flow.account
Why provenance, never truth (INV-028)
- intent.reference-is-an-address
A reference names where to look, never what was found; verification is a separate act that must be recorded each time it happens.
docs/decisions/002-evidence-reference-vs-observation.md#Decision
Outcomes and what checks them (INV-027)
- account.checked →
outcome=checked
● checked assert.account.outcome-declares-its-check - account.refuted →
outcome=refuted
● checked assert.account.refuted-is-an-error - account.rotted →
intent=unresolved
● checked assert.account.intent-is-provenance
Assertions
- ● confirmed assert.account.intent-is-provenance
an Intent is checked by whether its record still resolves, never by whether its sentence is true - ● confirmed assert.account.outcome-declares-its-check
an outcome that declares no check reads differently from one that is checked, everywhere it is reported - ● confirmed assert.account.refuted-is-an-error
an outcome refuted by its own check takes integrity to INVALID, because the model is wrong rather than stale
flow.render
Why provenance, never truth (INV-028)
- intent.a-view-is-not-a-source
Anything rendered is regenerated from the model and never edited in place, so no reader has to work out which copy is the real one.
docs/decisions/008-artifact-is-derived.md#Decision
Outcomes and what checks them (INV-027)
- render.published →
view=published
● checked assert.render.view-not-truth
Assertions
- ● confirmed assert.render.no-second-implementation
every figure on the page is computed by the engine and embedded as a result, so no traversal runs in the browser - ● confirmed assert.render.view-not-truth
the page is regenerated, never edited, and is excluded from the repository
flow.trace
Why provenance, never truth (INV-028)
- intent.derived-is-never-authored
A value the system can compute must never be stored as something a person wrote, because the stored copy goes stale and then lies about exactly the property it exists to express.
docs/decisions/001-three-tier-entities.md#Decision
Outcomes and what checks them (INV-027)
- trace.tiered →
impact=tiered
● checked assert.trace.four-tiers
Assertions
- ● confirmed assert.trace.four-tiers
impact is reported in four tiers and never as a list of changed files - ● confirmed assert.trace.unknown-is-gated
a changed file in scope that maps to no node fails the gate, so unknown rejects growth instead of only disclosing it - ● confirmed assert.trace.unknown-is-not-safe
a locator that maps to nothing lands in unknown, never in silence
flow.understand
Why provenance, never truth (INV-028)
- intent.reference-is-an-address
A reference names where to look, never what was found; verification is a separate act that must be recorded each time it happens.
docs/decisions/002-evidence-reference-vs-observation.md#Decision
Outcomes and what checks them (INV-027)
- understand.modeled →
model=established
● checked assert.understand.observes-before-asserting
Assertions
- ● confirmed assert.understand.observes-before-asserting
an evidence reference is authored, then checked, and only the check is recorded - ● confirmed assert.understand.coverage-needs-repo
unmodeled areas are only detectable with the repository file list as input
flow.implement
Why provenance, never truth (INV-028)
- no Intent declares why this Flow exists
Outcomes and what checks them (INV-027)
- none declared
Assertions
- ◐ likely assert.implement.not-ours
implementation is the agent's ordinary coding work, not a TraceOS capability
flow.reconcile
Why provenance, never truth (INV-028)
- intent.confidence-must-be-able-to-fall
Confidence has to drop without anyone editing the model, or the model records only that somebody was once confident.
docs/decisions/003-confidence-is-derived.md#Decision - intent.derived-is-never-authored
A value the system can compute must never be stored as something a person wrote, because the stored copy goes stale and then lies about exactly the property it exists to express.
docs/decisions/001-three-tier-entities.md#Decision
Outcomes and what checks them (INV-027)
- reconcile.reported →
integrity=reported
● checked assert.reconcile.integrity-is-computed
Assertions
- ● confirmed assert.reconcile.confidence-decays
confidence falls when an artifact moves under an observation, with no model file edited - ● confirmed assert.reconcile.rot-is-caught
a reference whose address no longer resolves is reported, because nothing else reads the artifact when {"repo_available": "yes"} - ● confirmed assert.reconcile.integrity-is-computed
integrity is computed and reported, never authored or decided by the agent - ● confirmed assert.reconcile.invariants-stay-tripled
an invariant drifting between the specification, the reference digest, a skill citation and the engine is reported - ● confirmed assert.reconcile.unverifiable-is-not-verified
an observation whose ref is absent from the repository caps confidence and is reported when {"repo_available": "yes"}
Parallel branches are drawn as the absence of a
next arrow, not as a fork construct (INV-021). Arrows are
next; every other relationship is listed under its node.