Reading Index
Chapter summary: This index offers role-based reading paths, chapter descriptions, and a vocabulary map so humans and agents can retrieve only the material relevant to the task at hand. It covers the founding Grounding-first transition (00–11) and the working-surface, reasoning, knowledge, retrieval, uncertainty-representation, and capability-governance doctrine that grew from it (12–37). See the root README for the genesis and full arc.
The suite is intentionally divided into short, stable chapters. Agents should not load the whole directory into every prompt. Select the chapters whose authority is necessary for the current task, then retrieve live code and state for implementation detail. A UI claim is not settled by an accessibility-tree query alone — chapter 18 requires looking at the rendered view.
Reading paths
Product and architecture review
Read the abstract, development history, and target architecture. These chapters explain why the older index-centered design existed, why its lessons remain valuable, and why authority moves to Grounding and Storify now.
Grounding implementation
Read the target architecture, Grounding contract, and phases 1–3 of the refactoring program. Finish with the relevant tests in validation and acceptance.
Storify implementation
Read the current-state analysis, Grounding contract, and phases 2–4 of the refactoring program. The source-authority and no-index acceptance cases in validation and acceptance are mandatory.
Readiness, journey, or UI implementation
Read the target architecture, phase 4 of the refactoring program, and compatibility and future evolution. These changes are incomplete until generated capabilities and reasoning artifacts agree with the UI.
Index deletion
Read the entire refactoring program, especially its deletion gate, followed by the agent operating guide and validation and acceptance. Do not begin from a filename search and delete outward; prove replacement consumption first.
The Score, and composing a cut
Read the Score (the one working surface; the timeline and Cut as lenses; the Cut composes a take; every projection reads it — "has one cut"), then the beat and its arrangements (the beat anatomy and the take it fires) and animating truth (how the read is felt). Anything the writer sees or operates is also governed by the stage presents the act. The Cut is not a return of the retired patch-graph canvas — it is a lens and a second lane of the one surface.
Visual, UI, or design work
Read the stage presents the act first — it is the enforceable floor (the act is the star; the glasses test for type and hit targets; progressive disclosure; one act in focus; relationships drawn, not implied; verify by looking in light and dark). Then animating truth, the Score, and the specific surface's chapter. A machine-readable accessibility tree is the necessary but never sufficient half of accessibility; passing it is not passing legibility.
Copilot implementation
Read the target architecture, Grounding contract, the Copilot implementation extension, the situated Copilot, and Copilot capability governance, then follow chapter 10's mandatory discovery procedure before editing. Work that places the Copilot on a surface, or changes what she says when she arrives, is governed by chapter 15 and must satisfy its acceptance as well. The Copilot must reuse existing application operations and the same authority chain; it is not a second workflow engine. The behavioural, relaunch, no-index, and capability-parity acceptance cases in validation and acceptance apply.
Model lanes, cost, and task-based model selection
Read on-device first, and the writer's key — Reframe selects the best eligible model for the task from live capability, budget, credential, and health facts; paid is the default when available, bounded local execution is an internal economic optimization, and an explicit local-only instruction overrides it. It is governed together with the situated Copilot (the opener names the true elected lane and cost before spending).
Training the on-device model to the writer's work
Read training perspectives — a trained LoRA adapter is a perspective (a lens learned from the writer's material), authored by intent, adopted only on evidence (shadow comparison + eval gate), legible, and reversible; it is the on-device path to quality, the sibling axis to on-device first, and the writer's key (which governs the lane and cloud escalation).
Preferences, settings, and configuration
Read no preferences, only reasoning — Reframe has no panel where the writer configures how the app decides; the app reasons decisions in context and the writer instructs it in dialogue. The only stored settings are facts the app cannot reason into existence (credentials, storage location, account state), on a lean Accounts & Storage surface. It generalizes ch.20 (the lane) and ch.21 (training) into the rule both instance.
Turn routing, intent classification, the Copilot's understanding of a turn
Read one reasoning — a turn is understood by ONE reasoning over ONE complete taxonomy, and everything routes from that single decision; no speculative "fast" pre-classifier with a smaller vocabulary that fires first and misroutes, no cascade of reflect* passes racing to grab the turn. It is what makes ch.20's writer's-key recognition reachable and the sibling of ch.22 (no stored toggle for a decision; here, no fast pre-guess for the reasoning).
Intent uncertainty, clarification, escalation signal
Read the reasoning is an uncertainty map — the one reasoning (ch.23) produces an uncertainty map over what the writer could want (settled / ambiguity / thin / failure + why + what would resolve it), not a scalar confidence; the app routes from it (settled→dispatch, ambiguity→clarify, failure→fail visibly), it is the signal the writer's-key escalation (ch.20) reads, and it is inspectable/showable (UncertaintyScoreKit / FCIS-AX). This is also why the one reasoning can run lean.
UncertaintyScoreKit UX, arbitrary ledger lanes, and Reframe binding
Read a want is a gap in a ledger first — it makes the ledger collection open-ended and explains why a lane is only a ledger's drawing, never a fixed kind of doubt. Then read every gap keeps its address: the arbitrary-lane rack, shared-spine map, composite lane/note selection, stable selected-thread account, generic-kit/Reframe boundary, and the rule that chat records collaboration around the map rather than becoming its only state surface. Visual implementation is also governed by the stage presents the act, Apple's Human Interface Guidelines, and FCIS-AX.
