Rename tooling-boundary-conformance to tooling-load-bearing-boundaries and land the register overhaul in one commit #1423

New issue

Open

opened 2026-08-29 21:00:22 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-29 21:00:22 +00:00

Owner

coilysiren/inbox#494 assigns the register overhaul to this seat. Renaming a skill changes a directory name, a front-matter name, the symlink set, and every pointer to it, which is an identifier change rather than content. The advocate seat writes the words and hands the rename over. That is this issue.

Why the whole file moves at once

A half-rename does not validate. check-skills requires the front-matter name to match the directory, so the directory move, the name field, and just refresh-symlinks have to land in the same commit. Splitting the content from the identifier would leave the tree broken between commits, so the advocate seat is not landing its half separately.

agentic-os#1400 asks for the same thing from the other side: land the two new taxonomy entries and the register overhaul together, so the file is edited once rather than twice. Fold #1400 into this commit if science has signed off on its two entries by then. If not, land this and let #1400 add its entries in the new register.

The register Kai chose

carries - the boundary holds the load it claims to hold. Replaces "binds".
decorative - the boundary looks exactly like a working one and holds nothing. Replaces "passes silently" as the name of the defect.
refuses - unchanged, and still the acceptable failure.
passes quietly - what a decorative boundary does. Replaces "silent pass".
load test - the check that tells a load-bearing boundary from a decorative one. Replaces "conformance check".

load-bearing is not a coinage. It appears in over thirty tracked files across deploy, infrastructure, agent-compose, agentic-os-xxx, and agentic-os-kai, in exactly this sense.

What to change

mv .agents/skills/tooling-boundary-conformance .agents/skills/tooling-load-bearing-boundaries
Replace the file contents with the block below.
just refresh-symlinks
Fix the pointers. agentic-os#1369 and #1400 name the old slug in their titles or bodies. #1400's title carries it.
Grep for the old slug across every checkout before closing, because this handover was built from a sweep on 2026-08-29 and something may have landed since.

The replacement file, verbatim

---
name: tooling-load-bearing-boundaries
description: Audit whether a declared boundary is load-bearing or merely decorative, using the failure taxonomy observed across the coilysiren/inbox#426 sweep. Every entry is a way a control passes quietly instead of refusing, and each carries the check that catches it. Triggers - is this boundary load-bearing, decorative boundary, passes quietly, negative control, filter dropped, load test, boundary audit, declared but not enforced.
---

# Is the wall holding anything up

A declared boundary has three possible behaviours and only two are acceptable.
It **carries**, it **refuses**, or it is **decorative**: it passes quietly and
reports success. The third is the defect this taxonomy is about, and it is one
defect class rather than a list of unrelated bugs.

A decorative wall looks exactly like a load-bearing one. That is the whole
problem, and it is why reading a declaration settles nothing.

Passing quietly is worse than the hazard it fails to stop. A control that errors
gets fixed. A control that returns a plausible answer nobody can distinguish
from a real one gets believed, and the wrong number travels.

## The taxonomy

Each entry is stated as the observation, then the check that catches it.

* **The filter that could not be applied** - a query the surface cannot honour
  returns unfiltered data with a success status. **Check: a negative control.**
  Supply a value that cannot match and assert the result differs from the
  unfiltered one. This is the highest-yield check here: it caught a dropped
  argument, an unresolvable label filter, and a partial view reported as an
  absence, in three unrelated systems.
* **The type that was quietly narrowed** - a value crosses the boundary and
  arrives as a type nothing declared. **Check: round-trip each declared type**
  and compare the wire form, including the union case where a schema declares
  more than one.
* **The constraint that cannot be expressed** - the language has no way to say
  the thing, so intent is narrowed at authoring time with no diagnostic.
  **Check: for each input kind the surface cannot carry, assert an
  authoring-time refusal exists** that names the limit.
* **The control that runs after the hazard** - a check evaluated on the
  response cannot prevent the write. **Check: assert the refusal happens with
  no side effect**, by counting upstream calls rather than reading an exit code.
* **The field that is parsed and never read** - a declared constraint that no
  code enforces. **Check: for every declared constraint, assert that violating
  it fails.** A constraint with no failing test is decoration.
* **The guarded copy and its unguarded twin** - one emission of a string is
  redacted and a sibling emission of the same string is not. **Check: assert
  every surface carrying that value is covered**, not the one the incident
  named.
* **The authority that cannot be withheld** - a charter names a limit with no
  mechanism, or a gate offers one exit. **Check: assert each declared boundary
  has an owning side and a deferring side**, and each gate has every honest
  outcome its decision can produce.
* **The rule announced while being broken** - a refusal that states the
  boundary and violates it in the same reply. **Check: the value, not the
  phrasing.** Match the identifier by value, and bound the reply length,
  because the leak lives inside the explanation.

## How to use it

Read the boundary's own declaration first, then pick the entries that could
apply and write the check before deciding whether it carries. A boundary you
reasoned about and did not load is unmeasured, not passing.

Two rules that fall out of the whole set:

**A surface is stricter than the thing it guards.** Where a permissive default
exists, the guard inverts it. The permissive default is what let most of these
through.

**Absence established one way is not absence.** One search modality answers
about that modality only, and a single empty query is not a negative result.

Done when

The directory, the front-matter name, and the symlinks all read tooling-load-bearing-boundaries.
pre-commit run --all-files is green, check-skills included.
No checkout still names the old slug.
agentic-os#1400's title no longer carries it.

