Stop re-deriving what someone already solved
Six waves of work produced a real autonomous execution loop and zero pages of website. The correction did not come from building more of it — it came from reading what the company next door had already built, run for four days, and deleted.
A defect gets a repair, not a new layer
Governance grew a new layer every time a check was caught lying. The repair was to fix the layer, not to add another one that could also lie.
Never infer cloud state from a repository artifact
A policy JSON in a folder is an intention. Only a probe of the live account is evidence. The named mechanism in ADR-0005 was wrong; the conclusion was not.
The retired repo still looks live
A session reading the retired repo finds a real, plausible Terraform file and has no local signal that it is dead. Live IAM is control-plane/infra/iam/, not zentari-autonomous-runtime.
A blocked call is unknown, never absent
A hang is not a negative result. A blocked call is UNKNOWN, never ABSENT.
Assert properties, not signals
I keep asserting on signals rather than on properties. Assert content, origin and lineage. Never status.
Revoke first, then clean up
On suspected exposure, REVOKE FIRST, then clean up. A credential is never placed in a process's command-line arguments.
Nothing should need my laptop
nothing should need my laptop; everything headless and autonomous. A headless AWS path is live and in daily use.
Rico back in the loop by proxy
That is Rico back in the loop by proxy. Record the Actions-approval trade as a risk row, not a closed item.
Retire the human click
There are 26 MESSAGE-TO-BUILDER files and no inbox. Retire the human click.
Never halt on a block
Never halt on a block. Route around it. A goal is done when its exit criteria are machine-verifiable and verified.
Verify the property, not the sentence
Verify the property you care about, not the sentence you wrote. You have seen none of it. Done = exit criteria executed.
The disclosure was placed first
The disclosure is the most important fact in the report and it was placed first. The token was not revoked.
Use, not mention
The forbidden thing is use, not mention. Checking the string you wrote instead of the property you meant.
The carrier cannot assume its role
Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity. RS did not make this change.
Did the queue refill itself
The number that matters between now and then is "did the queue refill itself." Nothing reads the packet DAG.
Update this file, not the two source docs
Update this file, not the two source docs, as items close. Oversight mints D-RS-1xx; builder mints D-RS-2xx.
Never ingest the old site
OLD site being fully rebuilt from scratch; NEVER ingest the old site. Never ingest old ricosuarez.com.
The voice fixtures were left unauthored
The voice fixtures were correctly left unauthored. Nothing here is drip-fed and nothing below is a gate defect.
This is the unlock
This is the unlock. Prevents agents from turning Rico into "AI-founder-LinkedIn-guy."
A build target, never an ingest source
It is a build TARGET, never an ingest SOURCE. The old ricosuarez.com is being fully rebuilt from scratch.
Source of truth is now rico-suarez-os
Source-of-truth for these 21 files is now rico-suarez-os. Separate-entity plus separate-vault.
Net-subtractive or it is not accepted
we add a layer to check it instead of repairing it. This wave is net-subtractive or it is not accepted.
Unverifiable unblockedness is refused at filing
an unverifiable claim of unblockedness is refused at filing. The RSROLE packet does not aim at the retired repo.
Dispatch is not proactive
Dispatch is not proactive. That repo is retired. This should be the last message Rico relays.
The queue refills itself from the DAG
the queue refills itself from the packet DAG with zero human input for 72h. Eight real scheduled ticks enqueue new packets with zero human input.
A retracted claim is propagated
a retracted claim is propagated to watch pages, transcripts, answer objects, clips, newsletters, press kits and structured data. Revoking a claim makes it unavailable to new generation immediately.
A skill below incumbent eval does not ship
a proposed skill scoring below the incumbent on its eval does NOT ship. One skill detected from repetition, benchmarked, and promoted or rejected on evidence.
A winner below minimum sample is refused
a winner declared below minimum sample is REFUSED; a null threshold REFUSES. One experiment run to completion against a maintained holdout with a pre-declared criterion.
