A fifth effect dimension: what the change is made OF - #9
Merged
Conversation
… much of it there is The four existing axes all answer «how much»: how durable, how far it reaches, whether it comes back, what power it spends. Eight operations were compared where half demand a cryptographic signature and half do not, and on every one of those axes they were IDENTICAL — same durability, same authority, same recoverability. Four dimensions and none of them discriminates, because the property this framework actually gates on was declared nowhere. It is also not derivable. Three independent static readers were built to infer it from what a handler touches — shallow, transitive, and verb-qualified — and each failed differently, and all three missed an operation whose package-manager command had been captured by running it. The property sits between what reading derives and what running measures, so declaring it is not a convenience, it is the only remaining option. Four levels, and each earned its place rather than being enumerated. Data is rows and tokens and indexes — what the code reads, not the code. Configuration is how the code already there behaves: a setting, a mode, a constitution, and this is the level that stopped the previous rule from overreaching, since founding an app and changing an agent's autonomy both live here and neither is what a signature is for. Executable is which code will run at all. A fifth level splitting that one into loaded and replaced was proposed and rejected by its own test: under the qualified rule it changes no consent decision, and a level that changes no decision is vocabulary rather than dimension. Unknown is the ceiling and not a gap, like everywhere else in this namespace. That inverts the burden: whoever wants to run without consent has to WRITE that their operation leaves the executable alone, and a written claim is one a reviewer can quote and refute. It does not prevent the lie, it gives it a name. A read has no subject, and saying otherwise is now impossible rather than merely wrong. Four blind judges classified thirty-three operations from the definition alone, and every disagreement they produced landed on an operation that changes nothing at all — they were being asked what a read is made of. The durability axis already answers that nothing changes, so the two are made to agree at construction, the same treatment the guaranteed-rollback claim already gets and for the same reason: a contradiction that cannot be declared never has to be caught by a reviewer. Note for consumers: the fifth axis counts toward «fully classified», so every profile that declared four is now honestly reported as incomplete. Nothing gates on that aggregate today — its one consumer uses it for a report and filters on the individual dimensions — and the pressure is the intended effect rather than a side effect. The way out is to classify, never to add a permissive default. Verified by mutation: removing the axis from the join, and removing the construction invariant, each fail the suite. Measured in the greenhouse: decisions/0017, 0018 and 0019.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The four existing axes all answer how much. Eight operations were compared — half demanding a signature, half not — and they came out identical on every one of them:
Four dimensions and none discriminates: the property actually gated on was declared nowhere. It is also not derivable — three static readers (shallow, transitive, verb-qualified) each failed differently, and all three missed an operation whose
composer requirehad been captured by running it.Subject: None · Data · Configuration · Executable · Unknown, withUnknownat the ceiling like every axis here. A proposed sixth level splittingExecutableinto loaded/replaced was rejected by its own test — it changes no consent decision, and a level that changes no decision is vocabulary.A read has no subject, and it is now impossible to say otherwise. Four blind judges classified thirty-three operations from the definition alone and every disagreement landed on an operation that changes nothing — they were being asked what a read is made of. The invariant makes durability and subject agree at construction.
Consumer note: the fifth axis counts toward
isFullyClassified(), so four-dimension profiles are now honestly reported incomplete. Nothing gates on that aggregate today; its one consumer uses it for a report and filters per-dimension. The pressure is intended.Verified by mutation in both directions. Provenance: greenhouse
decisions/0017–0019.