Since 0.13.0 this repository gained 7,805 lines of code and its website gained three.\nprotocol reverse — four verbs and 2,782 lines — had no mention anywhere on the site, and the\nstatus page still opened \"current as of 0.10.0-horizons-dogfood-lab\".
Lifecycles, decided as data — the status ladder is a YAML file decided\nby entity-core, a rung may cost evidence or open on a date, and every write is journalled.
It also states what that kernel does not do, because \"entity runtime\" invites the reading that\nit stores something. It performs no IO at all — a scan over its own sources refuses the tokens\nfor filesystem, clock, network and randomness — so every byte written here is written here. The\ndependency buys a verdict, not a store.
\n| page | now says |
|---|---|
| CLI reference | protocol reverse, plus artifact history and artifact evidence |
| Where this stands | current as of 0.23.2, with the ladder, the engine's four mechanisms, and adoption from the other end |
| Roadmap | the delivered table ran to 0.10.0 and now runs to 0.24.0 |
| Limitations | the store does have a journal since 0.19.0; the contract gap is unchanged and says so |
| Vocabulary | kinds and statuses are open to authors, and why evidence_kinds is closed |
| /releases | one post per release, all 33 of them — the backported ones marked as written retrospectively, with no invented command output |
More columns: swipe horizontally, or focus the table and use the arrow keys.
\nCLI verbs 17 → 20. Artifact lifecycles 8 → 12. This repository's own plan 59 → 101\nartifacts. The document tree 45 → 49 files. The gate ten → twelve steps, in five files.
\nAGENTS.md also still claimed the billing suite runs 27 scenarios where its own guard asserts\n29 — a count the gap register closed in two places and missed in a third.
.github/workflows/release.yml fires on a version tag, runs ci.yml itself — called rather\nthan copied, so a tag cannot ship against a shorter gate than main does — and takes its notes from\nthe tag's own section of the changelog.
Release notes render as GFM, where a single newline becomes a <br>, so a file hard-wrapped at\n100 columns arrives broken after \"added\" and before \"the\". The file stays wrapped, because that\nis the right shape for something reviewed in a diff, and only the notes are joined.
cargo xtask notes --self-test holds the eight shapes the reflow must not damage, and it runs\nbefore the notes are generated — because the failure it catches is silent, and nobody re-reads a\nrelease they already cut.
On its first run it failed. A line ending in two spaces is Markdown asking for a break, and the\nreflow was ending the paragraph but dropping the two spaces. The break survived only because GFM\nturns a bare newline into <br> — standing on the exact quirk the reflow exists to remove.
The same defect was in the original Python implementation in entity-runtime, whose own self-test\nhad a case for it asserting the wrong expectation. Both are fixed.
The least comfortable release note here.
\nCI had been red for eleven consecutive releases — every tag from 0.13.0 to 0.23.1 — with a\ngreen local gate the whole time.
| job | cause |
|---|---|
MSRV 1.85 | a transitive dependency raised its own rust-version, so the declared MSRV stopped holding |
Website | a markdown link from a documentation page into the repository tree, which the site's build resolves |
More columns: swipe horizontally, or focus the table and use the arrow keys.
\nThe MSRV failure is the instructive one: it arrived through the lockfile. idna_adapter@1.2.2\npulled in icu_*@2.3.0, which need rustc 1.88. No commit of ours touched a line of Rust, and\nnothing local noticed for eleven releases.
The fix was to pin idna_adapter to a version that uses unicode-normalization instead — which\nalso drops eight crates from the tree. The alternative was raising the declared MSRV, which would\nhave quietly broken the promise the README makes to anybody building this.
task check did not run msrv or website, while its own description said \"everything CI\nruns\".
That is the whole mechanism by which a red CI survives eleven releases behind a green gate. A gate\nthat covers less than the gate it claims to be is worse than one that admits its scope — because\nthe second kind makes you go and look.
\nIt runs twelve steps now, and this list and the CI workflow are checked against each other whenever\neither changes.
\nNo behavioural change at all. The tag exists so there is one commit in the history whose green is\na fact rather than an assumption, and so every tag after it can be compared to something.
", "url": "https://beyond10x.github.io/updates/field-notes/aep/the-first-verified-tag/", "title": "0.23.2 — the first tag this repository has verified", "summary": "CI had been red for eleven consecutive releases behind a green local gate, because task check was missing exactly the two jobs CI also ran. One failure arrived through the lockfile with no source change at all.\n", "date_modified": "2026-08-25T23:18:01.000Z", "tags": [ "release", "ci" ] }, { "id": "https://beyond10x.github.io/updates/field-notes/aep/the-pin-says-what-it-links/", "content_html": "A small release, and both fixes are the same mistake wearing different clothes: a label that had\ndrifted from the thing it names.
\n\naep-backend-markdown pinned entity-core at a tag two releases behind what existed.
Nothing this crate links actually moved — the source is byte-identical between the two tags, because\nthe releases in between carried an examples-only change. So this changed no behaviour at all.
\nIt was still worth fixing, for a reason that is not about this pin: a pin stale by label is a pin\nnobody trusts to be current by content either. The next person reading it has to go and check\nwhether the drift matters, every time, which is exactly the work a pin exists to save.
\noutbound-claim started at drafted, not draft.
Every other shipped ladder starts at the built-in draft. An invented rung one letter from a\nbuilt-in is a typo wearing a vocabulary's clothes — and it would have been inherited by everybody\nwho copied the file.
This is the boundary the open vocabulary was designed to hold. The vocabulary is open to authors,\nnot to near-misses. A status is accepted because some ladder declares it, never because it\nparses — but a ladder can still declare something its author did not mean to, and the first shipped\nexample doing so is the one that teaches it to everybody else.
