28. Workflow

Spellweaver keeps the score through motion, pause, and return.

Decision

Spellweaver is LychD's single logical workflow jurisdiction; Weaver remains its short, code-facing name and the compatibility spelling used by existing paths.

Spellweaver owns validation, registration, routing, logical dependencies, Gates, schedules/overlap, revision continuity, and contribution. Composition owns domain judgment. Product owns its customer promise, supported-use-case catalogue, packaging, and defaults, but none of its members' records, policy, secrets, consent, or effect authority. IAM/Ward/HitL own authority; Dispatcher capability; Orchestrator readiness; Workers delivery/retry; Phylactery/Graph stores and checkpoints; Riddle evaluation; Soulforge promotion.

Spells, Scrolls, and casting

The mythic grammar is exact: a Scroll is one immutable workflow score; each semantic station is a placement of a Spell; a casting performs that Scroll inside one admitted Invocation and its Circle. These names do not create duplicate schemas or let imagery replace engineering identity.

A Spell is the smallest independently named, discoverable, teachable action at the workflow boundary: ask an Agent, anonymize material, await consent, write an artifact, delegate work, or send through a Portal. “Smallest” is semantic, not mechanical. Its implementation may involve model calls, tools, syscalls, retries, or adapter machinery. An internal operation becomes another Spell placement only when the Scroll must independently type, route, authorize, checkpoint, retry, inspect, or recover it.

The Spell contract defines typed input, output, errors and non-completion; semantic requirements; authority and effect demands; and continuity obligations. A provider-owned Spell implementation claims to realize one exact contract revision and has separate code, package, adapter, provenance, checkpoint, and evidence identity. A Spell is not an uppercase Dispatcher Capability, tool, Agent, credential, grant, Python type, or live handle. Its name requests a bounded action and grants no power to perform it.

A Scroll declares its placements, edges, entry, termination, configuration, budgets, requirements, and authority/effect/privacy ceilings; receiving the artifact conveys none of that authority. Each placement names an exact authority-qualified Spell contract revision and digest. A receiver-owned, immutable Resolution Lock binds it to an exact local implementation, adapter, code/artifact, Agent/Posture requirement, tool/effect contracts, checkpoint codec, and registry generation where needed. The Run pins both the Scroll snapshot and Resolution Lock digest. Contract identity, implementation identity, and placement identity never substitute for one another.

A one-Spell Scroll is valid. A larger workflow or batch is simply a Scroll with several placements; the same Spell may appear more than once under distinct placement identities and bindings. This uses the existing workflow identity rather than inventing another batch object.

Admission distinguishes parseable, contract-conformant, locally bound, available, authorized, and admissible. A claim at one level proves none of the later levels. Unknown, unavailable, incompatible, revoked, or unauthorized placements block casting; no similar name, version range, provider, or newer revision may be substituted. A future Loom may render an inert resolution report with grey placements and redacted reasons, but such a view is not an executable Graph.

The current fixed manifests expose station key, label, kind, one workflow-wide implementation closure, and edges, with each executable station bound one-to-one to a Python Graph node. A current station therefore behaves like a legacy inline Spell placement plus implementation binding, but it has no independent Spell identity. The runtime does not ship a Spell catalogue, Resolution Lock, portable Scroll ABI, remote compatibility negotiation, teaching surface, or package contribution store.

Policy for an unknown Spell may choose only among refusal, a request for an attributed teaching candidate, or use of an already admitted exact contract with an exact local binding. A teaching candidate is hostile foreign craft: it enters Assimilation, not the live registry. Smith may re-express it locally, but Spellweaver validates and the target owner publishes it only after evidence and authorization. Publication creates new catalogue truth and a later casting; it never mutates or resumes the refused Invocation under changed law.

Language is typed, not global

Canonical Composition, Pattern, Scroll, Spell, placement, schema, field, route, status, and event identities are locale-neutral and never translated. Human-facing labels and explanations may use versioned catalogues, but changing their locale cannot change the signed declaration, Resolution Lock, Graph topology, or Run. Frontend owns Altar locale; Vision and Audio own their media-language boundaries.

A Spell contract carries exact language or locale fields only where its semantics require them: ordered input/output preferences, original language, requested result language, permitted detection, fallback, and refusal. Translation is a separately named, attributed Spell or owner-declared transformation; it retains source and derived text, implementation revision, and declared loss. A model, engine, browser, peer, or Persona may not infer a host-global language or silently translate another station's material.

