Plato · genome roadmap extension · draft v2.1 for Robert's red-pen · 2026-07-04 · v1 graded 7/10 → folded → independently re-graded 8.5/10 → those five findings folded same day

The Fabric Arc

The substrate of the agentic development lifecycle — from code wires to business wires, so that every projection above it can be trusted.

The frame: SDLC → ADLC

Every institution in the old software development lifecycle exists to manufacture trust between humans — code review, standups, requirements docs, QA phases, onboarding, postmortems. All of it is trust-manufacturing overhead, and it was worth it because trust was scarce.

The agentic lifecycle's defining fact: generation became nearly free; trust didn't. Velocity is now rate-limited entirely by wherever trust is still hand-made. The answer is a substrate where work secretes its own proof, so trust is read off the artifact. Every institution dissolves into a query:

code review → claim adjudication  ·  meetings → the shared world model  ·  requirements docs → leased intents
QA → gates as facts  ·  onboarding → born-knowing  ·  postmortems → history at a pin

One genome, many projections. A projection stops being an artifact you maintain and becomes a query you run — provably current, or wearing its staleness. You never update the docs again; you regenerate them. It's the same inversion DE sells practices, applied to ourselves, all the way down.

The value spine — three consumers that create real velocity

1 · The adjudicator — kill the verification bottleneck. The human saying "this is actually done" is the ADLC's rate limiter (the 30/70 theory). Every "done" arrives as a claim card — verdict + receipt + scope + currency — so adjudication collapses to reading evidence and spot-checking fences. Measured, scoped: hardened receipt experiment, un-graded condition, median of 3/arm — receipted claims verified in 268s vs 633s naked (2.4×), 17 vs 34 calls (2.0×), median crossing; zero blind trust in every arm of both runs; under grading pressure the advantage flattens (the honest limit). First build: Robert's morning projection — five cards, ninety seconds, zero re-derivation. Task #28; ships on existing substrate, parallel to the arc.
2 · The fleet — the genome as coordination bus. Workers read the genome at birth (born-knowing, proven cold), deposit facts with receipts, lease intents so duplicate work and tramples are structurally impossible. Fleet size stops multiplying lead attention. This is what replaces the meeting — least-built of the three; needs #1's substrate trustworthy first.
3 · The planner — kill wrong-frame builds. The ADLC's most expensive failure isn't a bug; it's a whole build against the wrong frame (17 patch-cycles once; three plans this month each the surface of a deeper one). The intent ledger + banked frontier scans + killed-ideas, queryable at spec time. Today's review proved it involuntarily: v1 called shell extraction "greenfield" while the parser sat in our own repo.

The story (what the fabric adds)

A practice raises its vaccination price. Today that truth gets re-remembered into a dozen places by hand; most go stale; nobody can see it, because no map holds the wires between a fact and the surfaces that project it. We already built the engine that holds wires honestly — proven edges, receipts, currency pins, fences that say "I can't see here, and here's exactly how to look" — and proved it on code imports. A real consumer (the neuron session) then showed the limit and the road: the catch that mattered lived in a second wiring language the map doesn't read. The arc makes the map sighted, dialect by dialect, until the dialect is business truth.

The arc in one sentence: generalize the wire engine from "who imports this file" to "who consumes this fact" — proven on code, hardened on shell, landed on a practice's truth — so that every projection above it can be trusted.

What I decided and why

Proves-or-fences — no third class. v1's "heuristic edge" is deleted (review catch: it contradicted the engine's own never-lie floor, and no dialect would ever have produced one). Everywhere in the fabric: a proven edge, or a named fence carrying enumerated unproven doors. A guess never travels as a wire.
Extracted, never invented — and the extraction is real. Retrofit the existing import + C# engines to the contract with zero behavior change, proven against a commit-pinned baseline. Then move 2 lifts the shell parser we already built (it serves a gate today, with its interpolation fences) and rewires it into the contract. Rewire, not greenfield.
Shell before business, for a stated reason: business projections are a mix — generated surfaces are provable, hand-authored/legacy/external can only be fenced. Shell is the cheap rehearsal of exactly that proven+fence coexistence, on wiring we can hand-label to verify precision.
The business dialect has a mechanical spine. A proven projection edge is a recorded fact→slot build binding (the generator read fact X into template slot Y at pipeline pin P — Neuron's build receipts, ratification 7). A page that merely agrees with a fact is fenced, never proven — agreement is not derivation. That makes move 4's kill concrete and immune to motivated reasoning.
Sequencing, corrected: move 0 starts now, in parallel with the hosted-world token wait — only move 5 needs the hosted acceptance. The C# over-fence fix (adversary-confirmed today) lands before move 1, so the retrofit baseline is the fixed tree.