", "url": "https://beyond10x.github.io/updates/field-notes/aep/the-pin-says-what-it-links/", "title": "0.23.1 — the pin says what it links, and the ladder says draft", "summary": "Two corrections that are the same mistake in two places: a dependency pin recording a tag two releases behind what exists, and a new ladder starting at drafted — one letter from a built-in.\n", "date_modified": "2026-08-25T22:55:19.000Z", "tags": [ "release", "aep", "planning" ] }, { "id": "https://beyond10x.github.io/updates/field-notes/aep/a-claim-that-left-the-boundary/", "content_html": "Every ladder in this repository models evidence flowing inward: something was observed, and an\nartifact's status records what we now know.
\nAn outbound claim runs the other way. A number in a customer's inbox. A status page saying\n\"resolved\". An availability figure in a renewal deck. Those are assertions that already left the\nboundary, and nothing here modelled them.
\n\n$ protocol artifact lifecycle outbound-claim
outbound-claim starts at draft
cleared -> sent
corrected -> nothing
correction-owed -> corrected
draft -> cleared
sent -> correction-owed, standing
standing -> correction-owed
Sending is not undoable, and the ladder says so:
\n$ protocol artifact move outbound-claim:q3-uptime --to sent
outbound-claim:q3-uptime moved cleared -> sent (revision 3)
$ protocol artifact move outbound-claim:q3-uptime --to draft
outbound-claim:q3-uptime is sent; an outbound-claim may move to: correction-owed, standing
There is no path from sent back to draft. A ladder that allowed one would model retraction as an\nedit — the claim would simply stop having been made — and the customer would still have the\nemail.
So a wrong claim moves forward, never back. correction-owed, then corrected, which is a new\noutbound act with its own evidence, costing two approvals where the original cost one. Fixing\na claim costs a second claim. That is true in the world, and the ladder should not be kinder than\nthe world.
correction-owed is a rung and not a flagThe rung names the state precisely: sent, known wrong, audience not yet told.
\nIt is the most expensive state an organisation can be in and the easiest one to leave undocumented,\nbecause nobody wants to write it down. A rung is a column protocol artifact board prints; a flag\nis a field nobody queries.
It is deliberately not terminal and deliberately not counted as approved — a claim in\ncorrection-owed is a live obligation, and anything treating it as finished would let the most\nimportant case disappear from a report.
There is no retracted. A retraction is itself an outbound claim — you have to tell somebody —\nso it is a corrected whose content is a withdrawal, not a rung that quietly makes the original\nstop counting.
A whole new kind of artifact, with six rungs and two evidence requirements, arrived as one YAML\nfile and no Rust change at all.
\nThat is the sentence the entity-runtime programme was for. Ten releases earlier it would have been a\npull request against this repository, a review, a release, and an upgrade for everybody. Now it is a\nfile you write in your own tree.
", "url": "https://beyond10x.github.io/updates/field-notes/aep/a-claim-that-left-the-boundary/", "title": "0.23.0 — a claim that left the boundary", "summary": "Every other ladder here models evidence flowing inward. An outbound claim runs the other way — a number already in a customer's inbox — and sending is not undoable. Added as a YAML file with no Rust change at all, which is what the whole entity-runtime programme was for.\n", "date_modified": "2026-08-25T22:49:54.000Z", "tags": [ "release", "aep", "planning" ] }, { "id": "https://beyond10x.github.io/updates/field-notes/aep/a-second-transcript-shape/", "content_html": "Every behavioural document here is published as harness-neutral, and until this release exactly\none transcript adapter existed. So \"neutral\" was a claim with no second case behind it.
\nA vocabulary tested against one harness is a vocabulary shaped like that harness, and nobody can\ntell which from the inside.
\n\nA reader for a second transcript shape, so one trace-spec/1 specification now decides both. The\nspecification did not change to accommodate it, which is the result the exercise was for.
Two things stated plainly rather than implied, because the difference matters:
\nThe claim this release earns is precise: the vocabulary is neutral. The driving path still has\nnever met a second harness, and the limitations page says so.
\nThree prose literals had drifted from the counts their own gates print. Each was corrected by\nrunning the command beside it rather than by picking the number that looked right:
\n| claim | was | is |
|---|---|---|
| billing suite scenarios | 27 | 29 |
| browser boundary claims held | 17 | counted at run time |
| revision-pair scenarios | nine | ten |
More columns: swipe horizontally, or focus the table and use the arrow keys.
\nThe middle one is the fix worth copying: smoke.mjs now increments a counter in its own check\nfunction and prints what it actually checked. It cannot drift again, because there is no second\ncopy of the number to drift from.
For the first, a new guard reads the count out of the suite's own source and fails if the prose\ndisagrees — because correcting two copies without tying them together only resets the clock.
", "url": "https://beyond10x.github.io/updates/field-notes/aep/a-second-transcript-shape/", "title": "0.22.0 — a second harness, and what it immediately found", "summary": "One trace-spec/1 specification now decides two transcript shapes, so harness neutrality stops being a claim with one case behind it. Plus three prose counts re-derived from the commands that print them.\n", "date_modified": "2026-08-25T22:45:27.000Z", "tags": [ "release", "trace", "portability" ] }, { "id": "https://beyond10x.github.io/updates/field-notes/aep/the-engines-mechanisms/", "content_html": "Four mechanisms, each closing a gap where the rule existed and nothing enforced it.
\n\nA record may declare what it is about. If the declared subject does not match the task it is\nsubmitted against, it is refused — before the record is constructed, not after.
\nIn a sentence: a green test run for one story can no longer discharge a different story's gate.\nThat was possible before, it was silent, and the audit trail would have looked correct.
\nPlacing the guard before construction is deliberate. A refused record that got built is a refused\nrecord that can be logged, cached, or passed on by something that did not check the verdict.
\nA requirement may be declared advisory, with an owner and an exit criterion. It is evaluated,\nreported and counted — and it gates nothing.
