Halo · steward
Your rulings
Everything you have already decided, so it does not have to be said again.
68 cardinal rules118 directives
This page LISTS your rulings. It does not verify that they are being followed — only a handful are machine-checkable today, and claiming compliance it cannot measure would be worse than claiming nothing.
Cardinal rules
10CHINESE WALL (cardinal, ABORT on cross)2026-07-10
20THE TRAIN NEVER EDITS ITSELF IN PLACE (cardinal, evolved 2026-08-01)2026-08-01
25WORK IS A DEFINED ACTIVITY, COACHED TO ITS DoD (the dev-TRAIN)2026-07-12
30TECH EXECUTION IS SELF-APPROVED (cardinal, absolute)2026-07-10
35SINGLE IMPLEMENTATION, SINGLE INVOKED (one canonical, many call-sites)2026-07-10
37MIGRATE = CHECK CALLERS, REPOINT, ARCHIVE LEGACY (cardinal)2026-07-10
40DEV-TRAIN DOWN = TL EXECUTES TO RESTORE, TOP PRIORITY (cardinal)2026-07-10
45AGENTS ARE NEVER LEFT DECAPACITATED - THE TL RESTORES IMMEDIATELY (cardinal)2026-07-31
50CONTROL-PLANE SENSITIVE ASSETS ARE STEWARD-DRIVEN ONLY (security law)2026-07-07
60TL ONLY ENQUEUES (Temporal-only, when train is UP)2026-07-05
70RECORD EVERY MANUAL INTERVENTION LIVE (ledger discipline)2026-06-28
80ACKNOWLEDGE-BEFORE-ACT (activity-definition-first)2026-07-04
82GATE ROUTING: CODE -> PEER REVIEW, DESIGN -> HA. NO STEWARD GATE ON TECH BUILD; implement after both (cardinal)2026-07-30
90Impact-analysis-first: every change ships as ONE bundled change-package (direct + impact-radius)2026-07-19
91ACCESS IS INVISIBLE UNLESS GRANTED; PLUGINS DECLARE, THE CENTRE GRANTS2026-07-25
92ATTENDANCE IS THE ONLY ASSURANCE2026-07-25
95THE TL THUMB RULES (cardinal, steward 2026-07-30) -- five continuous conditions2026-07-30
96REPORT AND SKIP — offline supervision is not no supervision2026-08-05
97HTL IS INDEPENDENT - NO EXCLUSION, AND NOT SCOPED BY ANY OTHER CHANNEL CONFIG2026-08-05
99A CEILING IS A DESIGN DECISION, NOT AN IMPLEMENTATION DETAIL - CREATING ONE REQUIRES STEWARD APPROVAL2026-08-05
100NO UPPER LIMITS, NO TIME FRAMES - FOR ANY CHANNEL OR QUEUE2026-08-15
103THE ASSURANCE LAYER: THE ENFORCER KEEPS THE DISCIPLINE, TEMPORAL IS THE BACKBONE2026-08-15
110ONE AI LADDER STANDARD ACROSS ALL OF HALO2026-09-13
115ONE TASK AT A TIME - SEQUENCE IS OWNED, TOPICS ARE NOT2026-08-17
120ASK THE STEWARD ONLY ABOUT DESIGN - NEVER FOR PERMISSION, NEVER WAIT2026-08-18
130TIME IS DISPLAYED IN SGT WITH UTC BESIDE IT (cardinal, REFINES 125)2026-08-20
135PRECEDENT FIRST; AGREEMENT BEFORE ANYTHING OUTSIDE THE ACTIVITY DEFINITION2026-08-22
140STATUS IS STATIC. NEVER READ IT FOR PROCESSING2026-08-22
145NEVER WATCH A WORKING CHANNEL. WATCHING IS NOT WORK2026-08-22
150THE FLOW MAP IS PART OF THE CHANGE. CHANGE A FLOW, UPDATE ITS ROW2026-08-22
155"I DIDN'T DO IT" IS NOT A REPORT. SEE IT, RAISE IT, CHANGE IT2026-08-22
160FIND THE CODE FIRST. EXTEND IT AND MAKE IT CALLABLE -- NEVER WRITE THE SECOND COPY2026-08-23
165ASKS INTO THE TODO FIRST. THEN EVERY TASK DESCENDS THE CHAIN: REQUIREMENT -> SPEC -> FSD -> TSD -> TASK -> TEST CASES -> USER GUIDE; NOTHING SKIPS IT, AND A BREAK MID-CHAIN IS RETRO-BUILT WHOLE2026-08-29
170THE TRAIN NEVER STOPS; IMPROVEMENTS ARE RINGS. ONE MOVING PART PER WINDOW, CANARY CLOSES, CANNOT-CLOSE ROLLS BACK2026-08-30
175NOTHING OUTSIDE THE CAMPAIGN TABLE IS BUILT BEFORE TENANT #1 PAYS; EXCEPTIONS ARE ROWS, NOT WORDS2026-08-30
180ONLY mode=auto SELF-SEEDS; mode=you IS THE STEWARD'S; A QUIET QUEUE IS MEASURED BEFORE IT IS CALLED BROKEN2026-08-30
185A HALT LIVES IN THE CLAIM PATH OR IT IS NOT A HALT2026-08-30
190APs BUILD; THE TL FACILITATES IN BOUNDED SCAN-FIX-DEPLOY CYCLES; KERNEL BUILDS NEED DURABLE CLAIMS2026-08-30
195THE STEWARD OWNS THE DESIGN PRINCIPLE; THE TL TAKES THE TECHNICAL CALL AND RECORDS IT; ASKS TO THE STEWARD ARE PRINCIPLE OR PO QUESTIONS ONLY2026-08-30
197The TL directs; the tenant channels do the tenant work2026-08-30
199SHIPPED MEANS TRACKED - every change that ships lands its chain rows; reground surfaces the debt2026-08-31
