENIALSA GUARD IS WRITTEN ONLY FOR WHAT A MACHINE CAN DECIDELEGENDTHE TEST COMES FIRST · IT FAILS BEFORE THE CODE EXISTSTHE OUTER LOOP · A REVIEW FEEDS THE NEXT STEP
    Fig. 12 · The test comes first. A guard runs on the tool event, and one review reads the diff.

  8. 08

    Reconcile

    A change to a parent document marks every child as stale.

    Each document records the content hash of its parent. A parent is any document the work rests on: a parent spec, a decision record, or a research note. A guard recomputes that hash after every change. A change to the parent marks each child document as stale, and a stale document fails the build. The guard then shows the exact difference since the last check. The author reads the difference and signs the document again. So a document does not stay in the workspace and read as current after the design moved under it.

    Output
    Re-attested specs, each signed against its parent
    Bound by
    A content hash of the parent, checked on every write
    The spec cascadeA four-level document tree — a research note, two epic specs, two feature specs and a plan — where editing the note marks every descendant stale because each one stores the content hash of its parent.RECORDS PARENTEDITEDResearch notebytes changed → new hashEPICE2 · Session coreparent_hash 3f1a9c2EPICE4 · Conferenceparent_hash 3f1a9c2FEATUREE2-F1 · Registryparent_hash 91c7e04FEATUREE4-F4 · Raise handparent_hash 4bfd1bePLANRaise-hand planparent_hash 8ad2f61LEGENDTHE DOCUMENT THAT CHANGEDSTALE UNTIL RE-ATTESTEDCI + EVERY WRITE
    Fig. 13 · One edit at the top, five documents flagged.

  9. 09

    Improve

    What the work shows returns to the instruction set.

    The workflow reports on itself. A report at the end of a session names each file the work changed that the plan does not carry. A second report names the configuration that moved away from its committed state. A mechanism has a trigger, and the trigger can fail while the document stays correct. So we test the mechanism, and we do not test the document alone. A correction that repeats becomes a skill, so the next session starts with the answer. An answer that two tasks needed becomes an asset, so a third task does not research it again. A new model generation starts a review of every instruction we hold. Guidance written for an older model can cost quality on a newer one. The instruction set improves from use. The team does not maintain it by memory.

    Output
    New skills, tighter guards, a retuned instruction set
    Bound by
    A model-update pass on each new generation, and a drift report when the configuration moves
    The self-updating frameworkA five-step pipeline across four lanes — a schedule, the low model tier, the top model tier, and the repository — that fetches the model maker's documentation, audits every loaded instruction file against it, places each rule in the lowest enforcement layer that can decide it, applies the edits as hooks, rules and skills once a person approves them, and scores each skill.01FETCH02AUDIT03PLACE04APPLY05SCOREON ASCHEDULELOWTIERTOPTIERTHEREPOMODEL DOCSSCHTimer firesweekly · on releasecron · CI scheduleLSLOWFetch the docsllms.txt → pagesweb fetch · subagentsLSWBTOPAudit every filewhat is loaded nowmodel-update skillWBTBTOPPlace each ruleprose → rule → hookenforcement layersTBFLLOWApply the editsafter the person pickshooks · rules · skillsFLFLREPThe instruction setone workset, sharedCLAUDE.md · rules · skillsFLFLLOWRun the evalsscore each skillplugin evalFLTBREPKept or cutwith the reasoningreport + diffTBSTEPS01FETCH02AUDIT03PLACE04APPLY05SCOREPAYLOADLStriggerWBdocsTBfindingsFLfilesleft = in · right = outFLOWhand-offtriggerfocal hand-offpublished
    Fig. 14 · The pipeline runs on a timer. A person approves the edits before they land.

Built in Oslo.

A stave church stands because its frame carries the load, and because every timber was cut to a mark that says where it belongs. We build software the same way.

The toolchain

Built on work we did not write.

A mechanism is cheaper to adopt than to invent. These are the repositories this practice runs on. Each one is open source, and each one does a job named in the stages above.

Start here

Start with the foundation.

We map what your team already holds, and we build the instruction set the whole team works from. Then we add the guards, one stage at a time.

Get in touch