\nThis exists because the realistic alternative to a soft rule is not a hard rule; it is prose in a\nwiki. A team can now measure how often a proposed rule would have fired, on real work, before\nanybody's build turns red.
\nThe owner and the exit criterion are required at parse time, so an advisory requirement cannot\nquietly become permanent through nobody remembering to revisit it. A rule with no exit criterion is\na rule that never graduates and never dies.
\nA step map may declare depends_on and a circuit breaker. A repeatedly failing dependency opens\nthe breaker instead of being retried, and the run says the breaker is open rather than producing\nthe tenth identical timeout.
Retry and circuit-breaking had been prose in every step map — which is to say, enforced by whoever\nread it.
\nRefusals are emitted as their own trace-spec/1 document, with tool.absent expectations. The\nabsence of a tool call becomes a checkable fact rather than a silence.
This closes a real hole in reasoning about a governed run: \"the agent did not shell out\" and\n\"the transcript contains no record either way\" look identical in a log, and only one of them is a\nfinding.
\nIf a run refused nothing, no document is written at all — an empty specification is refused by\nthe format itself, and a file asserting nothing is worse than no file.
", "url": "https://beyond10x.github.io/updates/field-notes/aep/the-engines-mechanisms/", "title": "0.21.0 — four mechanisms the engine and driver were missing", "summary": "Evidence names its subject, so a green run for one story can no longer discharge another story's gate. An advisory tier that reports and gates nothing. A circuit breaker on step dependencies. And the driver writes down what a step was not allowed to do.\n", "date_modified": "2026-08-25T22:25:17.000Z", "tags": [ "release", "aep", "driver", "evidence" ] }, { "id": "https://beyond10x.github.io/updates/field-notes/aep/evidence-names-what-it-is-about/", "content_html": "0.15.0 let a rung cost evidence. This release is how the evidence gets there.
$ protocol artifact evidence outbound-claim:q3-uptime \\
--kind approval --source \"legal review\" --ref https://example.invalid/approvals/814
outbound-claim:q3-uptime: approval recorded from legal review
on hand: approval=1
$ protocol artifact move outbound-claim:q3-uptime --to cleared
outbound-claim:q3-uptime moved draft -> cleared (revision 2)
--at defaults to now, read at the edge and written into the record — so the observation\ncarries when somebody looked, not when the file was parsed. That is the same observed_at rule\nthe engine has used since 0.10.0, now available from the planning side.
--source and --ref are how a record stops being an assertion: where it came from and where to\ngo and look.
A move now records the provenance of what decided it, separating evidence that was recorded\nfrom evidence that was asserted at the moment of the move — and a move leaning on an assertion\nsays so as it happens.
\nThe consequence is about a specific future moment: somebody auditing, months later, why a gate\nopened. Without this, both cases look identical in the trail. With it, the weaker claim is visible\nat the point of decision — where somebody could still have objected — rather than discoverable\nafterwards, when the only options are accept or unwind.
", "url": "https://beyond10x.github.io/updates/field-notes/aep/evidence-names-what-it-is-about/", "title": "0.20.0 — evidence you record, and provenance for a decision", "summary": "protocol artifact evidence records an observation against an artifact so a later move can be decided on it. And a move now separates evidence that was recorded from evidence that was asserted — saying so at the moment it leans on the weaker one.\n", "date_modified": "2026-08-25T22:03:33.000Z", "tags": [ "release", "aep", "planning", "evidence" ] }, { "id": "https://beyond10x.github.io/updates/field-notes/aep/the-plan-has-a-history/", "content_html": "The planning store is markdown files in git, so its history was always there — as git log, in a\nform you had to reconstruct. This release makes it a question you can ask.
$ protocol artifact history outbound-claim:q3-uptime
2026-08-26T00:08:16Z operator created as draft (revision 1)
2026-08-26T00:08:20Z operator approval recorded from legal review (https://example.invalid/approvals/814) (revision 1)
2026-08-26T00:08:20Z operator moved draft -> cleared (revision 2)
2026-08-26T00:08:20Z operator moved cleared -> sent (revision 3)
A corrupt line is skipped and counted. A history that quietly shortens is worse than one that\nsays it is damaged: the second is a bug report, the first is a wrong answer nobody questions.
\nAppend-only, and not a cache. The journal cannot be regenerated from the files — which is\nexactly why it can answer questions the files cannot, such as what an artifact's status was before\nsomebody corrected it. A derived index would lose that on its first rebuild.
\nThis is the markdown store's own journal, not the AEP storage contract's. The sixteen conformance\nsuites still do not run against this store, and this release does not move that. Worth saying,\nbecause \"the durable store now has a journal\" reads like it might have.
", "url": "https://beyond10x.github.io/updates/field-notes/aep/the-plan-has-a-history/", "title": "0.19.0 — the plan has a history", "summary": "The markdown store gains an append-only journal, so what happened to an artifact becomes a question you can ask rather than a git log you reconstruct. A corrupt line is skipped and counted, never silently dropped.\n", "date_modified": "2026-08-25T21:54:35.000Z", "tags": [ "release", "aep", "planning" ] }, { "id": "https://beyond10x.github.io/updates/field-notes/aep/the-typed-blocker/", "content_html": "$ protocol artifact lifecycle blocker
blocker starts at open
cleared -> nothing
open -> cleared
Two rungs. The value is entirely in the type: a blocker is typed by what would clear it, so\nblocked stops being a label on a card and becomes a statement with a named exit.
\n\nThe same release published an audit of every adopter-facing vocabulary — which are open, which\nare closed, and what each closure buys.
\nOpening a vocabulary is not automatically the better answer. evidence_kinds stays closed on\npurpose: an open evidence vocabulary would let a caller invent the kind of proof a gate is asking\nfor. That is not extensibility, it is a hole.
The output of the audit is not open everything. It is that no vocabulary is closed by accident,\nand the reason is written where an adopter reads it.