Translation does not become a freestanding Composition merely because several Patterns can reuse it. A versioned Translation Spell has an authority-qualified publisher that owns the contract's semantics and revision; Spellweaver owns registration, placement, resolution, and casting law, not linguistic truth or application acceptance. The Composition placing it retains the source and attributed derivative and owns fit for its domain.

For example, Language Edition may place Translation inside a timed-media language edition while retaining scene, speaker, glossary, timing, and localization judgment. Another application may place the same exact contract under different records and finish law without inheriting Language Edition's project or becoming part of a global Translation workflow.

Progressive finish and forward continuation

A Scroll may declare several typed finish boundaries and an exact admission-time finish policy, including a bounded interactive policy whose possible Gates and terminal routes are already in the score. For example, one visual score may permit an accepted still, an animated sequence, or a sealed visual package. Reaching the requested still boundary is successful completion of that Invocation, not a Run left in Stasis. Failing to reach a requested motion boundary is partial or non-complete according to the pinned score; an intermediate image cannot be relabelled as the requested video.

A Gate may pause the same casting for an exact review or a declared choice to continue. Live or Durable Stasis exists only while an admitted owner, capability transition, consent, or delegated result remains outstanding. Once the operator settles at a valid finish boundary, the Run becomes terminal. Later animation, soundtrack, edit, or publication begins a new forward Invocation over immutable ArtifactRef inputs and preserves the prior result.

Different prompts, source artifacts, requested language, target profiles, or a declared finish boundary are new Invocation inputs when the exact Scroll schema permits them. Different stations, edges, Spell contracts, authority ceilings, or model requirements create another Scroll revision. Several steps owned by one Composition may inhabit one Scroll; separate Composition-owned work is coordinated by a Suite through typed handoffs, never by nesting or silently resuming another Pattern.

Portable declaration

Portable SpellContract, Scroll, and TeachingBundle artifacts use versioned, restricted UTF-8 JSON. Hash and signature inputs use the pinned JSON Canonicalization Scheme; duplicate keys, non-interoperable numeric values, unknown unnamespaced fields, YAML tags/aliases/merge semantics, and source-language object construction are refused. Semantically unordered arrays define and verify their own deterministic order. Identity includes schema reference, authority-qualified name, exact revision, algorithm-tagged digest, and domain-separated artifact kind.

YAML may serve as a friendly Loom or repository authoring projection, but it must compile through the same typed validator into canonical JSON. YAML text is never portable identity and is never the signed object. A different wire encoding requires a separately versioned adapter and conformance corpus; it cannot claim byte identity with JSON.

core contract namespaces are reserved to their canonical owner. Built-in, Crypt, operator, and foreign publishers retain distinct authority-qualified identities. A private implementation may prove conformance to a public contract without acquiring its publisher's name. Learned material is private by default and preserves derived_from or implements lineage; promotion cannot squat a canonical namespace.

Current material

Fixed source registry has bridge_chat@1 (Bridge conversation, context, Agent turn, optional consent Gate, reply) and delegated_rite@1 (exact /delegate command token, reference job, Durable Stasis, result/reply). The latter proves no external coding-agent/Tomb plane. One boot-composed catalogue is shared by admission, workers, Bridge, Loom, and Orb. It freezes after construction, rejects duplicate exact revisions, requires an explicit active revision when alternatives exist, permits registered revisions or whole names to remain retained but inactive, requires explicit non-default route precedence whenever multiple names are active, and has one active default. Run commits selected name and manifest; resume never routes Intent again. Loom exposes active/default/route-rank metadata without making retained revisions admissible.

This is Core registry, not Extension contribution, Composition registry, Suite executor, scheduler, editor, or durable Pattern publication store. State separately owns v1 adapter, delegation, stasis, and Loom.

Pattern identity

Manifest has schema, URL-safe key/revision, reviewed implementation revision, checkpoint schema, a declared entry station, unique semantic station key/label/kind, permitted declared-endpoint edges, and deterministic SHA-256 digest. Executable stations map one-to-one with Python nodes; construction rejects missing/duplicate/unknown/mismatch, duplicate semantic edges, Gate or delegate marker drift, dynamic BaseNode returns whose topology cannot be proved, and any semantic transition set that differs from the public Graph node definitions. The declared entry must name the actual executable start node and participates in the digest. Exactly one terminal is required. Gate loops remain explicit Graph edges; a delegate station additionally declares its durable same-station re-entry edge. Gate/delegate derives Durable Stasis. The opaque implementation revision is a human-reviewed compatibility closure, not a hash of Python bytes: behavior that would invalidate parked state or replay must bump it or the Pattern revision. The manifest fingerprints source-adjacent declaration rather than compiling all semantics.