Code review
Read current state and refactoring problem, the relevant target contract, and the phase exit criteria in the refactoring program. A review should reject dual authority, hidden index reads, numeric context shaping, or readiness claims that are not persisted.
.claude and .codex
Read the agent operating guide first, then follow the task-specific path above. The guide explains authority precedence, planning discipline, evidence expectations, and the rule that historical documentation is never operational state.
Release, publication, or “what can the App do?” review
Read the released surface is a named build, then validation and acceptance, Copilot capability governance, and the Copilot capability audit skill. The command catalog is an inventory; the release manifest is the only authority for what a named build ships.
Public publication and source-boundary review
Read public publication and private source policy, then the released surface is a named build and validation and acceptance. Use this path when changing what the Book, governance repository, or a public projection may expose.
Scenario execution, ownership, or acceptance integrity
Read validation and acceptance, the Reframe scenario development cycle, and scenario run ownership and non-interference. Use this path when a live scenario is being driven, resumed, interrupted, diagnosed, or promoted. The runner owns terminal classification; intermediate observations do not establish failure; and any unrecorded intervention invalidates the run.
Instrument creation, kit promotion, or capability publication
Read the FCIS-KIT Instrument Store, instrument creation, the Reframe scenario development cycle, and validation and acceptance. Use this path when creating, extracting, releasing, consuming, admitting, or publishing any bounded instrument. The instrument-creation chapter is the generic governance contract; the agent skill with the same semantic role is the procedure that applies it. A particular instrument is an instance, not the workflow definition.
Chapter catalogue
| Chapter | Purpose |
|---|---|
| Abstract | Compact statement of the decision and completion condition. |
| Development history | The architectural eras, retained lessons, and superseded assumptions. |
| Current state and problem | What the runtime does now and where index authority still leaks through. |
| Target architecture | Stage ownership, data flow, authority boundaries, and final invariants. |
| Grounding contract | The persisted profile, identity rules, prompt relationship, and invalidation semantics. |
| Refactoring program | Ordered implementation phases, affected seams, deletion gate, and exit criteria. |
| Agent operating guide | Instructions for .claude, .codex, and human collaborators. |
| Validation and acceptance | Required unit, integration, store, UI, live-provider, and negative evidence. |
| Compatibility and evolution | Legacy-store policy, archival behavior, rollback, and rules for future extensions. |
| One Store Authority Across Repositories | The shared Fountain-Store Swift authority for explicit selection, identity, readiness, leases, receipts, recovery, and Reframe's product-specific intents. |
| The Book Library Is Reframe's Sole Reading Provider | Defines the separately hosted curated reading boundary: provenance, publication switches, generated OpenAPI, Reframe import, FountainStore boundary, migration, and the prohibition on generic web reading. |
| The Writer Enters by Intention | Defines the new Reframe landing and Copilot-first Book Library discovery: writers ask by meaning, Copilot semantically searches grounded publication metadata, provider IDs stay internal, on-device help comes first, and AX plus rendered visual review are both release gates. |
| Open-Turn Mediation Protocol | Defines the reusable mediation boundary for first contact, interruption, nonsense, correction, ambiguity, and spontaneous change of mind before any existing capability or lane executor acts; Copilot mediates on the right, drives the left projection, and keeps direct web reading out of Reframe. |
| The Fountain-Coach Git Library and Reframe Project Flow | Defines the Fountain-Coach-owned Git project service, Swift Git boundary, Copilot project views, Library candidate/release flow, explicit authored export, custody, accounting, and migration. |
| The Fountain Editor Is the Project Surface | Defines Reframe as the left-pane Fountain editor projection with Copilot as the right-pane mediator, managed Git as versioned transport, and the Book Library as publication authority. |
| The Fountain Project Round Trip | Closes the governed Library → Reframe → Compose → Fountain Project → Git → Library lifecycle with explicit identities, provenance, transformation, no automatic feedback loop, and a projection-left/Copilot-right surface. |
| The Reframe Maintenance Control Plane | Defines the authenticated maintenance API, Preferences/SecretStore boundary, Reframe and skill clients, authorization, receipts, rollback, migration, and the separation from the public Book Library source API. |
| FountainMaintenanceKit — Portable Swift Maintenance Contract | Defines the reusable FCIS-governed Swift package boundary, native Git target, SecretStore protocols, host adapters, platform profiles, migration, and acceptance gates for the maintenance control plane. |
| FountainProjectKit — Durable Fountain Project Custody | Defines the reusable Swift custody boundary around FountainEditorKit: immediate creation persistence, edit flush, interruption and relaunch recovery, AX save truth, and the separation of working drafts from Git and Book Library publication. |
| The Copilot as Writing Coach | Merges the writer-facing Copilot role with the default Grounding stance and internal Dramaturg realization discipline: Grounding governs attention, the Coach mediates and teaches, and realization remains grounded, accountable, and writer-controlled. |
| FountainImagePublicationKit — Reframe Image Cloud and Publication Boundary | Replaces the retired Apple Photos/iCloud handoff with Reframe's hosted Image Cloud: paste/selection intake, cross-platform Swift client/server contracts, rights-aware AI provenance, EU disclosure, preflight, delivery receipts, and migration-safe hosting. |