\nThe failure mode it prevents is specific and common. An adopter hits a closed vocabulary, cannot\ntell whether the closure is a decision or an oversight, and either works around it — building\nsomething on a shape that was never intended — or files an issue and waits.
\nA table saying closed, and here is what that buys you turns both of those into a one-minute read.
", "url": "https://beyond10x.github.io/updates/field-notes/aep/the-typed-blocker/", "title": "0.18.0 — the typed blocker, and a vocabulary that says why it is closed", "summary": "Two rungs, and the value is entirely in the type: a blocker is typed by what would clear it, so \"blocked\" stops being a label on a card. Plus an audit of every adopter-facing vocabulary — open or closed, and what each closure buys.\n", "date_modified": "2026-08-25T21:48:17.000Z", "tags": [ "release", "aep", "planning" ] }, { "id": "https://beyond10x.github.io/updates/field-notes/aep/obligation/", "content_html": "An obligation is a commitment on a clock nobody here controls: a customer's deadline, a\nregulator's window, a partner's delivery date.
$ protocol artifact lifecycle obligation
obligation starts at open
met -> nothing
open -> met, slipped
slipped -> met
slipped. And the rule attached to it is the point of the whole release: an obligation must never\ngate a transition.
A missed external deadline is a fact to report, not a permission to withhold. A tool that\nlet a slipped obligation block your work would have turned somebody else's missed date into your\nblocked pull request — which is both unfair and useless, because you cannot fix it from here.
\nThis is also why it is a second ladder rather than a widening of the existing status vocabulary.\nslipped on ArtifactStatus would have been available to every kind, and something would\neventually have gated on it.
slipped -> met existsAn obligation you missed and then satisfied is a real and common history. A ladder that made\nslipped terminal would push people to avoid recording it in the first place — and the state you\nmost want recorded is the one nobody wants to write down.
A YAML file. No Rust change. This is the second kind added that way, and by this point the claim\n0.13.0 made has two releases of evidence behind it.
Some rungs should not open yet. A review window. A cooling-off period. A notice period somebody\nagreed to in a contract.
\nThis release adds date and duration operators to the condition language, so a ladder can say so.
\n\nThe interesting part is where the time comes from. The kernel deciding the move has no clock at\nall — reading one is banned by a scan over its own sources. The instant is read at the edge and\nhanded in as an argument.
\nThat is not fastidiousness. It is what makes the same inputs give the same verdict forever, so a\ndecision recorded today can be re-checked next year by somebody who was not there, and the answer\ndoes not depend on when they asked.
\nA kernel that read its own clock would give different verdicts at different moments for identical\ninputs, and every recorded decision would become unfalsifiable.
\nThe condition language is data, and the standing rule is that it grows operator by operator, never\ninto a language. Two comparison operators over instants is a step; an expression evaluator would\nbe a different product.
\nDate parsing now lives inside a decision path, which means it has to be total. A malformed\ndate is False — not a panic, not a default, not \"probably fine\". Anything that can be reached by a\ngate has to have an answer for every input, including the input nobody expected.
0.13.0 made the status ladder data. This is the first release that spends it.
A ladder that only says what may follow what models permission, not earning. Anybody could\nmove a story to implemented; the ladder had no opinion about whether anything was implemented.
requires:
cleared: [{ evidence: approval, at_least: 1 }]
corrected: [{ evidence: approval, at_least: 2 }]
And the refusal says which kind of no it is, which is the whole design:
\n$ protocol artifact move outbound-claim:q3-uptime --to cleared
outbound-claim:q3-uptime is draft; cleared is on the ladder and not yet earned: reaching cleared
needs at least 1 approval record(s). Nothing was presented at $args.evidence.approval
On the ladder and not yet earned is a different sentence from not on the ladder, and the two\nlead to different next actions. One is \"go and get the approval.\" The other is \"you are trying to do\nsomething this kind of work does not do.\"
\nA tool that collapses both into refused has handed you the job of guessing which.
The condition is True / False / Unknown. A rung whose requirement cannot be observed\nrefuses as Unknown, never as False.
Nobody looked is not the same answer as somebody looked and it failed, and neither of them is a\npass.
\nThe shipped story ladder does not declare a cost. The mechanism exists; this repository has\nnot yet spent it on its own most-used kind. That is a choice you can now make in your own tree\nwithout waiting for us.
Every worked example on this site starts from documents that already exist. That is the wrong end\nfor anybody deciding whether to adopt: your repository has a README, a test layout, a CI file and\nsix years of git history, and none of it was written with a protocol in mind.
\n0.14.0 adds protocol reverse — four verbs that read what a repository already says about\nitself. Three of the four write nothing at all, which is the part that matters when you are\nevaluating a tool you do not trust yet: the worst case is a report you disagree with.
reverse scan — what the repository says about itself$ protocol reverse scan .
aep.reverse-scan/1
readme headings: 119
README.md:1 aep
README.md:19 Two halves, one seam
README.md:34 What that looks like
README.md:76 Is this for you
README.md:89 Where it sits
README.md:104 Status
...
Headings, declared toolchains, gates, test layout — assembled into an aep.reverse-scan/1 bundle\nthat renders as text, yaml or json. Nothing is written.
reverse history — what the git history saysThis is the one that surprises people. Run against this repository:
\n$ protocol reverse history . --top 5
aep.reverse-history/1
span: 213 commits, 1 author(s), 2026-08-19 -> 2026-08-26
tags: 33 [0.23.2, 0.23.1, 0.23.0, 0.22.0, 0.21.0]
commit types: feat 95 docs 66 fix 22 chore 18 ci 3 refactor 3 test 3 style 2
tickets: 4
W4-2 5 commit(s), last 2026-08-24
W4-1 3 commit(s), last 2026-08-22
reverted: 0
stated expiry: 1
2026-08-20 87310c3 refactor(conformance): drop the per-suite workaround for colliding identifiers
churn: 5
CHANGELOG.md 109 commit(s), 1 author(s), last 2026-08-26
AGENTS.md 39 commit(s), 1 author(s), last 2026-08-25
crates/protocol-cli/src/app.rs 36 commit(s), 1 author(s), last 2026-08-25
dormant: 0
Churn is where change concentrates. Dormant is what nobody has touched recently — a\ndifferent question from what is untested, and often a more useful one. Stated expiry finds\ncommits that said something was temporary, which is the class of comment that outlives its author's\nmemory of it.