Admission persists snapshot/digest; execution/resume requires exact current registered equality or fails pinned Pattern unavailable. Multiple exact source-registered revisions may coexist: new admission uses only an active revision while an older Run resolves its retained pinned revision directly. Removing old executable code still makes that revision unavailable. Compatibility is proved only by exact registered equality and the reviewed closure. Automatic source-code drift detection, durable publication, drain, and migration remain future work.

Migration without rewritten history

Portable Spells and Scrolls arrive additively:

1. Freeze current Pattern schema v2 digests and persisted-Run fixtures.
2. Introduce Spell-contract, implementation, placement, and Resolution-Lock types without changing v2 snapshots.
3. Adapt each v2 station at assembly as a Scroll-private legacy_inline Spell identity; it is neither reusable nor portable.
4. Add separate provider-attributed Spell-contract, implementation, and Scroll stores, then build one immutable registry generation shared by admission, workers, Bridge, Loom, and Orb.
5. Introduce a new Scroll schema with exact Spell references and a Resolution Lock while dispatching v2 and the new schema through separate validators and resolvers.
6. Publish built-ins only as new revisions. Never rewrite bridge_chat@1 or delegated_rite@1, and retain their executable closures until pinned Runs drain or settle honestly unavailable.

No compatibility shim may present a v2 Python node as a canonical public Spell merely because its label resembles one.

The first internal adapter for steps 2–3 has one deliberately private identity. For every executable v2 station it derives a Scroll-private contract from (pattern_id, pattern_revision, manifest_digest, station_id, legacy_inline), places it under the station key and kind, and binds it to the manifest's exact implementation_revision, checkpoint_schema, and Python node fingerprint module:qualname. Contract, placement, and implementation identities remain separate and form a one-to-one set over executable stations. The declarative terminal maps to Graph End and is not adapted into a fictional Spell or implementation.

That boot-derived legacy_inline Resolution Lock has a deterministic internal-v0 digest. It is not JCS portable identity, a signature input, a public Spell contract, or proof of Python source equivalence. It changes when the exact local node binding changes without altering the frozen v2 Pattern snapshot or digest. During this migration step the lock is used by the in-process exact revision lookup but is not stored on Run, exposed by Loom/Orb, or claimed as the future persisted Resolution Lock. Persisting and projecting it begins only with a new schema and migration under steps 4–5.

Configuration-to-casting spine (Designed)

The extensibility path is one directional assembly, not runtime reflection:

typed local configuration selection of exact registered refs and bounded policy
→ explicitly selected shaped contribution stores
→ one immutable contract / implementation / Scroll registry generation
→ exact resolution and Resolution Lock
→ registered Scroll-version adapter and Graph binding
→ per-placement AgentSpec, Context contributions, and effect demands
→ Run admission pins executable truth before queue publication

TOML may later select authority-qualified ids, exact revisions/digests, activation, placement policy, budgets, and registered Context projection profiles already admitted by the selected Extensions. It remains a local typed selector, not the portable Scroll identity owned by canonical JSON. It may not contain a Python module/class path, callable, Graph node or edge, arbitrary prompt, raw source material, credential, live Connector/grant, or fallback implementation. Registering a Rune schema, Spell contract, implementation, Scroll, adapter, AgentSpec, Context formatter, or effect handler is a separate shaped contribution; none implies another and duplicate or unresolved exact identity fails before activation.

The Graph binder consumes only an admitted Scroll-version adapter and its exact lock. It never imports code named by configuration, scans packages for subclasses, or guesses an implementation from a similar label. Placement-specific Agent and Context assembly occurs after resolution so a Reader may receive an exact structure or verbatim projection without acquiring Writer tools, while a Writer must separately satisfy its declared effect and authority contract. The current source delivers only the fixed v2 registry plus the private legacy_inline boot adaptation; no TOML keys, portable stores, general lock persistence, or dynamic activation for this spine ship.

Admission and ownership

Spellweaver selects once from admitted Intent; Run ledger owns identity/status:

1. validate/select Pattern;
2. atomically create Run with exact manifest and its initial durable delivery;
3. retain caller initiating record while that delivery is held, then release it;
4. publish the exact job key; relay it later when the broker is unavailable.

The Run delivery outbox is transactional with Run truth, not with the external broker. Workers and the relay publish, claim, and settle physical hops; Graph checkpoints; Spellweaver neither writes the outbox directly nor operates containers. Spellweaver owns scheduling identity, eligibility, overlap, and miss semantics; a separate clock/relay mechanism detects due work and publishes only the ordinary delivery that Spellweaver has admitted. Spellweaver does not become that timer or broker.