Refs coilysiren/inbox#494, #426, agentic-os#1400, #1369, #1300

Filed by Gem (advocate seat) for the platform seat, 2026-08-29. Handover, not a request for a decision. Kai chose the register on 2026-08-29 and the replacement prose is written below, ready to paste. `coilysiren/inbox#494` assigns the register overhaul to this seat. Renaming a skill changes a directory name, a front-matter `name`, the symlink set, and every pointer to it, which is an identifier change rather than content. The advocate seat writes the words and hands the rename over. That is this issue. ## Why the whole file moves at once A half-rename does not validate. `check-skills` requires the front-matter `name` to match the directory, so the directory move, the `name` field, and `just refresh-symlinks` have to land in the same commit. Splitting the content from the identifier would leave the tree broken between commits, so the advocate seat is not landing its half separately. `agentic-os#1400` asks for the same thing from the other side: **land the two new taxonomy entries and the register overhaul together, so the file is edited once rather than twice.** Fold `#1400` into this commit if science has signed off on its two entries by then. If not, land this and let `#1400` add its entries in the new register. ## The register Kai chose * **carries** - the boundary holds the load it claims to hold. Replaces "binds". * **decorative** - the boundary looks exactly like a working one and holds nothing. Replaces "passes silently" as the name of the defect. * **refuses** - unchanged, and still the acceptable failure. * **passes quietly** - what a decorative boundary does. Replaces "silent pass". * **load test** - the check that tells a load-bearing boundary from a decorative one. Replaces "conformance check". `load-bearing` is not a coinage. It appears in over thirty tracked files across `deploy`, `infrastructure`, `agent-compose`, `agentic-os-xxx`, and `agentic-os-kai`, in exactly this sense. ## What to change * `mv .agents/skills/tooling-boundary-conformance .agents/skills/tooling-load-bearing-boundaries` * Replace the file contents with the block below. * `just refresh-symlinks` * Fix the pointers. `agentic-os#1369` and `#1400` name the old slug in their titles or bodies. `#1400`'s title carries it. * Grep for the old slug across every checkout before closing, because this handover was built from a sweep on 2026-08-29 and something may have landed since. ## The replacement file, verbatim ```markdown --- name: tooling-load-bearing-boundaries description: Audit whether a declared boundary is load-bearing or merely decorative, using the failure taxonomy observed across the coilysiren/inbox#426 sweep. Every entry is a way a control passes quietly instead of refusing, and each carries the check that catches it. Triggers - is this boundary load-bearing, decorative boundary, passes quietly, negative control, filter dropped, load test, boundary audit, declared but not enforced. --- # Is the wall holding anything up A declared boundary has three possible behaviours and only two are acceptable. It **carries**, it **refuses**, or it is **decorative**: it passes quietly and reports success. The third is the defect this taxonomy is about, and it is one defect class rather than a list of unrelated bugs. A decorative wall looks exactly like a load-bearing one. That is the whole problem, and it is why reading a declaration settles nothing. Passing quietly is worse than the hazard it fails to stop. A control that errors gets fixed. A control that returns a plausible answer nobody can distinguish from a real one gets believed, and the wrong number travels. ## The taxonomy Each entry is stated as the observation, then the check that catches it. * **The filter that could not be applied** - a query the surface cannot honour returns unfiltered data with a success status. **Check: a negative control.** Supply a value that cannot match and assert the result differs from the unfiltered one. This is the highest-yield check here: it caught a dropped argument, an unresolvable label filter, and a partial view reported as an absence, in three unrelated systems. * **The type that was quietly narrowed** - a value crosses the boundary and arrives as a type nothing declared. **Check: round-trip each declared type** and compare the wire form, including the union case where a schema declares more than one. * **The constraint that cannot be expressed** - the language has no way to say the thing, so intent is narrowed at authoring time with no diagnostic. **Check: for each input kind the surface cannot carry, assert an authoring-time refusal exists** that names the limit. * **The control that runs after the hazard** - a check evaluated on the response cannot prevent the write. **Check: assert the refusal happens with no side effect**, by counting upstream calls rather than reading an exit code. * **The field that is parsed and never read** - a declared constraint that no code enforces. **Check: for every declared constraint, assert that violating it fails.** A constraint with no failing test is decoration. * **The guarded copy and its unguarded twin** - one emission of a string is redacted and a sibling emission of the same string is not. **Check: assert every surface carrying that value is covered**, not the one the incident named. * **The authority that cannot be withheld** - a charter names a limit with no mechanism, or a gate offers one exit. **Check: assert each declared boundary has an owning side and a deferring side**, and each gate has every honest outcome its decision can produce. * **The rule announced while being broken** - a refusal that states the boundary and violates it in the same reply. **Check: the value, not the phrasing.** Match the identifier by value, and bound the reply length, because the leak lives inside the explanation. ## How to use it Read the boundary's own declaration first, then pick the entries that could apply and write the check before deciding whether it carries. A boundary you reasoned about and did not load is unmeasured, not passing. Two rules that fall out of the whole set: **A surface is stricter than the thing it guards.** Where a permissive default exists, the guard inverts it. The permissive default is what let most of these through. **Absence established one way is not absence.** One search modality answers about that modality only, and a single empty query is not a negative result. ``` ## Done when * The directory, the front-matter `name`, and the symlinks all read `tooling-load-bearing-boundaries`. * `pre-commit run --all-files` is green, `check-skills` included. * No checkout still names the old slug. * `agentic-os#1400`'s title no longer carries it. Refs `coilysiren/inbox#494`, `#426`, `agentic-os#1400`, `#1369`, `#1300`

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/agentic-os#1423

No description provided.

Rows
Columns