Governance

The human stays in the gate. That is not a slogan; it is the design. The Architect proposes an institution; it does not provision it. A spec stays pending until a person writes the confirmation. The arm that creates and destroys infrastructure publishes no port: it lives on the internal network.

Approve means apply

The approval tray is not a notice board. Approving executes. There is no second manual step to forget. [V][Verified]

Proportionate to risk

There is a declared self-improvement ladder, from the most harmless (a local skill) to the most dangerous (changing infrastructure or code). Every capability declares which rung it plays on. Destructive actions — dropping a corpus, resetting an environment, deploying an institution — require a session and a permission on the server, not a hidden button.

Emergency switches per capability, off by default: agent creation, corpus writes, skill publication, automatic approvals. [V][Verified]

What still does not bite

Generic governance enforcement is off by default. Turning it on is an environment decision, not a silent default. [P][Partial]

No social quorum, no cryptographic dual signature on delegations, no physical owner gate (hardware). [D][Designed]

Selection, not RSI

The rungs that route work to the agent measured as best run in shadow: they recommend, they do not act. They are switched off by decision, not held back by the gate; if switched on, three brakes return them to shadow: the measured ability is not stable, the latest fit did not converge, or the anti-Goodhart alarm fires. [P][Partial] Recursive self-improvement (editing the identity document or skills in a closed loop) is not started, and the design bounds it: never model weights, always under fitness and a human gate. [D][Designed]