| FountainComposerKit — Remote Attachment Custody and the Composer Boundary | Makes the Copilot composer the single typed ingress for text, images, and files; admits attachments to remote cloud custody before pipeline use; keeps only references and evidence locally; and defines the reusable cross-platform Swift boundary. |
| The Reframe E2E Scenario Is the Publication Unit | Makes a versioned, prerequisite-complete E2E scenario the first artifact for every Book command: AX-driven interaction, state-based waits, paid-lane consent, FountainStore and window-ID evidence, one-run provenance, honest statuses, and a sanitized Book coverage projection. |
| The Book of Reframe Is a Dual Projection | Keeps the Book public for humans while giving Reframe a reviewed, role-gated maintainer projection from the same commit and digest; neither projection replaces runtime authority or independent evidence. |
| External MIDI2 Control of Reframe | Defines Reframe as a negotiated MIDI2 peer: external operation ingress, internal mediation and lane policy, FountainStore lifecycle authority, MIDI2 event projection, AX/window-ID witness, and the scenario-first gates for claiming full live drivability. |
| Reframe-to-Reframe Software-Peer Acceptance | Defines the two-process software-peer conformance topology, separate process and Store authority, independent witnessing, scenario-first gates, and the boundary between software-peer acceptance and unproven hardware interoperability. |
| MIDI2 Peer Projections and Capacity Admission | Defines the projections surface as the semantic peer boundary, generic and clonable MIDI2 endpoints, Reframe as the default software-peer fixture, capacity-governed admission, and AX/Store/MIDI2 evidence requirements. |
| The Reframe Scenario Development Cycle | Makes the versioned scenario the reusable development unit across commands, capabilities, system boundaries, projections, and failure/recovery paths; keeps executable YAML beside the implementation, the Book as projection, and a separate scenario repository out of scope unless a new conformance authority is governed. |
| Conversational Scenario Authoring Is the Development Surface | Defines the scenario as a human-readable executable prompt-contract: conversation is the authoring surface, YAML/JSON are compiled projections, semantic dependencies preserve movements/questions/passages/locations, and the runner executes meaning without becoming a hardcoded scenario interpreter. |
| The Reframe Design Mock Is a Governed Projection | Defines the deterministic default design mock: current Reframe workspace, proposed semantic illustration rollout, visible not-live boundary, reproducible renderer inputs, and the strict separation from AX, Store, MIDI2, Image Cloud, and live scenario evidence. |
| Private Image Prompt History | Narrows prompt retention only for the private image.prompt.history capability: exact authored prompts may be recovered from protected FountainStore history, never from receipts, telemetry, logs, manuscript, or public Book projections. |
| Copilot implementation extension | Extends the refactor to the conversational Copilot: perception, retrieval, action parity, discovery procedure, and acceptance. |
| Grounding as a given | Refines the Grounding authoring model: a canonical manifesto shipped as the default given, auto-confirmed on import, edited centrally as prose, never model-dissected. |
| Animating truth | Perceived performance: never sign a wait with a spinner. Render the frame and cheap/cached truth instantly; foreshadow the unknown as honest, animated structure whose motion maps to real work. Nothing that is not the manuscript may delay the manuscript; absence may not overwrite a truth already held; a click lands in its destination. |
| Storage and performance | Locks the storage layering — document layer = plain-text bundle + single manifest; musical layer = MIDI 2.0 — and the performance doctrine: reads are fast architecturally (cache-first, one manifest, no serial fan-out), not by encoding. |
| The beat and its arrangements | One beat, three arrangements: a single widget anatomy whose only differing part is its measure; the take — one firing that renders the document and musical layers as siblings. Its patch-graph canvas (rules 7–9) is superseded by chapter 17; the beat anatomy and take are retained. |
| The situated Copilot | One Copilot, differently placed: she perceives the arrangement hosting her and what is wired into the conversation there, opens in words that fit the place, offers nothing whose object the surface does not show, and states an empty situation rather than filling it. |
| The timeline is the machine room | Making beats IS the machinery and the timeline is where it is seen: one machinery, one surface. No machine room, factory gate, engine view, run report, or heartbeat line; diagnostics may drive behaviour but never become a surface; unreachable surface is deleted, not kept. |
| The Score | The performance space of the work, and the ONE working surface: the timeline and Cut become lenses of it (the patch-graph canvas is retired); a lane is a participant, not a track; the beat/arc is the structural spine every participant is grounded to; protocol state (MIDI 2.0) is composition. Defines the minimum honest Score — grounded spine + one Text participant from the source — with the distributed multi-participant stage named as horizon, not increment. |
| The Stage Presents the Act | Legibility over density: a surface presents the ACT the writer is performing, not a console. Enforceable floor — the act is the largest/central element; the glasses test (min type + hit-target sizes); progressive disclosure of per-object machinery (no permanent hieroglyph rows); one act in focus at a time; relationships are DRAWN, not implied by a glyph; and every visual change is verified by LOOKING at the rendered view (light + dark), never by the accessibility tree alone (the machine-readable half is necessary, never sufficient). |
