Plan · v1 draft · opened with frame-fitness · for red-pen
The change-brief, the first verdict, and the ranked map
The next three increments on the trustworthy wiring-map — Move 1 (a pre-edit brief an agent reaches for instead of grep), Move 2 (the first time Plato renders a verdict, not a description), and the time axis (a flat blast-radius of 40 becomes the 3 edges that matter). Each ruler verified against the field before a line is planned.
Frame-fitness done & lead-verified · not approved · no building yet
The one fact that reorders everything:Move 2 is a GATE; Move 1 is a TOOL. A gate is consulted whether or not an agent chooses to call it — so Move 2's value doesn't depend on the unrun demand bet at all, while Move 1's depends on it entirely. That's the spine of the sequence below.
01
What the frame-fitness scan settled
The field's default + strongest alternative + the anti-pattern of our pick, cited. The two load-bearing claims were grep-verified by me against the sources.
Move 1 · the brief
A sealed, fenced, token-bounded composite — not a wrapper
The field's own direction (Anthropic just-in-time, Aider's ~1k-token signatures-not-blobs map) says a fused brief earns its place ONLY if it carries what the loose calls can't: a currency-proven, fence-carrying composite. Aider/Cody/LSP all fail open — no proof it matches HEAD, no way to say "I can't see this edge." That gap IS our brief.
Move 2 · the verdict (the moat)
CANNOT-CERTIFY is genuinely ours alone
Verified from sources: ArchUnit, dependency-cruiser, import-linter, NetArchTest are ALL binary — none can say "I can't certify." dependency-cruiser, for a dynamic import, "won't be able to determine what dependencies they're about" → it returns a false HOLDS when a boundary is crossed by an edge it can't see. Plato's three-valued verdict bound to its fence is the differentiator no one has.
Time axis · a real reorder
Static centrality FIRST, temporal co-change second
The obvious pick was temporal (churn/history). Checked harder, the field says lead with static graph centrality: a pure fact about the current graph — zero new lie-axis, no history window to tune, computable today — and it catches the never-edited high-fan-in hub that history-weighting misses. Temporal is real but is Plato's first inferred relation — it comes second, fenced.
02
The never-lie floor each increment must re-earn
Each new question re-earns its fence (proven twice already: silent-0 → inbound fence; confident-orphan → deleted tier). The new lie for each here: Move 1 — aggregation-laundered false-clear (fusing fenced answers into one "trustworthy: true" no single answer asserted) → never roll up to one green bit. Move 2 — a boundary crossed by a fenced edge reads HOLDS → HOLDS requires no-forbidden-edge AND no-fenced-edge-in-scope. Temporal — the phantom edge (co-change minting a dependency the parser never saw) → temporal is a separate labeled relation, never an edge, never enters the graph.
03
The sequence — and why this order
Static centrality first.The smallest, today-able piece: rank the graph Plato already pins by centrality. Pure fact, zero new fence, and it makes the brief AND query #1 immediately better (ranked, not flat). The foundation everything else uses.↘ go deeper
Weighted PageRank over snapshot.getEdges() (+ betweenness as a "bridge" lens). Pure src/graph/ function, reuses the reach adjacency. Labeled "structural centrality," never "importance" (runtime importance is the parked axis). Gate: determinism + a hub-outranks-leaf control.
Move 1 second — welded to the demand test.The centrality-ranked brief, shipped WITH the instrumentation that finally answers the unrun bet: on a real Neuron edit, does the agent call the brief or grep — and when it greps, why? The existential falsify, run as a byproduct of building, not deferred a fourth time.↘ go deeper
Signatures+pointers, ~1k token budget, centrality-ranked truncation, fence at the START/END (lost-in-the-middle is real). Per-constituent currency, never one rolled-up bit. The composite must beat sum-of-primitives (else ship primitives). Demand metric = call-rate vs grep-rate, counts+tool-names only (no content).