Pattern contribution

A publishable Scroll revision declares identity/revision/owner/provenance/support/parentage; every required Spell contract and placement; typed input/output/state/error/non-completion; topology and cancellation; capability/tool/plane/budget/ wait; Sigil/effect/privacy/egress/consent and secret-free durable state; checkpoint/idempotency/ receipt/compatibility/migration/drain/refusal; Loom metadata; and serialization/failure/recovery evidence. Assembly uses explicitly selected shaped store, never package scanning; rejects duplicate identity, ambiguous routes, unknown adapters, unreachable station, unsafe cycle, unserializable state, missing continuity, forbidden effect, then freezes generation. Workflow dataclass is internal pre-v1, not ABI. Creation/Assimilation/Extension law governs candidate publication; source/model/ Loom draft cannot publish without validation, review, evidence, immutable revision.

Spell-contract publication, executable implementation registration, Scroll publication, and activation are separate acts and shaped stores. Deactivation of an implementation closes dependent Scrolls to new admission; already pinned Runs may use an explicitly retained closure, while security revocation forbids even retained execution. Installing code or replacing a process-built catalogue is Evolution, not Reanimation; Reanimation restores an exact whole-body checkpoint. A future declarative-only Scroll may activate without Vessel replacement only when all implementations are already admitted and an atomic durable catalogue-generation mechanism exists.

Authorship provenance and protected regions

Authorship and approval are different records. A human may approve model-written text without having written it; an Agent may commit through a human-configured VCS identity. Git author, committer, account name, prose style, detector score, and absence of model metadata are evidence at most. None may mint human provenance.

An Authorship Attestation binds one artifact revision and stable region id to its canonical content digest, locator, origin class, attesting Principal, and evidence references:

The attestation is an attributable claim, not proof of private cognition. A trusted local or authenticated human surface may create human_attested; an Agent, provider assertion, imported commit, or style classifier may not. Agent outputs receive agent_generated from the host job and artifact lineage even when a human later approves them. Approval changes authority to promote, not the history of who composed the bytes.

Attestations append; they do not overwrite inconvenient lineage. Contradictory or inseparable human and Agent evidence resolves to mixed, while insufficient evidence remains unknown. A trusted human surface may attest a new human-written replacement only when it binds that editing boundary and exact result. Copying unchanged Agent output through the human surface cannot launder its origin.

A Protected Region binds a stable region id, target artifact revision, canonical content digest, locator, and live_change_only policy. Accepting a human authorship attestation protects that region by default; an authorized human may also protect material of another or unknown origin. Line numbers are only a projection. Document block ids, syntax-aware symbols, structured field paths, or media-specific selectors locate the region, while the digest catches drift. Moving, deleting, splitting, reformatting, changing its marker, or changing the protection record itself counts as a touch.

Source comments, front matter, editor decoration, and VCS notes may display the mark but are not its authority. The target owner retains the base-revision attestation and protection manifest outside the candidate's control. An Agent cannot unprotect text by deleting its visible marker.

For a candidate that may replace an artifact, Spellweaver orders one admission path:

1. bind the exact base revision, candidate digest, and target-owner diff;
2. resolve touched regions against the base-revision protection manifest;
3. continue normally when none overlap, or enter Durable Stasis for one live HitL verdict naming every affected region, old and replacement digests, and an authorized exact-diff artifact;
4. after approval, revalidate base, candidate, region set, and effect identity before the target owner writes a successor artifact and manifest.

Protected-region change never accepts Codex preauthorization, a previous verdict, a broad “edit this repository” grant, or approval of a different patch. Base or candidate drift creates a new call. Denial preserves the candidate as inert evidence; it does not mutate the active artifact. An Agent may prepare a suggested replacement in Lab, but cannot apply it to the protected body.

An approved Agent edit remains agent_generated when it wholly replaces a region and mixed when it interleaves with retained human material. Unchanged human-attested content retains its provenance across an approved move. A human may later rewrite and freshly attest the exact result; the approval itself never performs that relabelling.

For legacy material, history and stylometry may nominate likely regions for review. They remain unknown until a human explicitly attests the exact current digest. Spellweaver owns the Gate and ordering; the artifact/effect owner owns region resolution and mutation; Creation owns candidate isolation and target-owner promotion; HitL owns the live verdict. No Authorship Attestation store, protected-region manifest, trusted authoring surface, overlap resolver, or candidate-bound review card is delivered. State of Work owns that boundary.