A stale Learning raises an incident
a Learning older than 7 days with no linked change or explicit closure raises an incident. Every Learning in a 14-day window resolves to a change or a reasoned closure.
A gentle decline raises a drift incident
a synthetic 30-day gentle decline in M-VOICE — every point above the floor — raises a drift incident. Trend monitors running on all seven tracked series.
Every packet is decomposed or honestly parked
every packet in the queue is either decomposed into resolvable work items or honestly parked. A packet without a decomposition block is parked AWAITING_DECOMPOSITION and is never marked failed.
No declared interface is invisible to the DAG
no declared interface is invisible to the DAG. Every declared interface with no implementation has a corresponding queued packet; a new declared seam with no packet fails CI.
Role authorization is enforced on the real path
role authorization is enforced on the real execution path, not only in roles.test.ts. A work item whose bound capability's executor_role does not authorize it is REFUSED, not silently executed.
A capability cannot execute without a budget reservation
a capability cannot execute without a real budget reservation succeeding first. A reservation beyond available budget results in HALT_CAPABILITY and an incident record on the real execution path.
No publish path emits likeness without licenseGate
no publish path can emit third-party likeness content without licenseGate's real, wired approval. A seeded third-party-likeness fixture with no license on file is REFUSED by the real publish capability, not only by gates.test.ts.
An organ health breach is detected by something that runs
an organ health breach in production is detected by something that actually runs, not only by a test. A seeded organ N-1..N-5 SLA breach fixture is detected by a SCHEDULED tick, not only by checkOrganHealth.test.ts calling the function directly.
Drift detection exists as running code
drift detection exists as running code, not only as a line in r-guard.md's remit. A seeded configuration/behavioral drift fixture is caught by a real runner.
No connection_method with zero live wiring
no account-registry row can claim a connection_method with zero live wiring behind it. Either the method publishes via a real, credentialed API call, or the option is removed from the schema — never a silent no-op.
The honest-stub is resolved or trackedly deferred
the honest-stub state is either resolved or explicitly, trackedly deferred — not indefinitely implicit. A cross-company gate blocking a probe is itself a queued, tracked packet, not just a comment.
No publish path can assume rs-staging exists as more than a placeholder
no publish path can assume rs-staging exists as more than envs/staging/'s placeholder. A publish path that names rs-staging as a target either deploys to a real environment, or the dependency is a queued packet with its own enter_when condition.
The closed learning feedback loop actually runs
the closed learning feedback loop this type exists to support actually runs. A real Learning is observed to emit rico.learning.attached, and a real consumer reads it — round-tripped, not only type-checked.
Every RS packet declares its autonomy tier, risk score and class
every RS packet declares its autonomy tier, risk score and class. A packet allowed without Rico that still routes to a human fails as a gate defect; a packet with no class fails; an all-system daily plan is refused.
One packet source, two renderings, zero drift
one packet source, two renderings, zero drift. A markdown packet dropped in the vault inbox validates and appears in the registry within one tick; a hand-edited rendering is overwritten and flagged.
Seven consecutive daily plans with expected-vs-actual review
seven consecutive daily plans, each with a review recording expected vs actual. A plan with no review after 24h raises; a plan missing any of the three output types is refused.
The system generates and executes work from its own signals
the system generates and executes work from its own signals for 7 days with zero human prompts. A proposal serving no active objective is refused; a yellow proposal without a playbook is refused.
No duplicated work across overlapping schedules
no duplicated work observed across a full day of overlapping schedules. Two sweeps racing the same asset — exactly one processes it, the other skips.
Zero idle operating days across a 14-day window
zero idle operating days across a 14-day window. A day with no fresh objective work still produces completed maintenance items.
Autonomous execution ratio greater than zero
autonomous_execution_ratio > 0 with at least one component built by the runtime alone. A claimed queue item produced end-to-end by the runtime, passing its probes without human edits, counts; an already-satisfied artifact completes as already satisfied, not as executed.