| Apple Human Interface Guidelines | The HIG is Reframe's baseline visual/interaction standard — the floor beneath chapters 12/14/17/18, not an alternative. Adopts the specifics our chapters implied: system text styles (macOS Body = 13pt), contrast ratios (4.5:1 text / 3:1 controls / aim 7:1, verified in light, dark, AND Increase Contrast), 44pt hit targets where touch/accessibility reach, semantic system colours (never colour-alone, never hard-coded), the 8pt grid, system materials, purposeful motion that honours Reduce Motion, SF Symbols, VoiceOver. Reconciles each against our chapters, notes where Reframe is deliberately stricter (the no-spinner rule), and records the gaps to close (Reduce Motion, contrast audit, migrate hard-coded sizes/colours). |
| On-Device First, and the Writer's Key | The on-device model is the FIRST lane — the default that must work on its own (a manuscript read, discussed, composed with no cloud at all). Cloud is a widening of perspective and the writer's money, so the writer holds the key: no cloud call without an explicit grant the writer gives/revokes in dialogue (default local-only). When on-device leaves real uncertainty, the Copilot may OFFER to escalate — a decision reasoned on-device over the UncertaintyScoreKit map, never a hard-coded benefitsFromCloud/preference-order table. Apple's on-device→Private Cloud Compute escalation, with the key in the writer's hand. Every surface names the ELECTED lane before spending; fail visibly, never silently spend or fabricate. Also governs CUSTODY of the key (§Where the key lives): the Keychain via SecretStore is the only place a credential is read from — no environment variable, no config file, no other app's auth file — and a plaintext key found on the machine is reported, never silently consumed. |
| Training Perspectives | A trained LoRA adapter is a perspective — a lens the on-device model wears, learned from the writer's own material, to read/write THEIR work better. The sibling axis to ch.20: not which lane, but how the on-device lane gets better, and the on-device path to quality (the alternative to cloud escalation). Authored by intent ("learn my voice from these scenes"; the app reasons the training plan, expert knobs behind disclosure), adopted only on evidence (readable shadow comparison + passed eval gate; a perspective that doesn't beat the base is rejected), legible (provenance: what it learned, from what, how it compared), and reversible (worn per role, base never mutated). Cloud training is gated by the writer's key (ch.20); fail visibly, never silently fall back to base as success. |
| No Preferences, Only Reasoning | Reframe has no preferences — no panel where the writer configures how the app decides. A stored toggle for provider / reasoning-visibility / command-autonomy / guide-policy / model-tuning is a decision frozen into config, the anti-pattern ch.20/21 reject. The app reasons decisions in context; the writer instructs in dialogue (understood by meaning, scoped or standing, revisable, remembered as an instruction with provenance). The only stored settings are facts the app cannot reason into existence — credentials, storage location, account state — on a lean Accounts & Storage surface (a credential is a fact, not permission to spend — that is the writer's key, ch.20). No retired toggle becomes an unreachable hidden default; expert machinery is demoted behind disclosure, not deleted. Generalizes ch.20 (lane) + ch.21 (training) into the rule both instance. |
| One Reasoning | A turn is understood by one reasoning over one complete taxonomy of what the writer can want, and everything routes from that single decision. No speculative "fast" pre-classifier with a smaller vocabulary (FastRouteTargetG) that fires first and grabs the turn; no cascade of standalone reflect* passes racing to be first. Multiple reasoners with divergent vocabularies disagree, and first-to-grab wins — which is how "stay on device" (turning the writer's key) became a segmentation, and content questions / "fix it" became reads. Retire the fast pre-pass and the competing reflections into one decision; the key-turn (cloudGrant) is a case in the one taxonomy, so it becomes reachable by construction. Cheap preconditions (deterministic guards) are fine; a second model reasoning over intent is not. If the one reasoning is too slow, make IT lean — never front it with a lossy guesser. Sibling of ch.22 (no stored toggle for a decision; here, no fast pre-guess for the reasoning). |
| The Reasoning Is an Uncertainty Map | The product of the one reasoning (ch.23) is an uncertainty map over what the writer could want — per-intent state (settled / ambiguity / thin / failure) + reason + resolvedBy — not an opaque verdict or scalar confidence. Route from it: settled→dispatch, ambiguity→clarify (ask, don't guess), thin→proceed/offer, failure→fail visibly (a window overflow is a loud failure, never a segmentation). Ambiguity (a real two-way split) and failure (a breakdown) are different in kind. This is why the reasoning can run lean — it needs only the taxonomy + message + minimal state, never the execution manifest (that loads in the dispatched producer). The map is the signal ch.20's writer's-key escalation reads (thin/failure whose resolution is a stronger model → offer to widen), and it is inspectable/showable via UncertaintyScoreKit + FCIS-AX so the writer decides on real evidence. Fuses ch.23 (one reasoning) + ch.20 (the key) + UncertaintyScoreKit into one law: the reasoning's product is an inspectable map of doubt, and the app acts from it. |
| The CoPilot Is the Surface | Every capability that was a panel, editor, or toggle lives in the CoPilot as dialogue: the CoPilot teaches the writer the capability (they don't arrive knowing "grounding," a "reader lens," a "trained perspective"), states its current value in plain language, is instructed to change it by meaning (scoped/standing, revisable), and shows the effect on the work. The constructive half of ch.22: retiring a panel is not enough — the capability must re-appear in conversation, taught and held there, or it's a lost capability. Persistence is invisible plumbing — the writer never hears "saved," "stored," "Preferences," or "confirm." Instances: the key (ch.20), perspectives/LoRA (ch.21), preferences (ch.22), and grounding/lenses (new — retire the baseline/grounding editor; the writer changes the lens by asking and the beats re-form). Onboarding is mandatory and in-context; expert machinery is demoted behind maintainer disclosure, never taught to the writer. |