Gates, effects, and Stasis

Checkpoint is Graph state, never process image or retroactive replay safety. Effect station declares idempotency, receipt, cancellation, compensation/refusal, and illegal-repeat boundary. Consent appears only where HitL/effect policy demands; a verdict covers exact effect, not Pattern promotion or downstream authority. Archive, Ward, Dispatcher, provider, execution retain policy even when coordinated.

A protected remote score joins labels, selects a minimum disclosure projection, locally transforms, may ask a local Privacy Agent, independently verifies transformation evidence, creates a consumer- specific Privacy Cut, gets an exact tagged-target EgressDecision, transmits once, and quarantines the return. Censor/Agent proposes only. Context owns the Cut; Security owns declassification.

Execution projections for procedural Agent placements (Designed)

For a declared long-horizon procedural region, a Composition may define a bounded, versioned Execution Projection. The Composition owns its meaning; the exact Scroll revision pins its schema and initialization, placement mappings, required unknown and omission fields, admitted observation inputs, permitted candidate operations, applicator binding, history policy, and hard field, cardinality, and byte limits. A changed meaning, schema, mapping, operation set, applicator, or history policy is a new Scroll revision. The projection contains only working material required by later placements. It is not the whole Graph continuation, an authoritative domain record, an effect receipt, an audit trail, Archive memory, or conversation history.

The placement history policy selects exactly transcript, projection, or hybrid. transcript means Context-governed bounded settled message groups. A hybrid pins the deterministic selection profile and bounds for attributed history retained beside the projection; the assembled call records the exact groups selected at runtime. It is not an undeclared fallback to all settled history. Any required provider, tool, or consent continuation remains orthogonal and indivisible; it does not turn projection into hybrid. Semantic sufficiency and continuity select the pinned shape before cache, latency, or price. Cache availability cannot change it.

At an explicitly declared Agent placement, Context may assemble immutable instructions, the recipient-specific current Execution Projection, the exact station request, and fresh admitted observation projections without replaying settled reasoning, actions, or observations into that model call. Every observation retains its source, revision or cursor, freshness, classification, and lineage. The placement may omit settled history only when its contract declares the projection sufficient for continuation; required material that does not fit refuses before inference. Declared bounds make this input independent of prior-turn count, not independent of the actual size of its projection and observation.

The Agent returns typed, bounded candidate operations and, when allowed, an action intent. It does not replace the projection, extend its schema, or mutate workflow control, authority, privacy, domain truth, or effect settlement. A deterministic workflow-owned applicator binds the candidate to the exact current projection value and revision plus its admitted observations, validates the permitted fields and invariants, and alone creates the next committed projection value and revision for that Casting. An action intent remains inert until the owning effect boundary authorizes, executes, and settles it; confirmed world-facing fields follow owner observations or receipts, while indeterminate consequence remains UNKNOWN.

Canonical sources, full attributable artifacts, receipts, events, and any retained history remain with their existing owners even when excluded from a later model call. Exact conversational history and an in-progress provider/tool or consent continuation are not replaced by an Execution Projection. When no fixed sufficient schema is known, earlier material may become relevant only later, or the historical trajectory is itself the requested evidence, the Scroll must admit the necessary attributed history or artifacts—or stop with an explicit unknown or non-completion.

SKILL.state v2 reports that its projection-only, state-plus-latest-observation variant can preserve or improve benchmark performance while materially reducing repeated transcript tokens in long sequential single-agent tasks, including budget-matched controls. That evidence motivates the accepted shape; it does not establish LychD delivery, universal model performance, shared mutable multi-Agent state, concurrent merge law, privacy, effect safety, checkpoint recovery, or LychD-specific token savings, cache-aware billing savings, cache-hit rates, time-to-first-token improvements, or latency gains. The current Pattern v2 manifests and built-in workflows do not deliver Execution Projections.

Execution-road planning

Portal, A2A, and delegated coding are not interchangeable provider names. Spellweaver first closes the labor boundary, then any cognition boundary inside it:

• a native Spell or Agent keeps decomposition in LychD and may use deterministic work, a local Soulstone, or one admitted Portal capability;
• an A2A placement delegates one public task schema to a sovereign peer, which owns its private decomposition and provider choice; and
• a delegated coding placement gives one foreign runtime a contained read, candidate, or verify workspace and tool loop. A child model call is a nested Portal boundary.

