Governance

The human stays in the gate. That is not a slogan; it is the design. The Architect proposes an institution; it does not provision it. A spec stays pending until a person writes the confirmation. The arm that creates and destroys infrastructure publishes no port: it lives on the internal network.

Approve means apply

The approval tray is not a notice board. Approving executes. There is no second manual step to forget. [V]

Proportionate to risk

There is a declared self-improvement ladder, from the most harmless (a local skill) to the most dangerous (changing infrastructure or code). Every capability declares which rung it plays on. Destructive actions — dropping a corpus, resetting an environment, deploying an institution — require a session and a permission on the server, not a hidden button.

Emergency switches per capability, off by default: agent creation, corpus writes, skill publication, automatic approvals. [V]

What still does not bite

Generic governance enforcement is off by default. Turning it on is an environment decision, not a silent default. [P]

No social quorum, no cryptographic dual signature on delegations, no physical owner gate (hardware). [D]

Selection, not RSI

The rungs that route work to the agent measured as best run in shadow: they recommend, they do not act. Recursive self-improvement (editing the identity document or skills in a closed loop) is not started, and the design bounds it: never model weights, always under fitness and a human gate. [D]