| Internals Tune Themselves | The default disposition of any internal is reasoned — Reframe decides it dynamically, in context, at the moment it matters (output caps, routing, storify window, retries, budgets, reading shape) and can explain it; there is no setting. The writer meets a control only when their judgment is genuinely needed (a stance, a spend, a voice, a training intent), and then the CoPilot surfaces it contextually, teaches it, and asks — never a standing toggle. Turns ch.22 (no preferences) + ch.25 (CoPilot is the surface) into a disposition procedure (fact → reasoned → dialogic → maintainer → plumbing) and applies it to an audit of all 73 persisted settings. End state: Preferences collapses to a lean Accounts & Storage + Integrations surface plus a maintainer-only Developer disclosure — no routing panel, no tuning, no LoRA knob wall on the writer's path. Facts stay; reasoned values self-tune + stay explainable; genuine decisions go dialogic; maintainer machinery hides behind disclosure; runtime/learned state is never dressed as config. |
| Parse Before You Ask | Structure is parsed, meaning is read, and local non-generative tools measure what they can establish without invention; a higher reasoning is never asked what a lower tier can answer. |
| A Beat Is the Question It Raises | A beat is the span over which one story question remains open; atoms are local reading units and never promoted into named beats. |
| Beat Movement and the Uncertainty Overlay | Reconciles beat identity with UncertaintyScoreKit: grounded dramatic movement is primary; question movement is an optional, evidenced overlay that can be raised, carried, transformed, answered, deferred, or still open. |
| NaturalLanguage Measures, Storify Interprets | Measurement supplies candidates, coordinates and contradictions; only the reading interprets meaning or assigns uncertainty state. |
| The Living Gazetteer | The evidenced, revisable account of what the source has established to exist; it remembers the world without routing, judging, or silently filling its holes. |
| Compiled Knowledge | Hard, durable reasoning is compiled into evidenced project memory so the local lane improves for this work without pretending the model itself learned the world. |
| Referenced Knowledge | Knowledge outside the manuscript is retrieved rather than recalled, cited with the source's own words, and promoted only by the writer. |
| A Want Is a Gap in a Ledger | Uncertainty is collected from arbitrary registered ledgers; every gap carries a typed want naming who can close it, and a missing ledger reports failure rather than disappearing. |
| A Question That Leaves the Work | An outward question carries its work, measured doubt and bounded source passages; generated prose is discarded while fetched documents remain auditable. |
| Deep Search | A cited page begins the source reading; justified local reasoning follows source-internal links, records every reason, and states exactly why the search stopped. |
| Every Gap Keeps Its Address | The UI consequence of arbitrary ledgers: every gap keeps a composite lane/note address across an arbitrary-lane rack, shared-spine map, manuscript, typed want, evidence and decision. The kit remains generic; Reframe supplies domain context; complexity is represented at synchronized scales rather than flattened into fixed lanes or expanding chat cards. |
| Copilot Capability Governance | Current status and implementation perspective for joining the MIDI backplane IDL, application capabilities, Copilot verbs, runtime actors, contextual availability, and persisted evidence into one checked action contract. |
| Copilot Capability Audit Skill | Defines the repository-tracked audit skill and closure ledger that distinguish executable, live-accepted, unavailable, and drifted capabilities while planning the next widening batch. |
| A Model Cannot Be Told What It Cannot Do | Draws the line by KIND, not confidence: what the writer MEANS is a judgement the model makes; what Reframe CAN DO is a fact the app states from the registry. Where a fact exists, the app speaks it. |
| A Citation Is a Promise Someone Can Check | Outgoing citations: checked (retrieved and the quotation found) or visibly said to be unchecked — there is no third position, and a writer's "verified" flag is not one. Also governs the UNBUILT Copilot reading surface (§Showing the source): a rendered source is evidence the writer can check herself, never a browser, and never a way to set checked. |
| One Retrieval, Two Directions | Unifies incoming references (ch.32) and outgoing citations (ch.40) as one retrieval with two obligations: admissible before Reframe believes it, checkable before a reader is asked to. |
| What Is Already Recorded Is Read, Never Re-Derived | Doctrine that was available and unread is the most expensive failure on this record. What is written — in a chapter, in the store, under ch.08's evidence authorities — is read, not re-derived. |
| The Released Surface Is a Named Build | Separates runtime command inventory, governed capabilities, live acceptance, and the named-build release allow-list. |
| Copilot Reading Surface and Typography | Defines the two-pane Reframe surface: a Copilot-controlled source/reading/editor projection on the left and the conversational Copilot authority on the right. |
| Dynamic Grounding | Defines Grounding as a source-authoritative flow: default non-integrational reading, score-derived proposal, explicit /ground acceptance, new lineage, and persisted evidence. A lens is a hypothesis about the READER's blind spot — what the reading was attending to — not a description of the work or a summary of its open questions; the writer's own lens is authoritative and verbatim, and a hole in the reading is not a lens problem. |
| Situated, Mixed-Initiative Interaction | Defines Reframe as an open interaction space in which human turns may be corrective, interrupted, out of sequence, or unrelated, while only grounded live state and one mediated meaning may authorize mutation. |
| A Service Is a Fact, Not a Symptom | Registers every internal and external service Reframe calls, requires each call to carry its service, lane, cost and outcome as facts typed at the call site, and requires failures to be reported to the writer where she works — never re-inferred downstream from symptoms, and never answered by adapting her text. |