Each eligible placement pins ExecutionRoadPolicy@1: exact Pattern/Spell/placement revisions; semantic input/output and non-completion; permitted labor and cognition roads with explicit branch predicates; classification, lineage, Cut, consent, quarantine, and validators; effect demands; deadlines and request/token/concurrency/spend ceilings; durability and idempotency; permitted fallback edges; and result-adoption evidence. Economics and readiness may eliminate an eligible branch, never make an ineligible one lawful.

Before road admission, Spellweaver creates immutable ExecutionRoadDecision@1; the Run ledger stores it before any road-owned submission, and the later dispatch event, ServiceJobAttempt, Intercom task, or AgentJob references its id. The decision binds Run, station attempt, parent decision/retry generation, exact input/export digest, artifact-reference-set digest, opaque custody refs, and canonical content-digest/media-type/size/classification evidence, source-manifest and influence-label digests, safe residual-disclosure summary/digest, opaque restricted lineage refs, purpose, policy and expiry, chosen road, budgets, expected result/quarantine, record classification/visibility/retention, and the expected road binding. It contains no caller-supplied full ArtifactRef, raw subject, filename, material-parent, source span, reversal value, credential, or live grant/lease handle:

The complete decision is restricted, deployment-local, non-exportable evidence. Loom, logs, and external receipts receive only an opaque decision id or Security-owned EvidenceDigest@1 projection; canonical raw digests never leave local decision/attempt custody and are not anonymous.

The decision records selection only; it never replaces those ledgers, observes a terminal, or settles their truth. Durable road admission commits the decision and its road record atomically when they share one Phylactery transaction; otherwise the decision commits first and the idempotent road record adopts its id. A local deterministic road-selection Spell may choose only among manifest-declared branches using pinned policy and admitted observations. Dispatcher then binds an already eligible capability; it does not rank price, privacy, peer trust, or coding runtimes. Orchestrator makes managed local substrate ready; it does not change the road. Gateway auto, model-written routing, or a foreign runtime's provider choice cannot substitute for this decision.

Cache reuse is an execution-road optimization, not Execution Projection, Agent memory, continuity, authority, or recovery. After semantic input, road, and exact capability binding are pinned, a future execution profile may carry an opaque cache-affinity preference only for connector reuse or physical placement of that same admitted call. The preference carries no prompt, history, plain prompt-derived digest, or authority and cannot select another model, road, or input policy. No current Dispatcher or Orchestrator contract implements it; future declared support remains a Dispatcher capability fact and local placement remains inside Orchestrator's physical boundary.

Provider cache eligibility, identity and lifetime scope, retention, and current tariff remain dated Portal Roads selection-receipt facts; local prefix or KV behavior remains an exact Soulstone engine/profile fact. A provider, model, or engine name alone proves no cache fact. An exact launch flag or provider declaration is declared capability or intent, not observed residency, hit, or savings; prefix_digest witnesses LychD content only, and a projected discount is not a receipt. When available, provider-reported cached-token usage is attributed billing evidence under Oculus law, not proof of physical KV reuse.

Cache availability cannot be required for correctness, input sufficiency, budget admission, or recovery. Before first submission—or after the road owner proves no prior effect—an ordinary cache miss, eviction, or process restart executes the same admitted call without cache reuse on the same pinned binding. The miss alone causes neither refusal, fallback, nor input-policy change. After submission, existing reconciliation and idempotent-redelivery law governs; a changed target, model, or runtime still requires the existing fresh road decision. Only a separately admitted provider live-session road may require its exact session binding and opaque handle; its owner defines loss and reconciliation. Tool and consent continuation retain their existing Graph and HitL contracts and never become cache affinity.

A semantic retry, fallback, changed payload, target, peer, model, workspace projection, or delegated child call creates a new road decision, then its road owner creates the appropriate attempt/task/job and every required Cut/egress decision. Exact transport redelivery within one admitted road-owned attempt instead preserves sealed bytes, target, external/idempotency identity, road decision, and Cut/token namespace; the adapter must prove atomic same-key/same-payload idempotent replay or no prior effect, road-specific retry/reconciliation law must permit it, and each physical transmission receives a fresh EgressDecision and consumes its bounded disclosure use. A submitted attempt is first reconciled under its existing identity; uncertainty cannot activate an alternate branch by pretending the first effect did not happen. Every remote return stays attributed and quarantined until the Composition owner validates and adopts it.

Execution roads carries this law through the operator-facing selection and failure journey.