\n--recent sets how many commits count as recent for dormancy; --top sets how many entries each\nranked section reports.
reverse openapi — a specification you already published$ protocol reverse openapi openapi.yaml --domain acme.billing
Drafts an ess/1 domain from an OpenAPI document that already exists. Standard output when --out\nis absent, because a verb that scatters files over a working tree the first time somebody tries it\nis a verb nobody tries twice.
reverse init — the one that writes$ protocol reverse init \\
--protocols git+https://github.com/beyond10x/aep#<40-hex> \\
--profile development.standard
Writes the project.yaml that makes a repository an adopting project, and resolves the protocol\nsource first unless --no-verify says not to.
--protocols takes a path or a pinned git locator, and the pin is not decoration: a governing\ndocument tree that could move under you is a gate whose meaning changes without a commit in your\nrepository.
The walkthrough is\nAdopting a repository that already exists,\nand the verb-by-verb tables are in the CLI reference.
", "url": "https://beyond10x.github.io/updates/field-notes/aep/a-repository-that-already-exists/", "title": "0.14 — the protocol reads a repository that already exists", "summary": "Release 0.14.0 adds protocol reverse: four verbs that point the tooling at a repository written with none of this in mind. Three of the four write nothing, so you can run them against your own code before deciding anything.\n", "date_modified": "2026-08-25T14:05:51.000Z", "tags": [ "release", "aep", "adoption" ] }, { "id": "https://beyond10x.github.io/updates/field-notes/aep/the-ladder-is-data/", "content_html": "Every plan item in the planning store sits at a status and climbs a ladder: draft →\nproposed → active → implemented → accepted. Until 0.13.0 that ladder was a hand-written\nlookup in Rust, and the consequence for anybody using the tool was concrete and annoying: a team\nwhose work does not fit the shapes we happened to think of had to send a pull request to this\nrepository and wait for a release.
It is a YAML file now.
\n\n# artifacts/lifecycles/story.yaml
kind: story
initial: draft
transitions:
draft: [proposed]
proposed: [active]
active: [implemented]
implemented: [accepted]
accepted: []
Put a <kind>.yaml in your own document tree, point --root at it, and new, move, board,\nlifecycle and validate all understand the kind. No crate changes on either side.
$ protocol artifact lifecycle blocker
blocker starts at open
cleared -> nothing
open -> cleared
Not this repository. crates/plan/aep-backend-markdown/src/kernel.rs hands the definition and the\nattempted move to entity-core, a kernel that lives\nin a separate repository and is taken here as a git-pinned dependency.
entity-core is IO-free by test, not by convention. A banned-token scan over its own sources\nrefuses the tokens for filesystem, network, clock, process, thread and randomness, and its entire\ndependency list is serde and serde_json. It cannot open a file, read a clock or reach a network.
It is worth saying what that does not mean, because the phrase \"runtime\" invites the wrong\nreading:
\n| entity-core does | entity-core does not do |
|---|---|
| take an entity type as data and answer is this move permitted | store anything — every byte the planning store writes is written here, by aep-backend-markdown |
| evaluate a rung's conditions against values handed to it | read a clock — the instant is read at the edge and passed in as an argument |
| refuse an undeclared status by name | know what other artifacts exist, or resolve a reference |
More columns: swipe horizontally, or focus the table and use the arrow keys.
\nThe arrow points one way and never back: nothing from this repository appears in a manifest of\nentity-runtime's, at any version. A kernel that depended on its adopter could be shaped by one,\nand its verdicts would stop being a general answer.
Because it is reversible, and that was built before the dependency was taken.
\ncrates/plan/aep-backend-markdown/tests/kernel_equivalence.rs holds the kernel's verdict identical to\nthe hand-written lookup it replaced, across every kind-and-status pair. Delete the module and the\nlookup is still standing behind it. A dependency you cannot undo is a decision somebody else gets to\nmake later.
ArtifactKind and ArtifactStatus both gained an Other(String) variant, so a ladder may declare\nrungs nobody here named. It is deliberately not open to any string: a status is accepted because\nsome ladder declares it, not because it parses.
That distinction earned its keep two releases later, when a new ladder was written starting at\ndrafted — one letter from the built-in draft, a typo wearing a vocabulary's clothes. It was\ncaught and corrected in 0.23.1.
Openness is also not the default answer everywhere. evidence_kinds stays closed on purpose: an\nopen evidence vocabulary would let a caller invent the kind of proof a gate is asking for. Which\nvocabularies are open, which are closed, and what each closure buys is written down rather than\ninferred.
Everything in the eleven releases after it. A rung that costs evidence, a rung that opens on a date,\nthree new ladders — and, in 0.23.0, a whole new kind of artifact added as a YAML file with no\nRust change at all, which was the point of the exercise.
See Lifecycles, decided as data for the full model.
", "url": "https://beyond10x.github.io/updates/field-notes/aep/the-ladder-is-data/", "title": "0.13 — the ladder is data", "summary": "Release 0.13.0 takes the status ladder every plan item climbs out of Rust and puts it in a YAML file, decided by entity-core — a separate, IO-free kernel. The consequence: modelling a kind of work this repository never anticipated stops needing a pull request here and a release.\n", "date_modified": "2026-08-25T12:44:15.000Z", "tags": [ "release", "aep", "planning" ] }, { "id": "https://beyond10x.github.io/updates/field-notes/agentic-principles/what-the-operator-actually-contributes/", "content_html": "The median instruction given to a coding agent in our sample is eleven words long and sets off\neight tool calls. That ratio is the whole economics of agentic work in one line: a very small\namount of human input steering a very large amount of machine work.