What this unlocks

Near — this arc ships:

Change becomes safe at the business layer. Before a fact changes, see every surface it touches; after, every stale projection lights up, receipted. Staleness goes from the web's invisible default to detectable, fixable, billable.
The truth-PR substrate. Your ratified product shape — propose → verify → owner approves → propagate with receipts — needs exactly this: forward-reach from a fact plus currency pins IS the machinery that makes a truth-PR's blast radius computable. This arc builds the precondition for GitHub-for-business-truth.
Business-layer orphans. An orphaned fact = truth you pay to maintain that no surface projects (waste). An orphaned surface = a claim no fact backs (the naked-assertion liability). Same graph, both directions — completeness co-equal with currency, as always in this engine.
Inverse audit — answer provenance as a product. Given a Fides answer, every fact it rests on, with receipts and currency at that pin. The liability shield's actual mechanic, named: what did we know, when, from where.
The reads plane becomes a demand oracle. Which dozen facts drive most of what agents say about a practice — verification effort, update priority, and pricing follow measured consumption.

Horizon — enabled by this arc, shipped later (honestly labeled):

Drift detection on surfaces we don't own (the Google listing says $40; the fact says $45) — lands when external-surface dialects land; this arc fences external surfaces rather than pretending to read them.
Fleet-wide change receipts — one shared-fact edit across many practices with per-site conformance receipts: Stage 4 of the roadmap, for which this graph is the substrate.
The provable source wins the citation — the public agent endpoint as source of record: fact + receipt + currency + derivation.

Your calls

1 · Ratify the arc and name it. Working name: the Fabric Arc. Yours to rename for what it holds.
2 · Confirm the sequencing — with its real cost stated: this displaces the 5×-demo iteration, which was the queue's only economic-proof leg. The fold: move 4's acceptance now carries an economic number (cost-to-detect-staleness via fabric vs. a manual audit of the same practice), so the proof relocates instead of vanishing — and the owned 5×-demo baseline stays runnable as a cheap parallel track if you want a published number sooner. Confirm this trade or re-order.
3 · Confirm dialect #3 is practice truth (not Makefiles/configs) — now with the mechanical spine: proven projection edges = build-lineage bindings; agreement-without-binding is fenced.
4 · Confirm the first projection build: your morning surface — five claim cards, your calls flagged, ninety seconds. Ships on existing substrate, parallel to the arc, and becomes the daily proof the ADLC frame is real.