| One Definition, Two Projections | An operation is defined ONCE — in the reasoning manifest, which composes the IDL's mechanics (QoS, capability masks, budgets, correlation, chunking) with its MEANING (userMeaning, whenToUse, neverUseWhen, readOnly, mutatesState) under a declared precedence. The IDL is the first input, not the definition — and projected twice: onto a backplane topic and onto an OpenAPI-described HTTP route, both generated, never authored. The web does not speak MIDI 2.0 BY DEFAULT (midi2.js teaches it), so the HTTP surface is owed to the consumer who will not adopt it — a reason to project, never to define twice. A service binds by MIDI-CI Property Exchange, the market's own answer to "declare what you can do". Reframe is future-proofed by MIDI 2.0's negotiation semantics held as a projection; bound to UMP as THE transport the pillar becomes a cage. |
| Text Is Stored So It Can Be Pointed At | A store that can only return the whole work is not a data store for text. Measured: Ulysses is ONE record of 1,519,413 characters and 32,694 lines, so "open Circe" cannot be expressed as a fetch — only as fetch everything and look at part of it, which is why choosing a chapter opens the work at its beginning and why screenplay/lines.get overshoots its declared 65,536-byte budget by 23× on every read. FountainStore is not the limitation: its declared API already serves prefix/range scans with paging. So local text is ADDRESSED by ordered units whose identifiers sort in reading order — and a unit is a RANGE, never a payload: the authoritative source stays the bundle folder (ch.13) and the unit index is derived and rebuildable over it, holding offsets and never copies (ch.29); every fetch NAMES the span it wants and fetching more than commanded is the defect even when the display is right; selection is a STORE operation, not a client-side slice; the payload budget is binding, so an oversized answer pages instead of overshooting; structure is ASKED for rather than scanned for; and the operation is declared once in the IDL and projected by generation (ch.49), so no hand-rolled reader can quietly fetch more than it was told to select. Where no typographic boundary exists, the store records that fact rather than inventing a grid, and any mechanical cut is a recorded repair debt. |
| One Decision Decides the Lane | "Which lane serves this?" is answered once for the role and task from live facts. The result carries the elected model and its budget; ordered configured/permitted/credentialed/constructible/healthy gates may only narrow it, and refusals are typed rather than silent fallback. Paid availability is the default election for writer-facing work, while an explicit local-only instruction remains authoritative. Presence never elects a lane, naming never reads a secret, failures teach only what they evidence, and every surface prints the same recorded decision. |
| The Pencil Belongs to the Writer | A reader underlining marks FORWARD, IN IGNORANCE — salience not conclusion, mute (no caption, often unreconstructable later, and that is normal), cheap to be wrong about, layered across readings. The mark Reframe now emits is the exact inverse: made backward from a window the model has finished, asserting "these words raised this question", captioned, and expensive to be wrong about because a machine's mark reads as a finding. So it is NOT an underline — it is a CITATION (ch.40), and drawing it as a pencil stroke would be the app claiming to have attended to a page it has only finished reading. An underline was already three things here — evidence of a claim (producer removed with the semantic index), read-through progress (transient), and the new anchor — with the CoPilot's own help text spending a paragraph warning writers not to confuse them. The citation marks the beat's HEAD, never its body: measured on Circe 2026-08-08, threads run 20608→20815 while their anchors are 15–86 lines, and one thread opens 95 lines into its own passage. So the pencil is unclaimed, and it belongs to the WRITER: her mark says "this matters to me, I do not yet know why" — an instruction with an address (ch.46) that the app may notice and ask about in dialogue but never interpret, rank, or feed to a prompt as evidence. The two marks never share a visual language; absence stays absent; progress leaves nothing behind. |
| A Selection Snaps to Meaning | Reframe asks the writer to point at text — to mark, cut, cite, reframe it — and was asking her to do it CHARACTER BY CHARACTER with a mouse. That is an operability failure belonging to the app, not to her: a reader indicates a phrase, a line, a speech, a sentence, never a character offset, and requiring the offset excludes anyone whose hands or eyes are not perfect today. So a selection is SNAPPED to the smallest unit of MEANING containing what she indicated — whole words always, the sentence or speech when she barely selected anything — and the snap only ever GROWS outward to a boundary the text itself declares: never shrinks, never moves off what she touched. The boundary is PARSED, never asked of a model (ch.27), and MEASURED, never concluded (ch.29) — a tokenizer says where a sentence ends, not what it means. And where the text declares no boundary the snap STOPS AND SAYS SO: measured on this app's own shipped corpus, Ulysses' Penelope runs 27,287 characters with a single full stop, so "snap to the sentence" there would select the whole episode. The unit is chosen by what the text IS at that point — speech, stage direction, verse line, sentence — which makes it contextual rather than mechanical; it is shown before it is committed; a deliberate precise selection is honoured exactly; and no surface ever tells the writer her selection was wrong. |
| The Writer Does Not Manage the Projection | Reframe contains its own ledgers, providers, consent, batches, and rendering detail so the writer can navigate /readings, /ground, /world, and an offered /reference act as manuscript questions — without managing internal machinery — while every durable uncertainty note remains reachable through a bounded, honest, AX-verifiable projection. |