\nSo we went looking for the obvious follow-up question. Of those eleven words — how many mattered?
\n\nAny team running agents at volume eventually asks where to put the automation boundary. The honest\nversion of the question is uncomfortable: which of the human's turns carry information the agent\ncould not have obtained, and which are ceremony — permission, nudging, repetition — that a script or\na fixed policy could emit instead?
\nWe can now answer it with numbers rather than vibes, because agent harnesses record everything.
\nWe took the 100 most recently active Claude Code sessions from one heavy operator's machine, spanning\ntwelve days and 22 working directories, and rebuilt each one as a sequence of\nhuman turn → agent operations → outcome.
| sessions | 100 (18 of them already fully headless) |
| human turns | 1,567 |
| agent messages | 33,327 |
| tool calls | 33,293 |
| wall-clock | 673 h elapsed, 222 h with gaps over 5 min removed |
| compute | ~$10,200 at API list prices (these ran on a subscription; this is an equivalence, not a bill) |
More columns: swipe horizontally, or focus the table and use the arrow keys.
\nTwo things in that table are worth pausing on. Agent messages and tool calls are nearly 1:1 —\nalmost every turn the model takes, it takes an action. And 18 sessions had no human in them at all;\nthat is the automation baseline this operator had already built before anyone measured anything.
\nOn method. Counts, costs, latencies and sequence motifs are observed — read directly off the\ntranscripts. The labels on each human turn (intent, motivation, what information it carried, whether\nit could be replaced) are inferred by an LLM classifier over a closed taxonomy, and they are\njudgements, not measurements. We keep the two apart everywhere below, and we spot-checked labels\nagainst raw turn text before trusting them.
\n| metric | value |
|---|---|
| median human turn | 11 words / 65 characters |
| turns under 10 words | 44% |
| median tool calls triggered | 8 |
| turns triggering no tool at all | 15% |
| turns that interrupted a running agent | 1% |
More columns: swipe horizontally, or focus the table and use the arrow keys.
\nAnd the number that reframes the problem:
\n\n\nThe agent spent 229 hours idle waiting for a human to reply — 34% of all session wall-clock.\nMedian wait after the agent stops: 2 minutes. Ninth decile: 21 minutes.
\n
A third of the elapsed time of agentic work, in this sample, was the machine waiting for a person to\nread something and type a short reply. That is the cost being paid for whatever the human turns\ncontribute. So: what do they contribute?
\n| intent | share |
|---|---|
| open new work | 21% |
| approve / green-light | 12% |
| narrow or expand scope | 9% |
| manage the agent itself (context, config, tooling) | 9% |
| ask a question | 8% |
| correct an agent error | 8% |
| supply outside information | 8% |
| commit / push / release chores | 6% |
| \"keep going\" | 4% |
| ask for status | 4% |
More columns: swipe horizontally, or focus the table and use the arrow keys.
\nThen we asked a sharper question of each turn: did it carry anything the agent did not already\nhave?
\n| information contributed | share |
|---|---|
| nothing new | 42% |
| a new goal | 16% |
| state only a human could see | 12% |
| a taste or priority preference | 11% |
| a judgement between options the agent had already surfaced | 10% |
| domain knowledge the agent lacked | 8% |
More columns: swipe horizontally, or focus the table and use the arrow keys.
\nNearly half of all human turns added no information to the conversation. Widen it slightly — include\npure approvals, status requests and continuation nudges — and 48% of turns (748 of 1,567) carried\nno new information, arriving in 355 consecutive runs, the longest of them nine turns deep.
\nThe classifier judged each turn against four options: a deterministic rule could have emitted it, a\nfixed agent policy could have, another AI with context could have, or it genuinely needed the human.
\n| replaceable by | share |
|---|---|
| human only | 44% |
| a fixed agent policy | 23% |
| a deterministic rule | 20% |
| another AI with context | 14% |
More columns: swipe horizontally, or focus the table and use the arrow keys.
\n43% of human turns could be produced by a rule or a policy. Not \"eventually\" — from the\ntranscript alone, with the trigger visible.
\nThe interesting part is which intents concentrate the removable turns:
\n| intent | n | % a rule or policy could emit |
|---|---|---|
| manage the agent itself | 136 | 73% |
| approve / green-light | 190 | 61% |
| ask a question | 130 | 35% |
| open new work | 324 | 19% |
| narrow or expand scope | 145 | 8% |
More columns: swipe horizontally, or focus the table and use the arrow keys.
\nTwo clusters are almost pure overhead. Context management — compacting, clearing, re-orienting the\nagent after it lost the thread — is the agent's own housekeeping, delegated upward to a human who\nnotices before it does. And approval is mostly a human saying yes to something they were always\ngoing to say yes to.
\nScope refinement goes the other way: only 8% of those turns reduce to a rule or a policy, and 70%\nwere judged to need the human outright. That is the reassuring half of the result. Deciding what\nand how much survives automation. Deciding whether to proceed with the thing you already asked\nfor does not.
\n20% of human turns (313) existed only because the agent erred or stopped short. The dominant\ncause was not wrong answers:
\n| friction | share of turns |
|---|---|
| agent stopped short of the task | 18% |
| agent got something wrong | 7% |
| missing context | 3% |
| tool failure | 3% |
| ambiguous instruction | 1% |
More columns: swipe horizontally, or focus the table and use the arrow keys.
\nOmission outweighs error two and a half to one. The operator's most common corrective act is not \"that's wrong\",\nit is \"you didn't finish\". Tone tracks this: 44% of turns read as terse and pressing, 5% as\nfrustrated.
