Protocols

Every shipped engineering protocol is a Canon protocol/1 document at protocols/<name>/<major>.yaml. Each page here is generated from the document's compiled form, canon-ir/1, so it shows what Canon understood.

Protocol	Revision	Description	Declares
eval.gated_change/1	1	Decide one change an automated loop made to an agent's text or configuration (guidance, a system prompt, tool caps) against an evaluation set: keep it only on evidence about that exact candidate revision, from a producer the case lists as another agent run than the one that wrote it, that the evaluation design passed review, the change stays inside the surface the loop may change and carries no leaked or forbidden content, it improved on the tuning split and the improvement reproduced, and the held-out split did not regress; reject it when every one of those is decided and one is false; propose it to a person when it leaves the surface; or close the case inconclusive on an explicit decision. The candidate's revision hashes its content together with its basis (baseline, question set, data revision and design), so a moved basis is a new candidate revision and evidence about the old one no longer counts. Missing, stale or non-independent evidence leaves a claim unknown, and unknown neither keeps nor rejects.	7 claims, 6 actions, 0 obligations, 4 outcomes
incident.response/1	1	Respond to an incident through two obligations that progress independently: restore_service, on which emergency mode is left, and investigate_cause, which stays open after emergency mode ends until a cause analysis of a current revision of the service or the release identifies the cause. A rollback of the release is verified only on a complete rollback result from a verifier the case lists as another principal than the one who rolled it back. The service is healthy only on an observation at most 30 minutes old.	4 claims, 6 actions, 2 obligations, 0 outcomes
loop.improvement/1	1	One turn of improving the improvement loop itself: the loop scorecard, computed over at least three recorded self.improvement turns, shows a metric below its target on the promoted loop definition (the scenario corpus, the metric definitions, the review panel, the intake rules, the protocols and the agent profiles); a candidate change to the loop is delivered; the candidate is checked not to redefine a metric without reporting the previous definition beside it; the owner, or a role the owner delegated the grant to on record, merges it; and after at least three further turns under the candidate the metric is compared again. Accepted once the metric improved; declined when it did not. Every change to the loop is a judge-surface change, so its merge needs the owner's grant or that of a role the owner delegated it to by a revocable record; a revoked delegation grants nothing (story:judge-guard enforces it).	4 claims, 6 actions, 2 obligations, 3 outcomes
ml.experiment/1	1	Test a hypothesis by experiment: run a candidate against a baseline on a frozen dataset snapshot under a reviewed design, and close the case supported when the experiment is valid and its result reproducible, beats the baseline and is robust; refuted when a valid, reproducible result does not beat the baseline; invalid when the experiment itself is not valid; or inconclusive or superseded on an explicit decision.	5 claims, 0 actions, 0 obligations, 5 outcomes
protocol.adopt/1	1	Adopt one revision of a generated protocol: it is adopted only with a canon diff report within the organization floor, a passing canon check report and an approval under the capability protocol.adopt, each about the revision under adoption. Evaluation reads the two reports as evidence and runs neither tool.	3 claims, 3 actions, 0 obligations, 1 outcomes
self.improvement/1	1	One improvement turn on takt: a finding that names a machine-checkable predicate on a scenario or on a repository at a seed is reproduced on the promoted baseline, a candidate fix is delivered and merged under the authority its surface needs, the finding is verified gone on the candidate by another run than the one that delivered it, the scorecard shows no regression against the baseline, and the candidate's binary is promoted. Accepted once promoted; declined when the candidate still reproduces the finding; unreproducible when the baseline never did. Claims about the baseline and about the candidate are about separate artifacts, so a commit to the candidate leaves the baseline's claims standing.	6 claims, 7 actions, 3 obligations, 4 outcomes
software.change/1	1	Deliver a change to a software system: implement it, verify the current implementation revision, merge it under authority, release and deploy it, and accept it once its objective is realized; or close it declined, superseded or abandoned on an explicit decision, or rolled back on a complete rollback result. A case fixes its risk, which selects the obligations that apply, and its change kind, which selects whether a regression must be reproduced before the implementation is edited, and whether its regression test must fail on its first run, before the implementation is first changed; and whether it affects a security boundary, in which case the implementation is verified only once a principal other than the implementer approved its security review. A deployment is healthy only on an observation at most 30 minutes old.	9 claims, 6 actions, 6 obligations, 5 outcomes
story.delivery/1	1	Deliver a planning-store story: implement it, verify the current implementation revision with its tests and the repository's gate, open a pull request for it, read its continuous integration, and merge it under authority. Accepted once the pull request is merged, or abandoned on an explicit decision. Every claim is about the implementation at its current revision, so a new commit returns all of them to unknown.	7 claims, 10 actions, 4 obligations, 2 outcomes
story.delivery/2	2	Deliver a planning-store story: implement it, verify the current implementation revision with its tests and the repository's gate, open a pull request for it, read its continuous integration, and merge it under authority. Accepted once the pull request is merged, or abandoned on an explicit decision. Every claim is about the implementation at its current revision, so a new commit returns all of them to unknown. A case fixes whether the tests must fail before the implementation is edited and whether the gate runs once, after the handover, or at every revision; the pull request opens only on a complete change, with test paths and implementation paths both changed and the tests and the gate green at one revision.	9 claims, 10 actions, 4 obligations, 2 outcomes
support.triage/1	1	Triage one support ticket: read it at its current revision, know who raised it, have a proposed classification reviewed, and route it under authority; escalate under authority when its service-level target is breached, and hand it to a person when it cannot be triaged.	9 claims, 7 actions, 1 obligations, 3 outcomes