Skip to content
The GOVENANT Standard

The GOVENANT Standard — Part 4: The Substrate

The components every OCMAS product MUST build. Each is listed with its invariant, its “done-when” (presence AND liveness — fresh rows, live consumers, real side effects), and its portable schema. The consolidated DDL is in SCHEMA.sql.

The pair rule applies to every component (Part 0, Law corollary): a mechanism is its writer and its consumer. If you can find only one side, it scores L0.

4.1 The substrate at a glance

flowchart TB subgraph HUMAN["Constitution plane (Part 8) — steers, never gates"] HC[Five powers: approve · direct · object · lock · reorganize] end subgraph WAKE["Wake layer"] DR["Duty Roster (Part 3)\ncalendar · interrupts · dependencies"] EV[Event bus\ntyped, every type names its consumer] BR[Boardroom\nlive human-and-chief deliberation] end subgraph EXEC["Action layer (Part 5 gauntlet)"] AG[Agenda + dispatcher\npriority claim, outcome-keyed completion] OG[Ownership gate\nunowned pull becomes a request] VG[Validation gate\ndeterministic hard-blocks then judged lenses] TL[Granted tools\nre-guard ownership in-handler] end subgraph TRUTH["The record (append-only)"] AA[(agent_actions)] ED[(executive_decisions)] VL[(validation_log)] AQ[(approval_queue)] DRR[(duty_runs)] CS[(config_snapshots)] end subgraph WATCH["Monitors (Part 7) — independent watchdogs"] DI[Delivery integrity\nset-relationship invariants] LV[Liveness\nflag- and dependency-gated] CB[Circuit breakers\nper external dependency] CO[Conductor\nmissed-beat writer + escalation] end HC -.locks and directives.-> EXEC DR --> AG --> OG --> VG --> TL --> AA EV --> AG BR --> OG TL -->|terminal side effect| EDGE[Terminal edge] EDGE -->|outcome row verified| AA AA --> DI DRR --> CO AG --> DRR WATCH -.escalations.-> BR

4.2 Component register

S1 · Append-only record — one ledger, five jobs

Invariant. Every action, cost, decision, validation, approval, and duty resolution is written once, never edited. The single record simultaneously serves coordination (agents interact through shared state, never direct calls), compliance (“who authorized this?”), cost accounting (every token attributed), oversight (the approval surface), and the customer feed (“here is exactly what the AI did”). In regulated domains, the record is the product. Done when: every agent action writes input/output/model/tokens/cost/outcome_type/outcome_value; no exposed path can UPDATE a committed row; every observed side effect in the product has a row (pick 3 at random and find them); cost/model fields are populated at the LLM-client chokepoint, not left to call sites.

S2 · Lever registry + ownership gate

Invariant. Part 1 §1.3. Single owner per lever; unowned pulls convert to requests; the check lives inside applyLever() (the one actuation chokepoint) so no caller can route around it — not only in an executive commit path. Done when: every external side effect traces through the gated chokepoint (grep-provable); executive_requests has both writers and a live resolve path; ownership reassignment is a config write with provenance.

S3 · Validation gate

Invariant. Every outbound artifact passes deterministic hard-blocks (regex/schema rules no LLM can override) and then judged lenses (LLM evaluation on brand-truth / funnel / risk / compliance, domain-retargeted). The deterministic layer never fails open, even when the judge is unavailable. Done when: every outbound path calls the gate (including chat replies and agent-authored config); validation_log records every decision with kind, pass/fail, failed lens, revision count; gate failures can seed ledger rules (Part 6 §6.7).

S4 · Constitution plane

Invariant. Part 8. Every setting is a row with source provenance; human edits lock; every write appends a snapshot; the human steers and never gates (objection windows, not approval bottlenecks). Done when: config_snapshots grows on every write; provenance distinguishes human | boardroom | agent | default; the sticky lock has been exercised against a real agent write.

S5 · Duty roster + agenda + dispatcher

Invariant. Part 3. All scheduled work derives from duties (schedule as data); the dispatcher claims agenda items compare-and-set, dedupes, reaps stale runs, and completes items only against their outcome assertion (Law 2) — which every item inherits from its duty, so the assertion cannot be omitted. Done when: deploy-config scheduling is retired; agenda items carry outcome assertions (count = 100%); duty_runs ledgers every firing; coverage invariants C1–C3 run on write + nightly.

S6 · Event bus with named consumers

Invariant. Roles wake on business moments, not just clocks. Every published event type is a typed constant both publisher and consumer import (a string typo must be a compile error, not a silently bifurcated bus), and every type names its consuming duty. Done when: an exported event-type union exists; a startup assertion verifies every published type has a consumer or is on an explicit observational allowlist; consumer latency is measured; event rows advance status when consumed (a bus where everything stays new is dead).

S7 · Approval queue + autonomy tiers

Invariant. Part 7. Tiered oversight with atomic decision+approval writes; expiry writes decided_by='system:expired' + decided_at atomically — silent expiry is a governance failure; an expiry-rate alarm exists.