\n| human turns in session | n | success | partial | abandoned / failed | open-ended |
|---|---|---|---|---|---|
| 0 (headless) | 18 | 10 | – | 6 | 2 |
| 1–3 | 26 | 17 | – | 8 | 1 |
| 4–10 | 16 | 6 | 9 | 1 | – |
| 11–30 | 21 | 6 | 13 | 2 | – |
| 31+ | 19 | 2 | 17 | – | – |
More columns: swipe horizontally, or focus the table and use the arrow keys.
\nSessions with more than thirty human turns finished cleanly twice out of nineteen.
\nWe are not claiming that talking to the agent more makes it worse. The obvious competing\nexplanation is confounding by difficulty: hard, sprawling, poorly specified work attracts both more\nhuman turns and worse outcomes. That explanation is at least as consistent with this table as any\ncausal story, and this study cannot separate them.
\nWhat the table does support is narrower and still useful: a long human-turn count is an early\ndistress signal, not a sign of diligence. A session past its twentieth human turn is, empirically,\na session in trouble — and something should notice that and say so.
\nGrouping sessions by the shape of the work gives a small, repeating catalogue: incident\ninvestigation, agent-harness tuning, greenfield scaffolding, refactor sweeps, review-and-gate runs,\nbacklog grooming, multi-agent fan-out, release cuts. Thirteen named archetypes plus a catch-all\ncover all 100 sessions; the six largest named ones cover 63 of them.
\nJudged per session, 64 of 100 could run unattended or with a small number of gates. The gates\nthat survive scrutiny fall into exactly four categories, and they are worth naming because they are\nthe actual specification for a human-in-the-loop design:
\nEverything else in the observed recipes — resolving the trigger, gathering context, running the gate,\nreading the failure, patching, re-running, committing, reporting — appeared in the transcripts as\nmechanical work that a human was narrating rather than performing.
\nOne operator, one harness, twelve days, one machine's habits. The corpus skews toward infrastructure\nand agent-tooling work and contains almost no greenfield product code. The replaceability labels are\nan LLM's opinion about a single turn in context; that classifier does not know what an automated\nreplacement would have cost, or what it would have broken. The outcome-versus-turn-count table is\nconfounded as described. And the analysis of these sessions was itself performed by an agent of the\nsame family as the one under study — which is either efficient or a conflict of interest, depending\non how the next replication goes.
\nThe cheapest falsification is a turn-count tripwire: have the harness announce, at the twentieth\nhuman turn, that this session is now in the population that historically finishes partial, and offer\nto restate the goal from scratch. If outcomes do not move, the distress-signal reading is wrong and\nthe confound was the whole story.
\nThe second is a default-approval policy for the 61% of approvals the classifier called removable:\nstate the intended action with its default, act after a fixed pause unless contradicted, and keep a\nhard stop on the four gate categories above. That converts approval from a blocking request into a\nrevocable one — and reclaims most of a third of the wall-clock.
", "url": "https://beyond10x.github.io/updates/field-notes/agentic-principles/what-the-operator-actually-contributes/", "title": "We read 100 agent sessions to find out what the human actually contributes", "summary": "A transcript study of 1,567 human turns in coding-agent sessions, separating the turns that carried information from the turns that only carried permission.", "date_modified": "2026-08-25T00:00:00.000Z", "tags": [ "transcripts", "automation", "human-in-the-loop", "measurement" ] }, { "id": "https://beyond10x.github.io/updates/field-notes/aep/where-a-run-may-write/", "content_html": "A workflow step now declares two things it never could: the files it is given, and the paths\nit may write.
\n\ncontext: names files a run is handed rather than has to find. scope: is an ordered list of\npaths and one of three words — allowed, partial-only, denied — first match wins, and the\nlast rule must name **, so a path nobody thought of has an answer rather than a default.
Requiring the catch-all is the small decision that matters. A default is a policy nobody wrote; a\nrequired final rule is a policy somebody had to type.
\npartial-only earns the shapeIt is the planning store's own rule. The CLI owns the frontmatter, so a body edit is legitimate\nand a whole-file rewrite re-types it by hand.
\nNo set of operations can express that, because a file write and a file edit are both writes. So\nthe document speaks granularity, not identity — and which of an adapter's operations replace a\nfile whole stays the adapter's own fact.
\nThe rule already existed, in the driver's store_integrity check, written in one vendor's tool\nnames — so every arm but one walked past it for a year. A policy written in one harness's\nvocabulary is a policy that only holds for that harness.
A call selector now takes a set of tools, an operation set and a subject, so a row meaning \"the\ntest was written before the code\" decides on any harness instead of being blind to the one that\nused a differently-named edit verb.
\nThe three-arm programme became four. The fourth is our own loop, where there is no decision seam\nat all and the published toolset is the policy.
\nFour live runs, recorded with their transcript digests:
\n| run | result |
|---|---|
| unscoped | 10 of 11 expectations held; three artifact files rewritten whole |
| scoped and stated | 11 held; discovery calls down from ten of fifty-two to three of forty-nine |
| scoped and unstated | five calls refused and the rule still held |
More columns: swipe horizontally, or focus the table and use the arrow keys.
\nThe last one is the only run that measures this feature's own claim: with the prose warning removed,\nthe toolset stopped the run rather than the instructions doing it. Everything else could have\nbeen the model being agreeable.
\nGreen for the first time that session, read from its own exit status rather than a pipeline's —\nthe same mistake this repository already paid for once and wrote down.
\nWritten retrospectively from this release's CHANGELOG.md section and its annotated tag; no\nre-run command output.
The most useful thing in this release is a mistake it documents.
\n\nThe adopter fixed their reference against this repository's scanner and re-issued\nexpected.json: 43 raw, 43 parsed, missed_by_reference zero — adding a seventh position and a\nrule running the other way. An annotation inside a fenced code block is an illustration,\nexcluded from parsing and from the coverage denominator both.