Parallelism and delegation

Built-ins are serial BaseNode. Parallel map/fork/join/reduce needs branch identity, declared reduction, bounded concurrency, cancellation, Gate behavior, completed-effect receipts, and crash-recovery on both join sides. A bounded durability adapter cannot replace ledger, Ward, Dispatcher, Orchestrator, HitL, or revision. Delegated station declares request/result, containment, budget, timeout, cancellation, artifact boundary, downstream use; provider adapter invokes foreign runtime, never embedded CLI/credential/private graph.

Crucible choreography

Crucible is the canonical adversarial choreography for forming a decision candidate: frame one question and common evidence; run separately biased first-round Postures; join their strongest claims, citations, concessions, defeat conditions, and unknowns; return that attributed projection for a second-round rebuttal; synthesize without a vote; then stop at an exact Magus Gate or inert dossier boundary. Logical independence is required; physical concurrency is optional. A serial implementation must preserve the same isolation and must not leak an earlier advocate's output into another first-round Context.

Bias is declared input, never authority or a substitute for evidence. Compression between rounds retains source references, every advocate's nominated strongest claims, concessions, dissent, unknowns, and omissions; the full reports remain attributable artifacts. Missing evidence may produce UNKNOWN, a bounded evidence request, or honest non-decision. Majority, confidence, eloquence, model identity, or survival through summarization cannot adopt the result.

Crucible is a reusable score form, not an ownerless global Pattern. A Composition that uses it must publish its exact Pattern and dossier contract and apply ordinary revision, road, budget, and authority law. When the receiving decision belongs to another office, that office retains judgment and the Composition only coordinates the dossier. The choreography neither evaluates a capability in Riddle's place, materializes Shadow branches, nor promotes its own recommendation. A downstream mutation or Covenant edit begins only through its target owner's workflow after the exact human verdict.

Compositions, Products, Suites, and schedules

Portfolio membership marks an accepted Native Reference Composition: a first-party maintained application contract and worked example. It does not prove executable delivery; State of Work keeps the shared whole-system envelope, while a Composition mentions local delivery only when it materially changes how the contract is read.

Portfolio acceptance is deliberately rare but not numerically capped. It requires durable reusable application truth with its own records, judgment, terminal outcomes, and recovery boundary; reuse of a mechanism or provider is insufficient. Two independently motivated Products or use cases are strong corroborating evidence, neither a necessary threshold nor proof by themselves. Portfolio acceptance remains distinct from runtime registration and from delivery.

Editorial reader views may group accepted Compositions for discovery. They have no identifier, revision, records, authority, namespace, source-layout consequence, dependency meaning, delivery state, or runtime/Product selection role. A Composition may be discoverable through several views while retaining one canonical leaf.

A Product gives a profession or market one named operator door. It pins eligible Composition or Suite revisions, owner-qualified profiles, projections, supported use cases, defaults, and its customer and support envelope. A Product may use one Composition or coordinate several through a Suite; it does not become another workflow executor, merge member ownership, or convert packaging into authority. Deployment instantiates a Product under one operator's configuration without creating a new Product identity merely because its host, customer, or credentials differ.

A Product Revision is one immutable version of that selection and promise. Changing an exact Composition or Suite pin, owner-qualified profile, projection, supported use case, default, or customer/support policy within the same stable operator promise creates a new Product Revision. A materially different profession, market, or operator promise requires a new Product identity. Neither a new Deployment nor presentation-only public copy changes the Product Revision.

A Native Reference Composition may also publish an exact reference deployment profile without becoming a Product. Such a profile binds an implementation and acceptance target; it creates no service until Configuration selects a delivered registered revision and Containers admits its complete deployment manifest.

A Product or use-case study may expose an unresolved application-ownership need. Until that need resolves to an exact external authority or an accepted Composition revision, the Product must not claim the affected use case as supported and no Invocation depending on that missing truth may be admitted as a supported Product path. Product packaging never acquires the missing records, judgment, policy, consent, secrets, or effect authority in the meantime.

An already-settled exact record, artifact, receipt, capability snapshot, Product co-packaging, or exact external precondition whose lifecycle the consumer cannot manage does not by itself create a Suite. A foreign reference grants no installation, availability, lifecycle, upgrade, credential, admission, or effect authority. Suite is required when one result must initiate or admit, await, retry, cancel, recover, correlate, or settle multiple Composition-owned Invocations. It pins member and Pattern revisions, typed ArtifactRef/Intent handoffs, correlation, ceilings, dependencies, and partial-completion law while never merging ownership, secrets, Sigils, HitL, or domain judgment. Suite execution is Designed: child identity/revision/closure/fan-out/join/budget/cancel/stasis/retry/effect/compensation/partial must be defined first.