Every scheduled organ has a registered expectation and a deadman
every scheduled organ has a registered expectation and a deadman watching it. A workflow whose window elapses without a run raises within one grace window; two consecutive failed runs raise.
Three consecutive scheduled ticks execute without human involvement
three consecutive scheduled ticks each execute at least one item with no human involvement. A scheduled tick — not a manual dispatch — claims and executes an item; a tick that claims zero while items remain queued fails; overlapping ticks are serialised.
Every blocking external dependency has a registered expectation and check method
every external dependency that blocks a packet has a registered expectation and a stated check method. An awaited event with no reachable check method reports UNOBSERVED, never pending; escalation fires past its window.
A brand contract exists before the homepage is implemented
a brand contract exists BEFORE the homepage is implemented. Token set renders; accessibility contrast and motion-reduction checks pass.
No capability can execute without an atomic budget reservation
no capability can execute without an atomic budget reservation in production, not only in unit tests. An execution attempted with no reservation is refused at clause 6; a synthetic ceiling breach halts the loop and the halt is observed.
M-INBOUND is computable from real structured intake
M-INBOUND is computable from real structured intake, not estimated. A spam fixture is rejected; a qualified fixture routes and starts an SLA clock; the source artifact resolves.
Cost per outcome computed per capability, workflow, format and connector
cost per outcome computed per capability, workflow, format and connector. A capability with 3 consecutive degrading periods is demoted automatically.
No autonomous external communication uses Rico's personal credentials
no autonomous external communication uses Rico's personal credentials. A DMARC aggregate report shows alignment; a seeded bounce and a seeded complaint both suppress.
Every scheduled organ declares all five parts
every scheduled organ declares all five parts and its correction routes to a queued item. A workflow missing any of the five contract parts fails CI; a correction path routing to a human fails.
No live workflow's correction path terminates at a human
no live workflow's correction path terminates at a human. A synthetic workflow failure produces a queued work item with zero human steps in the path.
No person hand-writes a status report again
no person hand-writes a status report again. Status is regenerated from committed state on a schedule; a stale artifact older than one day raises via the deadman.
An immutable, content-addressed vault exists for real media assets
an immutable, content-addressed vault exists for real media assets. Ingest is registered and tested, and it content-addresses a real asset.
One real asset enters the vault with zero session involvement
one real asset enters the vault with zero session involvement. A resolving URL produces a content-addressed vault entry and a provenance stamp; an unresolvable URL fails loudly; a denylisted host is refused before any fetch.
Rico drops files in a Drive folder and does nothing else, ever
Rico drops files in a Drive folder and does nothing else, ever. A dropped file is vaulted with Drive provenance and moved to ingested; the same file is never ingested twice; a denylisted asset is refused before download; a recursive sweep is structurally impossible.
Internal briefs with evidence refs; zero outbound sends
internal briefs generated with evidence refs; zero outbound sends possible from this capability. A story-brief scores newsworthiness with evidence refs; a send attempt from this capability is refused.
Every press asset traces to an approved entity record
every press asset traces to an approved entity record with a last_verified_at. Press-room fields resolve from the entity graph; a stale bio fails the freshness check.
Outbound sends occur only inside an approved playbook
outbound sends occur only inside an approved playbook, with provenance, caps and stop conditions proven. A cold-professional fixture without recorded provenance is refused; a reply auto-stops the thread.
Mentions classified and incidents raised with zero outbound capability
mentions classified and incidents raised with zero outbound capability. A seeded impersonation fixture and a seeded factual-error fixture each raise an internal incident.
Every topic has exactly one canonical owner before the first cross-domain publication
every topic has exactly one canonical owner before the first cross-domain publication. A second domain publishing the same topic is refused or forced to excerpt+canonical.
T3 processing recovered after a forced failure on the same original capture bytes
T3 processing recovered after a forced failure on the same original capture bytes. A later cycle of the same original bytes still publishes.
T4 enrichment recovered after a forced failure on the same original capture bytes
T4 enrichment recovered after a forced failure on the same original capture bytes. A later cycle of the same original bytes still publishes.