The scanner follows, with the fence-stripping implemented twice on purpose so the denominator\nstays independent evidence. Two implementations agreeing is evidence; one implementation checking\nitself is a tautology.
\nThis is what ground truth is supposed to look like: the corpus is not ours, and it corrected us as\noften as we corrected it.
\nTwo gates had aborted at their first step and were misread as green through a piped exit\nstatus — $? was the pipeline's, not the gate's.
The record is corrected in git notes rather than by rewriting history, and the first honestly\ncaptured gate immediately caught a stale test. Which is the point: the reason to fix the reading\nis not tidiness, it is that the gate had something to say and nobody heard it.
\nThe rule that came out of it — read the gate's own exit code, never a pipeline's — has been\napplied on every gate run since, including the one that cut this release.
\nprotocol evidence inspect no longer refuses a record the day it is written: the future check\nnow runs at the reference date's own granularity.
And the documentation caught up with the tree under one rule: every number from a command, every\nreference resolving, every quoted output reproduced.
\nWritten retrospectively from this release's CHANGELOG.md section and its annotated tag; no\nre-run command output.
Two things, and the second is the one that matters.
\n\nAn evidence record carries observed_at as the identity of the fact — not metadata about it. A\nrequirement may declare a horizon, past which the fact decays to Unknown, and never to\nFalse.
That asymmetry is the design. A lapsed check has not failed; nobody has run it. A tool that\nreported a stale pass as a failure would train people to re-run things to clear noise; one that\nreported it as a pass would be lying.
\nNo API can extend a horizon. There is deliberately no extend verb: if extending were as easy\nto call as re-checking, it is the one that gets called by whoever is trying to get a gate green.
Against the adopter's vendored corpus: 42 of 42, with self-reported coverage. It closed the\nfirst adopter's ranked-first finding, and was designed and adversarially reviewed the same day it\nwas built.
\nprotocol drive walked a real story out of this repository's own store under development.driven.\nFour headless model sessions, hooks as the enforcement arm, 80 decisions, 11 denies one-for-one\nwith the transcripts.
It blocked in establish_verifiers, four states short of the person it was meant to stop at.
Both reasons the engine printed were correct refusals. The model wrote its failing checks as shell\nscripts — the idiom the story's own acceptance is written in — while the map it was driving under\nran cargo in every state naming a verifier, so the suite came back green and test-driven refused\nto advance.
Nothing was changed to make the run go through. The run is the finding: four new gap-register\nrows, none patched to pass.
\nThat is the whole reason to dogfood. A run engineered into a pass measures the engineering.
\n/lab executes the synthesised billing realization as WebAssembly over its real boundary —\ndeterministic, asserted outside a browser, and a page without a module says so instead of\npretending.
Written retrospectively from this release's CHANGELOG.md section and its annotated tag; no\nre-run command output.
Everything before this release answered questions. This one walks a workflow — and the design\nof it was argued out and corrected before any of it was written.
\n\nThe driver's six open architecture questions became taken decisions, and an adversarial\nfeasibility review judged every one against the code: 23 confirmed, 14 needs-change, 3 infeasible.\nAll seventeen corrections were applied before a line was built.
\nSeventeen corrections is what a design document costs when somebody is genuinely trying to break it.\nPaying that before implementation is the whole argument for having the document.
\naep-driver-spec and aep-driver, with step maps under drivers/.protocol drive walks a workflow on evidence alone, and blocks with the engine's reasons\nverbatim. Not summarised, not re-worded — the driver is not allowed to become a second place\nwhere the meaning of a refusal is decided.development.driven profile — the only one that grants a shell, and it is held to the\nprotocol CLI by the driver's own per-call policy.env.tool_available as the fiftieth trace expectation kind.protocol workflow render, drawing a workflow and its live run in four formats.Gates are evaluated only by the engine. The driver asks and does what it is told. A driver that\ncould evaluate a gate would be a second protocol implementation, and the two would disagree —\neventually, quietly, on the case that mattered.
\nAlso in this release: the repository begins planning itself in .engineering/.
Written retrospectively from this release's CHANGELOG.md section and its annotated tag; no\nre-run command output.
Two waves in one release, and they are the same idea applied twice: take something that was prose\nand make it a typed thing a program can refuse.
\n\nPlanning artifacts live in the repository as markdown under .engineering/planning/, and are\nmoved only through lifecycle-validated CLI verbs. The consequence of choosing markdown over a\ndatabase is concrete: the diff of a status move is one line, and git log already knows who made\nit.
A Claude Code plugin — one skill, two agents, no hooks at this point — teaches the store's rules\nand discovers its vocabulary at use time rather than hard-coding it, so the plugin does not go\nstale when the vocabulary grows.
\nAnd a repeatable hermetic eval checks the plugin's behaviour with mechanical assertions, run\nmetrics, and an advisory adversarial review.
\nA harness transcript normalises into a content-addressed event IR and is judged against a\ntrace-spec/1 document: forty-nine expectation kinds, verdicts ok / gap / unk, exit codes\n0 / 1 / 3.
The third value earns its place here more than anywhere: unk means the adapter did not\nunderstand the event, which is a different thing from the expectation failing, and a checker that\nreported those as failures would be unusable against any harness it did not fully model.
A passing check mints trace_conformance evidence the engine admits, produced by the\ntrace-checker verifier class and fed back through protocol evaluate --evidence. That is the same\njoin as the ESS half: an observation becomes a fact a completion rule can read.
The vision's refusal of \"a workflow engine\" was narrowed to admit a reference driver — decided\nand designed, not built. A boundary that moves should move in writing, with the reason attached, or\nit looks later like it was never there.
\nWritten retrospectively from this release's CHANGELOG.md section and its annotated tag; no\nre-run command output.