| Scenario Run Ownership and Non-Interference | An executable scenario has one owner and one bound run identity; Store/AX observations remain provisional while it runs; only declared terminal predicates classify it; and any unrecorded intervention invalidates acceptance. |
| The Scenario Runtime Is Swift and MIDI2-Native | Makes the scenario executor, Store preparation, lifecycle waits, evidence binding, and terminal classification an owned Swift capability using the same typed MIDI2 operation boundary as production peers; Python is transitional only, while AX/CoreGraphics remain independent witnesses. |
| Scenario-Driven Development Is Org Infrastructure | Names the organizational consequence of the scenario cycle: a portable, released Swift/MIDI2 seam with product-local authority, independent evidence, public/maintainer projections, historical context, and a future of negotiated software peers. |
| The Default Semantic Manuscript Projection | Fixes the default Reframe workspace as a continuous Courier/Fountain manuscript with semantic Questions, Movements, and Read coverage navigation, Copilot on the right, MIDI2 peers below, and no A4 cards, horizontal timeline, or Slugline application chrome. The signature illustration is design evidence only. |
| The Universal MIDI2 Command Plane | Makes MIDI2 the common command and lifecycle boundary for every Reframe capability, distinguishing MIDI-CI peer discovery from operation execution, preserving mediation and FountainStore authority, and requiring all clients to converge on one typed operation contract. |
| Remote MIDI2 Reading Rooms | Defines the useful multi-user product boundary over Reframe's MIDI2 peer infrastructure: shared semantic projections, human roles, writer authority, secure web transport, privacy, reconnect, and the read-only acceptance gate. |
| Storify Source Auto Reads a Defined Whole | Governs immutable Book Library admission, named source ranges, structural measurement, hierarchical semantic reasoning, MIDI2 resource receipts, and terminal evidence for Storify Source Auto. |
| The Apple-Native Semantic Pipeline Is One MIDI2 Graph | Governs the refactoring boundary before implementation: Apple-native measurement, paid extension, typed MIDI2 stage identities, portable kit ownership, receipt lineage, and the acceptance order for the composed Storify pipeline. |
| The MIDI2 Monitor Is the Live Event Mirror | Defines the Swift-owned MIDI2 Monitor as the live event boundary between negotiated transport, durable FountainStore proof, the AX-visible peer mirror, and independent scenario evidence. |
| CodexKit Is a Governed Codex App-Server Boundary | Governs the proposed reusable Swift kit for a pinned Codex app-server runtime, its FCIS-KIT boundary, security and packaging rules, and the Reframe MIDI2/Store/AX adapter evidence required before any capability claim. |
| The Codex Auth Instrument Is the Copilot Login Surface | Governs the host-facing Codex authentication instrument: Swift-owned MIDI2 lifecycle, Copilot-first interaction, WebKit/system-browser projection, credential safety, Preferences retirement, and the independent Store/AX/monitor evidence required before a login claim. |
| Independent Security Review Is a Separate Acceptance Boundary | Separates local fixture and boundary tests, the internal adversarial instrument, independent security review, European conformity-assessment routes, Reframe live acceptance, and named-build release; defines the public/private boundary, evidence states, and stop conditions for the Codex auth instrument. |
| The FCIS-KIT Instrument Store Is the Capability Plane | Defines the governed capability distribution model: Reframe as host, FCIS-KIT as construction and admission boundary, MIDI2 as operational language, scenario-first creation, local/remote instruments, evidence lineage, and the boundary between architectural milestone and released marketplace. |
| Fountain Coach Publication Estate | Defines the semantic relationship between the TLD and specialized subdomains, the shared publication-template contract, cross-domain authority edges, and CI/deployment gates. |
| Instrument Creation Is a Governed Promotion Path | Defines the generic scenario-first lifecycle for creating, testing, admitting, releasing, consuming, and publishing any bounded Fountain Coach instrument; examples remain instances of the workflow. |
| Credentialed Infrastructure Operations and Provider Adapters | Defines the provider-neutral SecretStore and Copilot authorization flow, provider-specific infrastructure adapters, signed host installation, evidence, rollback, the owner-controlled operational-production tier, and the later independent-review boundary for security-reviewed/public claims. |
| FountainStore Is the Headless Linux Persistence Authority | Governs the supported headless Linux FountainStore service, typed configuration, Store identity, readiness, authentication, diagnostics, systemd lifecycle, and the separation between persistence authority and ingress. |
| SwiftACMEKit Is a Provider-Neutral Certificate Automation Boundary | Governs the proposed standalone Swift ACME package: provider-neutral RFC 8555 lifecycle, pluggable transport/storage/challenge/crypto boundaries, protected account and certificate custody, HTTP-01, renewal, mock and staging evidence, and the separation from host TLS deployment. |
| Provider-Neutral Host Bootstrap and Enrollment | Defines the provider-neutral first-boot bootstrap and explicit host enrollment boundary: cloud-init/provider adapters, no writer-facing SSH, scoped SecretStore credentials, existing-host migration, host-agent operations, revocation, rollback, and evidence. |
| Apple-Native Markdown Presentation and Transferable Engraving Rules | Governs semantic Markdown/Fountain parsing, Apple-native WYSIWYG text rendering, injectable layout policy, transferable engraving principles, and the boundary from Copilot text to ScoreKit and Teatro projections. |
| Decoupled Manuscript Instruments — Navigation, Source, and Uncertainty | Defines Reading Navigation, Source View, and the independent UncertaintyScoreKit SVG Lane View as three coordinated instruments sharing source identity and semantic addresses without duplicating rendering authority. |