Move 2 third — the demand-independent moat.The verdict that gates a commit regardless of whether anyone reaches for Plato. Highest validated value, lowest demand-risk. State one rule, get HOLDS / VIOLATED / CANNOT-CERTIFY in CI.↘ go deeper
Verdict reified: {HOLDS | VIOLATED(edges) | CANNOT_CERTIFY(blind_class, fenced_edges)}. CI: VIOLATED→fail, CANNOT_CERTIFY→fail-closed-distinct-signal, HOLDS→pass. HOLDS needs no-forbidden-edge AND no-fenced-edge-in-scope (bind to the existing fence). Forbidden from→to rule shape (dependency-cruiser-familiar). Guard the change (reuse query #2), not just the snapshot.
Temporal overlay last (phase 2).Co-change / hotspot history, only after the static lenses prove out, behind the phantom-edge fence. Kill-before-build test: compute centrality and temporal together once — if they agree on the top-K, ship only centrality.↘ go deeper
Separate labeled relation ("historical co-change — NOT a code dependency"); weights/annotates parser edges or an explicit overlay; never an edge, never in the graph. Min-support + tangled-commit awareness; "hot" = a fact about the past, never a prediction. Built on build-at-any-pin (query #2), each pin self-proving.
04
Your calls — the red-pen targets
C3 ★
The real strategic call: which risk to de-risk first.
Sequence as listed (centrality → Move 1+demand → Move 2 → temporal) tests the thesis first (is anyone reaching for Plato). Pull Move 2 ahead and you de-risk value first (the moat ships, demand-independent). Centrality-first is fixed either way. Recommend: as listed — but this is your call.
C1 ★
Weld the demand measurement into Move 1?
The brief's whole justification is the demand bet; building without measuring is the fourth deferral. Cheap (call-rate vs grep-rate on one trajectory). Recommend: weld it.
C2
Accept the time-axis reorder (centrality first, temporal as a fenced phase-2 overlay)?
Field-correct, simpler, today-able, catches the hub history misses. Delivers the ranked-map goal sooner; true temporal comes second. Recommend: yes.
C4
Where does the Move 2 gate live first?
Plato's own CI (dogfood, one declared rule), or a Neuron boundary rule? Recommend: dogfood first, Neuron second.
05
Honest risks
The demand bet comes back null
Agents grep even when the brief is present and correct → adoption is a HARNESS problem (mandate the call), not a Plato-quality one. Move 1's instrumentation surfaces this early + cheap. Move 2 is unaffected (a gate isn't reached-for).
Conformance rules rot
A baseline that never drains, or a rule guarding a non-rule (our store/cache scar). Mitigation: few, human-declared rules; a CANNOT-CERTIFY is never silently ratcheted to HOLDS.
The temporal phantom edge
Co-change minting a dependency the parser never saw — the cardinal sin. Structural mitigation: temporal never enters the import graph, never becomes an edge; min-support; "hot" is past, not prediction.
Aggregation-laundered false-clear
A fused "trustworthy: true" no constituent asserted. Mitigation: never one green bit; per-constituent currency/fence, positioned at the brief's edges.
06
How we'll know it works (the falsifiers)
Centrality— top-K central nodes match a human's "load-bearing" read; centrality vs temporal computed together once — if they already agree on top-K, temporal is redundant and phase 2 dies before we build it.
Move 1 (the existential one)— measured call-rate vs grep-rate on a real Neuron edit. Reach-for-brief with low false-positives = bet alive; grep-always = harness problem, surfaced cheaply.
Move 2— planted violation → VIOLATED; clean → HOLDS; boundary crossed by a fenced edge → CANNOT-CERTIFY, never HOLDS. Break (drop the fenced-in-scope check) → the violation reads HOLDS → RED.
07
Frame-fitness evidence (lead-verified)
Canonical source: docs/ai/SPEC-move1-move2-timeaxis.md (Layer 1 wins). After your red-pen, each increment runs its own build sequence; verify/adversary workflows go worktree-isolated (the query-#2 parallel-checkout scar).