200NEVER WAIT FOR SOMETHING TO HAPPEN - DROP A WATCHER AND PROCEED2026-09-01
201NEVER MONITOR A LANDING - it is wastage of effort, money and time2026-09-03
202HEALTHY MEANS DRAINING - anything starved, clogged, stuck, or repeating is UNHEALTHY2026-09-03
204CONTROL CODE IS NAME-BLIND - participants are rows, never literals2026-09-03
205No seat sleeps - ticks are reminders, not wakeups
206A found issue is RUSHED to claim and fix - never narrated, never rosy; THE FIX WALKS TEN STEPS: notice, inform, claim, investigate, dig OneBrain, sort the design, B->M->S->P, then the triad / trimon / document-chain deltas2026-09-03
207NO CODE IS COMMITTED WITHOUT REVIEW - URGENCY IS NOT AN EXEMPTION2026-09-04
208Every failure is LOUD - a hidden failure is not a handled failure2026-09-03
209NO HALO MECHANISM NAMES A TENANT - READ THE TENANT CONFIG AND LOOP2026-09-04
210A CONTRACT IS AGREED BEFORE IT IS BUILT - review is not a post-implementation formality2026-09-04
211A QUEUE IS A CAPSULE AND A CHANNEL IS A CAPSULE - nothing implements their behaviour outside them2026-09-05
212EVERY COMPONENT KIND IS A CLASS AND EVERY COMPONENT A VIRTUAL INSTANCE (*-a-c) - behaviour lives on the class, never on an instance, so a component stays atomic and can be dragged and dropped2026-09-05
213THERE IS NO I OR MINE IN HALO PLATFORM - a seat holds custody, never ownership; work, claims and artefacts belong to the platform2026-09-05
214TEMPORAL FEEDS THE ESTATE AND SEATS ACCEPT THEIR DELTA VIA THE DOORBELL - the ledger is written, never polled2026-09-06
215NO DB CHANGE UNTIL HA CONSENTS - THE CHANNEL DRAFTS AND SELF-VALUATES FIRST, THEN HA2026-09-06
216THE DOORBELL IS MANDATORY AT REGROUND - A SEAT NOT LISTENING IS NOT GROUNDED2026-09-06
217HA APPROVAL RELEASES IMPLEMENTATION - ASK THE STEWARD FOR DESIGN, NOT PERMISSION TO BUILD2026-09-06
218CAPSULES IN CONTAINERS ON TEMPORAL IS ALWAYS THE DESIGN - every change names its capsule part, its container part and its Temporal part2026-09-06
219STAGING-FIRST DISCIPLINE - NO DEV IN PROD; STAGING ALWAYS TRACKS OR LEADS PROD2026-09-06
220THE CONTROL PLANE VALIDATES ITS NEXT VERSION IN ISOLATION BEFORE BECOMING THE LIVE BUILDER2026-09-07
221NEVER BYPASS PROCEDURES: BRANCH -> MAIN -> STAGING -> PRODUCTION; ALWAYS TCC2026-09-07
222DIG ONEBRAIN BEFORE ANY CODE - read the history until you can say what exists and why; only then write new code or change existing code2026-09-08
223NO PRESSURE BYPASSES A DEFINED PROCESS; A STEWARD OVERRIDE IS CONFIRMED TWICE2026-09-08
224NO DECODEABLE HALO COMPONENT IN A TENANT BOX - ONE GO BINARY, ONE CONTAINER2026-09-15
225AI is never down: a no-slot is a named rung defect, read from the walk2026-09-15
226The TL never waits for the steward on tech: HA clarifies the step, the TL goes; only DESIGN waits2026-09-15
227TL: EVERY INFERENCE AND EVERY SOLUTION IS DOUBLE-CHECKED BY DIGGING DEEP INTO ONEBRAIN - do not assume, do not infer; confirm a second time before concluding or building; never rediscover the wheel2026-09-15
Directives
D-100Test management & authoring
D-101Documentation as a DB-backed component
D-102Adopt, do not invent
D-103Best-practice north star
D-105Steward-silence idle rule. When a developer queue drains, the channel posts a top-of-Live-status ping in the same loop iteration the queue drains, then STOPs and waits
D-106USE box-saturation gate
D-107Evidence-based Definition of Done
D-108D-31 autonomous-train mapping
D-109No-hardcode scripts (extends D-39 from plugin Settings to ALL scripts: fleet, orchestration, infra, CI)
D-110Control-plane on the flow protocol (strangler-fig)
D-117Telemetry infusion -- observability is a build discipline (extends #37 obs-standard): instrument AS built -- RED metrics halo_<component>_<noun>_<unit>, traceparent across seams, trace_id in hpf_event; no telemetry = gate fail; dashboards/alerts as code.