S8 · Accountability loop

Invariant. Part 6. Falsifiable predictions enforced at the single ledger-write chokepoint; measured on horizon; graded; calibration feeds back into the evidence bar.

S9 · Rhythm: standup + conductor

Invariant. A per-tenant daily standup generated from the roster diff (plan vs actual, Part 3 §3.6); a conductor that writes missed rows and escalates — the dead-man’s switch on every beat, itself independently scheduled and health-checked.

S10 · Resilience monitors

Invariant. Part 7 §7.3. Circuit breakers on every external dependency; a liveness monitor gated on flag+dependencies (a paused agent is not a false alarm); a delivery-throughput monitor that checks set-relationship invariants (drafts ≫ ships? per-entity churn? coverage %?), not just absolute-zero counters.

4.3 Core record schemas (portable)

-- S1: the action ledger. The heart of the record.
CREATE TABLE agent_actions (
  id TEXT PRIMARY KEY,
  scope_id TEXT NOT NULL,                   -- tenant/project
  role_key TEXT NOT NULL,
  action_type TEXT NOT NULL,
  input TEXT, output TEXT,                  -- JSON; include chain-of-thought where available
  model TEXT, tokens_in INTEGER, tokens_out INTEGER, cost_usd REAL,
  duty_run_id TEXT,                          -- ties action back to the coverage contract (Part 3)
  outcome_type TEXT NOT NULL DEFAULT 'none', -- canonical vocabulary per domain (Part 0 §0.7)
  outcome_value TEXT,                        -- ref/ID of the verified terminal row
  created_at TEXT NOT NULL
);


-- S2: cross-role cooperation — the only path for unowned levers.
CREATE TABLE executive_requests (
  id TEXT PRIMARY KEY,
  scope_id TEXT NOT NULL,
  from_role TEXT NOT NULL, to_role TEXT NOT NULL,
  lever TEXT NOT NULL, params TEXT, rationale TEXT,
  status TEXT NOT NULL DEFAULT 'open',      -- open | accepted | rejected | expired
  resolved_by TEXT, resolution_note TEXT,
  created_at TEXT NOT NULL, resolved_at TEXT
);


-- S3: every gate decision.
CREATE TABLE validation_log (
  id TEXT PRIMARY KEY,
  scope_id TEXT NOT NULL,
  artifact_kind TEXT NOT NULL, artifact_ref TEXT,
  passed INTEGER NOT NULL,
  hard_block_rule TEXT,                     -- which deterministic rule fired (if any)
  failed_lens TEXT, score REAL, revision_count INTEGER DEFAULT 0,
  created_at TEXT NOT NULL
);


-- S6: the event bus.
CREATE TABLE agent_events (
  id TEXT PRIMARY KEY,
  scope_id TEXT,
  event_type TEXT NOT NULL,                 -- MUST be a value from the exported typed union
  payload TEXT,
  status TEXT NOT NULL DEFAULT 'new',       -- new | claimed | consumed | dead_letter
  consumer_duty TEXT,                       -- the duty that consumed it (names the consumer)
  created_at TEXT NOT NULL, consumed_at TEXT
);


-- S7: the human oversight surface.
CREATE TABLE approval_queue (
  id TEXT PRIMARY KEY,
  scope_id TEXT NOT NULL,
  kind TEXT NOT NULL, payload TEXT, preview TEXT,
  tier INTEGER NOT NULL,
  status TEXT NOT NULL DEFAULT 'pending',   -- pending | approved | rejected | expired
  decided_by TEXT,                          -- REQUIRED on any terminal status ('system:expired' counts)
  decided_at TEXT, expires_at TEXT, created_at TEXT NOT NULL
);

(role_duties / duty_runs: Part 3. roles / agent_skills / agent_capabilities: Part 2. executive_decisions: Part 6. bos_config / config_snapshots: Part 8. Consolidated: SCHEMA.sql.)

4.4 Substrate design rules (learned the hard way)

  1. Chokepoints, not call-site discipline. Enforcement lives at the single function everything passes through (logDecision, applyLever, setConfig, the LLM client, enqueueAgenda) — never at N call sites, because the N+1th site will skip it (AP-1, AP-5).
  2. Typed constants across every seam. Event types, outcome vocabulary, lever keys, duty keys: exported unions both sides import. A string typo must fail the build, not bifurcate a bus (AP-3).
  3. Required fields over hopeful fields. If a reason/assertion/decided_by matters, make it NOT NULL (or CHECK-constrained) so the silent variant cannot be written (AP-7, §3.2).
  4. Filters must read fields that are actually written. Trace producer → field → sensor for every monitor; a sensor filtering on a never-written column is permanently, invisibly blind (AP-6). COALESCE nulls; better, constrain them away.
  5. Empty is worse than absent. Don’t ship a table before its consumer. Every queue names its consumer at creation time — with the roster, that consumer is a duty (S5/S6).