A Schedule makes one durable, deduplicated Occurrence for each firing and enters ordinary admission. Spellweaver owns calendar/event meaning, service class, temporal eligibility, priority/overlap/coalescing/revision, and the decision to admit or settle a missed firing. Workers deliver and retry exact admitted hops; Dispatcher resolves capability; Orchestrator owns readiness. A timer never calls a Graph node, model, Animator, or container.

Three semantic service classes govern admission; they are not broker queues:

Class is orthogonal to doctrine priority and physical queue. Continuous foreground demand must not silently starve a declared deadline; approaching deadline feasibility may outrank ordinary latency preference under the pinned policy. spare_capacity defaults to already-WARM/NO_OP-compatible capability and may not trigger a disruptive hard swap merely to keep iron busy.

Cron is one trigger grammar, not a service class. A calendar Schedule pins its revision, Pattern revision, IANA time zone, ambiguous/nonexistent civil-time policy, overlap and misfire policy, bounded catch-up, budgets, and authority owner. Jitter changes eligibility, never Occurrence identity. An overlap remains live while its prior Invocation is nonterminal, including Stasis; coalescing requires a Pattern-owned typed merge and preserves every member Occurrence.

Canonical Occurrence means the schedule or external-trigger firing before Invocation admission. The delivered Graph runtime's occurrence_id field is a legacy name for a station-attempt correlation; it is not this durable trigger identity. No Occurrence store, timer, eligibility engine, service-class persistence, safe preemption, or periodic workflow scheduler exists.

Returning findings

Riddle returns CompositionSuiteFindingSet@1, AttributionCandidate@1, InvalidationSet@1, and CorrectionRequest@1 as evidence, not reverse edges. Spellweaver admits a Correction Request only as a new forward Invocation under validation/budget/authority/consent; it cannot resume an arbitrary old station, mutate an artifact, inherit consumer authority, or turn recurrence into training. Repair starts from the smallest supported cut; reuse requires full input/evaluation closure; unresolved attribution or exhausted budget terminates honestly.

Loom projection and drafting

Loom reads the fixed immutable Pattern manifest: semantic stations, edges, Gate/delegate, revision, implementation revision, checkpoint schema, and digest. Mermaid/canvas are views. Charcoal remains inert until a canonical declarative Pattern has typed ports/state/effects/authority/termination/continuity. Drawn grouping does not nest a Pattern or execute a Suite. Publication alone makes a new immutable revision; Invocations stay pinned. Model prose, browser gesture, and renderer state are not authority.

Rejected alternatives

Unversioned procedural chains

Functions suit a bounded station, not long-lived identity with parking, projection, contribution, or revision continuity.

A second application scheduler

It fragments admission, priority, recovery, and inspection; applications contribute to Spellweaver.

Visual source as executable law

Renderer state cannot state all type, authority, effect, and recovery invariants; Loom projects and may draft candidates.

Git identity or an AI detector as authorship proof

Commit identity can be borrowed by an Agent, and style classification is probabilistic. Both may nominate legacy material for review; neither can create a human authorship attestation.

A prompt warning or source comment as protection

An effectful Agent can ignore the prompt or delete the marker. Protection is enforced by target-owner comparison with the base manifest and an exact live Gate, outside candidate control.

Consequences

Acceptance evidence

Registry, route-once, manifest, serialization, Loom, admission, claim, consent, delegation, and recovery tests prove the floor. Each future surface needs focused ambiguity, compatibility, failure, cancellation, replay, and projection evidence before State promotion.

The portable profile additionally requires golden and negative fixtures consumed by two independent implementations: canonical bytes/digests; duplicate and unknown fields; numeric and ordering edge cases; namespace collision; exact contract resolution; repeated Spell placement; missing, unauthorized, unavailable, retained, and revoked implementations; v2 coexistence; and refusal of similar-name, version-range, or newer-revision substitution.

The authorship-protection profile additionally requires fixtures for every origin class; conflicting and inherited lineage; unchanged moves, splits, marker deletion, and manifest drift; base and candidate races; live-only refusal of preauthorization; exact affected-region review; and proof that approving Agent output never relabels it human_attested.

The execution-road profile additionally requires complete local/Portal/A2A/delegated matrices; manifest-undeclared and model-selected road refusal; consumer-specific Cut and target binding; nested coding-agent child egress; capability/peer/runtime unavailability; pre- and post-submit failure at every edge; new-attempt fallback; indeterminate reconciliation; quarantine/adoption; and proof that a decision commits before admission, contains no live handle, is referenced by the road-owned record/event, and never settles that ledger.