D-118Verification-by-construction: presence SCANNED; tested DECAYS (last-green vs HEAD); quality MEASURED (MSI + escaped-defect, not coverage-%); evidence SIGNED (Ed25519). hpf_pillar_ledger machine-only -- no hand-written row; gate reads it; done un-fakeable.
D-119Single build executor: BuildWorkflow is the sole plugin-build executor; coarse-activity executors are prohibited; predecessor retirement is EVIDENCE-GATED, never by decision; enforcement OPEN until the step-6 stale-pointer reconcile check runs.
D-120Directives/requirements-as-data: instructions arrive as hpf_req rows (not standalone files); Definition-of-Done lives in the acceptance column; the review surface is the hpf_req export diff, not the original file.
D-121Emit-intent-before-act; fail-closed recording; break-glass is itself evented; one recording surface
D-122Impact-radius alignment on every change
D-123UI anti-pattern register: ten prohibitions (fonts, tokens, contrast, scales, utilities, cascade, outline, inline code, i18n, namespaces) with named enforcing gates
D-124CyanTerra IS the ESG response for authorities
D-125UTC internally everywhere; local only at the display edge
D-126Schema width standard: no guess where prose belongs
D-127One CSS for standards - USWDS defines the widgets, the colour theme is ours, and they are ONE stylesheet
D-128AI quota is not a cause - accounts are shareable, so look at the scripts and the infra
D-129Every process answers HALT - a new workflow without a halt gate is not finished
D-130A task carries its own advice state - any HTL continues it, no seat owns an answer
D-131Every failure is loud - a caught exception that says nothing is a hidden failure, not a handled one
D-132Two capsules, no loose parts - queue and channel own their whole contract including start and stop
D-133Capsules in containers on Temporal is always the design - the capsule carries the contract, the container carries the code, Temporal carries time
D-3010-line chunk ceiling; bug-table format
D-31Build gate. No code, files, zips, or artifacts during discussion or brainstorm. Build ONLY after posting a one-line “Build Request: WHAT / WHY / which plugin → version” and then ENDING the turn. The ONLY build green-light is the steward’s direct reply app
D-32Every feature defines workflows + stages + tracer + exception handlers + granular tests at design time
D-33Smokes assert string presence only; every release worklog lists manual-smoke steps; ship contingent on steward confirming each
D-34Stable BL-NNN IDs; closed items stay in table marked CLOSED-vX.Y.Z
D-35BL-001 pre-onboarding deferred until career backlog sufficiently closed
D-36Never use steward’s name or person identifiers in any generated artifact
D-37Title Case on ALL user-visible strings; grep for violations before every release
D-39Configuration over hardcoding; every operational parameter must be a Settings option with ownership classification
D-4-CYANCyanTerra constitution clause - born wow, zero retrofit
D-40Visual regression discipline
D-41No ask_user_input_v0 picker UI; use prose with inline options
D-42Don’t defer features; bundle all reasonable additions into current release (suspended for hotfix releases)
D-43Mock confirmation gate
D-44Response length discipline: short chunks, whitespace, tables
D-45Mobile-first viewport (~380px) for all UI surfaces
D-46Consult before changing existing workflows; silent improvements are failure mode
D-47Pictorial backlog (ASCII bar chart) at start AND end of every build, with delta
D-48Zip always uses stable dirname (e.g. hashira-careers/)
D-49Base-directory inheritance check
D-51Need-to-know visibility
D-52Compat-layer pattern over wholesale rewrite
D-54Production zips exclude tests/ (zip -x "*/tests/*")
D-55The platform documentation is the single system of record: one typed node-graph, authored once, read many ways
D-56Single-source, role-projected access & docs. Author content once and tag elements with the role(s) they serve; the renderer projects the role-appropriate slice (untagged content is shared)
D-57Keep the records in sync
D-58Tests live in the plugin and grow progressively. Co-locate each feature’s tests in the plugin’s tests/ as it is built and commit them with the feature, so the regression suite accretes alongside the code (stripped from prod by D-54). Target end-state (to
D-59Confirm the repro before investigating. When a defect is reported, first ask for the exact sequence of actions that produced it; restate that sequence and get explicit confirmation before forming any root-cause hypothesis or touching code. A one-line symp