The moves

  1. Frontier scan + contract spec — starts now (no dependency on the hosted world). Name the problem class abstractly, check how the field solves it, and inventory our own reusable machinery first — the review caught v1 missing a parser we'd already built, by not consulting our own graph. If an adoptable standard exists, adopt instead of invent (this move's kill switch).
    ↘ go deeper — the machinery
    Problem class: multi-source dependency graph with per-edge provenance and epistemic labeling. Field scan: code property graphs (Joern), Bazel build graphs, SLSA / in-toto attestations, SPDX / CycloneDX SBOM, OpenLineage. Cite-or-shut-up; lead grep-verifies. Anti-pattern hunt: universal-graph platforms that died of generality. MANDATORY internal leg: plato_reach_graph / plato_change_brief over this repo — confirmed reuse so far: ci-invocation-graph.mjs (CI/npm/make/shell parsing + interpolation fences), runner-completeness.mjs, broken-chain-hunter.mjs, value-flow-edge.mjs + flow-blind-axis.mjs (the proves-or-fences floor and the UNPROVEN-door model the contract adopts). Completeness-claim audit for the contract itself. DONE: frontier brief + contract spec graded ≥8 by a non-author.
  2. The dialect contract, proven by retrofit. Formalize what every dialect supplies: proven edges with receipts, named fences with enumerated unproven doors, declared blind axes, and falsification fixtures that can go red. Retrofit the existing import and C# engines with zero behavior change, proven two ways — the full gate green at a commit-pinned baseline, plus a mechanical differential: the retrofit must emit byte-identical edges and fences on a fixed corpus (the integrity gate alone can't see output drift). If the retrofit forces a behavior change, the contract is wrong; redesign the contract, not the repo.
    ↘ go deeper — the contract shape
    DialectExtractor: id · edges(pin) → ProvenEdge[] {from,to,kind,receipt:{file,line,quote}} — emitted ONLY when provably real · fences(pin) → Fence[] {axisId, at, doors:[{to?,why}], grepPattern} · blindAxes() · fixtures {mustFire, mustNotFire, deliberateBreak} (gate-run; a dialect that can't fail is vacuous and doesn't merge). No heuristic edge class exists. Pre-condition: the C# over-fence fix merged; baseline pinned by SHA. DONE: gate green on retrofit; dialect id + receipts visible in a served brief.
  3. Shell dialect — extract, don't build. Lift the invocation parsing + interpolation fences from the CI-graph gate machinery we already run, and rewire them into the contract, feeding the reach graph. CI run: lines and literal script invocations become receipted edges; anything interpolated stays a named fence with a prescribed grep. Acceptance is neuron's night re-run: "who consumes the CI wiring-checker" answered from the map.
    ↘ go deeper — proven vs fenced, and the kill
    PROVEN: workflow YAML run: lines invoking committed paths; literal sh|bash|node|python <committed-path> in committed .sh and package.json scripts. FENCED (SHELL_DYNAMIC, with doors where derivable): $(), backticks, eval, xargs, find -exec, computed-$VAR — the already-enumerated FENCE_PATTERNS. Declared blind axes v1: Makefile recipes beyond the sandboxed resolver, cron/launchd plists, Dockerfiles, CI matrices, sourced chains. Adversarial pass tries to mint a false PROVEN edge from an interpolated invocation — any success is gate-red. KILL: any false PROVEN edge on the hand-labeled sample → ships fence-only until precision is fixed. Both fence directions get deliberate-breaks (this week's C# over-fence is the live scar for the second direction).
  4. Cross-dialect reach with localized honesty. One blast-radius query walks all wire types. A chain is proven end-to-end only if every hop is proven; a fence doesn't smear a vague "downgraded" stamp over the whole chain — it breaks it into a proven prefix plus a named gap: "proven to hop 3; hop 4 is an interpolated path (grep prescribed); proven after."
    ↘ go deeper — the calculus and its kill
    Per-hop dialect id + edge|fence-door status in claim cards. Deliberate-breaks both ways: a fence-door rendered as proven = red; a clean chain rendered with a phantom gap = red (no-cry-wolf). KILL (new in v2): if >50% of chains on the labeled sample render so uniformly that a labeler can't rank chain trust from the rendering alone, the rendering is redesigned before shipping — the banner-blindness defense.
  5. The first business dialect: Neuron fact → surface projection. A proven projection edge is a recorded fact→slot build binding — the generator read this fact into that template slot at this pin (Neuron's build receipts). A surface that merely agrees with a fact is fenced, never proven. Acceptance is the opening story, walked, with a number and a defined comparator: the manual-audit baseline (an agent finding every surface the fact appears on, no fabric tools, median of 3, wall-clock + tool-calls) is recorded before the move ships; then change one real fact, the fabric lists every stale projection with receipts, and detection cost is measured on the same unit. The iterate ladder ports from the 5×-demo: under 2× publishes anyway, 2–5× iterates with named levers (three attempts max), 5×+ is the headline. Either way a number ships.
    ↘ go deeper — spec discipline and the honest kill
    Spec is Fable-authored L1 at move start; builds on the Neuron adapter v0 + ratification 7's build-lineage receipts {pipeline pin, input hashes}. External surfaces (GBP etc.): fenced axes v1, honestly out of scope. KILL: no fact→slot binding recorded in the pipeline ⇒ provenance too thin ⇒ STOP; file upstream requirements (what Neuron must record); the arc still lands moves 0–3 as shipped product. We never ship decorated guesses. Absorbs the practice-fiber thread — the fiber IS this move's spec.
  6. Hosted queries — the only move gated on the hosted-world acceptance. Cross-dialect reach served over the standing world (daemon + Fly), auth and read-only-for-truth intact, claim-carded, recorded in reads.
Parallel track (not a move of this arc): the morning projection. Adjudicator v1 — claim cards for open workstreams + flagged calls, one surface, walked against your actual mornings. Rides existing substrate; no fabric dependency; task #28, full user-facing gate set (walk script · composition gates · walk-audit on your real device). Done = five cards render with receipts + currency, leases nearing horizon surface, and it survives one real morning of your attention. Kill = the read exceeds ~2 minutes or you stop opening it — then we iterate on the walk, not the plumbing; two failed iterations and it parks, said plainly.

What could go wrong

The abstraction tax. Contract extracted from two working dialects plus a third parser being rewired, not written; every move independently rent-paying; kill criteria per move.
One false PROVEN edge poisons everything. Proves-or-fences everywhere; per-dialect adversarial pass tries to mint one (interpolated shell invocation; agreement-without-binding at the business layer) — any success is gate-red.
Over-fencing, the mirror. Live scar this week: the C# path swept 30 real consumers into blind-spots — fixed, adversary-confirmed, lands before move 1. Every dialect gate carries deliberate-breaks in both directions.
Banner blindness on chain labels. Long chains almost always contain a fence somewhere; a bare "downgraded" stamp would soon be ignored. Labels are localized and information-bearing — never a bare downgrade — with a measured kill criterion.
Neuron's provenance is too thin. Move 4 stops and files upstream requirements; the arc still lands moves 0–3 as shipped product.
Dialect rot. Self-declared blind axes + falsification fixtures that can go red, gate-run; a dialect that cannot fail does not merge.

How we'll know it works