D-60Cross-file invariant gate
D-62Architecture and portability
D-64Tech-debt is first-class backlog
D-66Documentation quality and diagrams
D-67Definition of Ready and Done
D-68Data ownership by layering. Every datum has exactly one owner; mutation only through the owner’s exclusive API (no plugin writes another’s table). Ownership follows layering: a datum handled by two or more functionalities in the same tier sinks one tier d
D-69Tenant scoping. Every tenant-owned datum carries account_id (NOT NULL); identity records also carry principal_plane. All reads and writes go through the owner’s port with an injected account context; the adapter applies the account_id filter (extends D-62
D-70Principal planes. Three planes
D-71API and contract versioning
D-72Structured logging and correlation id
D-73Seam contract tests. Each plugin ships consumer/provider contract tests for its cross-plugin seams
D-74Health hook and env-config
D-75UI engine and device neutrality
D-77Resilience on cross-boundary calls
D-78Single-source, event-driven, drift-gated documentation. All platform documentation generates from ONE source
D-79Forward-seam discipline. When an earlier-milestone build sits on the path of a later capability, leave the later seam in NOW
D-80Module-wise entitlement. Access to a product or module is gated by a single Entitlement contract
D-81Authorization backbone (role · read-lens · separation-of-duties · request flow). Access is governed by one model: a canonical role roster per plane (platform / account / end-consumer); a read-lens axis kept strictly separate from the grant axis
D-82Control-register schema and activation rule. Every directive that functions as a control carries five fields: Owner, Enforcement gate (the named hook that blocks ship), Evidence artifact (what it emits), Policy-ref (the Hashira policy clause it honours),
D-83Evidence by construction (EVD). Assurance is earned by continuous, attributable evidence that controls operated
D-84Data lineage and deterministic recompute (LIN)
D-85Segregation of duties and change control (SOD)
D-87Extended test-pillar model (t9 to t13) and tests-as-evidence
D-88UI Standard and Definition of Done. Every UI-bearing surface meets one standard: (1) Accessibility is law, not preference
D-89Four-DoD governance and the 4-Dimension audit work-order. The platform ships under FOUR Definitions of Done, each a gate-checkable checklist: Testing (D-67 + the t1–t13 risk-based pillars D-87, as evidence D-83), UI (D-88), Documentation (D-67 applied to
D-93AI is platform-core; fail-closed; per-tenant keys floor; tiered isolation. The AI layer (AIG authority · AID engine · AIX shim · shell enforcement) is platform-core. Fail-closed: if AIG is unreachable no stamp mints, so no model runs (AI degrades to manua
D-94External model use & the learning boundary. External (cloud) model use requires per-request consent and is trial-only where the provider terms permit training on submitted data. Routing is tier-scoped
D-95Build-conformance & clearance gate (AIB is executional, DB-authoritative). The directive register is enforced from an authoritative database (the hashira_aib control register on the DevOps-VM MySQL), not a file the SDK reads: each directive carries a chec
D-96Federated workflow engine (process-motion authority). Cross-plugin process motion is declared once and consumed twice
D-97Dual admin surface (admin-as-adapter) + the settings & audit hosts. Every admin/config capability is UI-as-adapter over a single settings-port, surfaced in BOTH the portal-admin host (canonical, cloud-native, gated by the Access read-lens / canonical rost
D-98Component & Field UI Standard. Below the token layer (D-63) and the UI Standard (D-88) sits a component / field / table / layout standard
D-99Dev-train protocol layer
D-CAPTUREEvery instruction captured and routed -- orphans impossible
D-MISSIONCyanTerra is the ESG authority response -- the mission, on record
D-UI-1Semantic palette - color encodes state, never decoration
D-UI-10Intelligence gets a socket
D-UI-2Urgency must be visible at distance
D-UI-3One hero per screen
D-UI-4Zero is a state, not an absence
D-UI-5Rows carry faces and actions
D-UI-6Controls are a surface, not a cloud
D-UI-7The page speaks - including good news
D-UI-8Accessible by construction (LAW, legal floor)
D-UI-9Waiting is a designed state
D-UTCUTC is the only ledger truth; timezone is display only
D-WIDTHColumn-width standard -- no column silently truncates its data