| Semantic Scenographer — Think with the Work in Space | Defines the downstream Teatro-backed instrument that turns source-addressed dramatic and semantic relations into inspectable spatial propositions without replacing Source View or making uncertainty a second navigation system. |
| TeatroStageEngine Is the Stage — Semantic Scenography Extends It | Fixes the implementation boundary: Teatro is the broader composition/rendering ecosystem, TeatroStageEngine is the canonical physical stage runtime, and Semantic Scenography extends that engine instead of creating a parallel RealityKit or renderer authority. |
| Semantic Inference Execution, Session, and Latency Governance | Defines one execution contract for local and Codex semantic lanes: warm runtimes with isolated source-window contexts, typed terminal events, exact provenance, resumable evidence, and comparable latency measurement. |
| FCIS-KIT Semantic Factory and the Wired Instrument Event Stream | Defines the external SemVer FCIS-KIT composition of library, admission, parsing, semantic reading, and persistence instruments, with one correlated MIDI2 lifecycle stream mirrored by MIDI2 Monitor and proven by FountainStore. |
| MIDI2 Event Time, Jitter, and Asynchronous Completion Governance | Defines MIDI2 sequence and correlation as ordering authority, monotonic time and jitter as measurement, heartbeat as observation, and typed terminal event plus FountainStore receipt as asynchronous completion. |
| Semantic Scenographer — One Spatial Thought in Reading Order | Defines the single writer-facing spatial-thought marker, source-addressed structured scene, TeatroStageEngine handoff, and blank-page coaching guardrail against turning spatial thought into a reward signal. |
| Teatro MIDI2 Monitor — Canonical Runtime Projection | Defines the typed MIDI2-to-Teatro runtime score, deterministic spatial grammar, live/replay parity, provenance inspector, performance safeguards, and explicit separation from Semantic Scenographer interpretation. |
| Creating the Canonical Teatro Stage Composition Layer | Governs creation of the missing source-addressed composition layer joining Semantic Scenographer, TeatroStageEngine, physics hosts, deterministic projections, provenance, and replay; explains why ImageGen illustrations are editorial projections rather than scene authority. |
| Reframe Is a Swift-Native Cross-Platform Runtime | Establishes Reframe as a portable Swift semantic runtime behind a platform host boundary, makes MIDI2 and FountainStore the cross-host semantic spine, identifies current Apple-framework leakage, and sets clean macOS/Linux core-runtime build and test as the first portability gate. |
| NaturalLanguage Measurement Is a MIDI2 Instrument | Governs macOS NaturalLanguage as a host adapter whose source-addressed structured evidence crosses the typed MIDI2 instrument boundary and becomes durable FountainStore evidence without making the framework semantic authority. |
| Three-Run Semantic Drift Is a Governed Measurement Principle | Requires exactly three concurrent, independently identified readings of one source address before semantic drift is calculated; preserves all three results, correlations, provenance, and incomplete states. |
| Evidence Cohorts Are the Publication Units of the Fountain Coach Estate | Extends the publication estate with evidence-cohort semantics: the TLD declares roles, Governance defines predicates, and the Book and sibling domains project only the state established by complete durable evidence. |
| Skill and Maintenance Capabilities Are Kit-Owned | Makes ReframeSkillKit and FountainCoachMaintenanceKit normative: typed kit ownership is required before implementation, admission, release, or publication; agent skills are procedural projections only. |
| Governance Becomes an Executable Scenographic Policy | Converts the existing Semantic Scenographer doctrine into a versioned typed Kit policy enforced by ReframeCore and realized by TeatroStageEngine, preserving source address, uncertainty boundaries, provenance, and deterministic projection. |
| Server-Side Semantic Proposals — Mac and Linux as One Reframe Runtime | Defines Storify as a writer-facing semantic proposal instrument: deterministic observations support model reasoning, FountainStore preserves evidence, MIDI2 carries asynchronous execution, and macOS/Linux host one portable runtime. |
| Semantic Browser Is a Governed MIDI2 and FountainStore Instrument | Establishes Semantic Browser as a Reframe instrument with deep MIDI2 lifecycle integration, FountainStore evidence custody, replaceable platform browser engines, and downstream indexing/semantic interpretation boundaries. |
| FountainStore-Owned Estate Edge and ACME Promotion | Makes FountainStore the durable estate publication authority and native edge: local candidate, secondary Store promotion, dynamic host-aware routing, ACME/TLS, external DNS, rollback, and Semantic Browser equivalence remain distinct evidenced operations. |
| FountainStore Snapshot Export and Git Recovery Projection | Defines typed Store snapshot/export, production-side Git recovery custody, private GitHub off-host mirroring, scenario and attachment permanence, verified restore, and the rule that Git remains a recovery projection rather than a second Store or publication authority. |
| European Cybersecurity Profile: Authority, Continuity, and Recoverability | Adopts a non-destructive European risk-based engineering profile: explicit authority, recoverable evidence, eligible openness, protected capabilities, purpose-limited personal context, and evidence-backed continuity without claiming legal compliance or certification. |
| The Scenario Pipeline Factory | Defines reusable named pipeline composition: existing scenarios, typed stage roles, serial execution, FountainStore continuity, human-facing reconciliation, and the boundary between composition and scenario authoring. |
| The Internal Triadic Peer Dialogue | Defines the internal dialogue contract joining user intention, a replaceable companion agent, and Reframe through the Composer: role provenance, MIDI2 transport, mediation, Copilot presentation, and evidence boundaries. |
| The Dynamic MIDI2 Instrument Factory | Defines Reframe's generic MIDI2 instrument boundary and the portable Swift factory that batches creation, build, admission, and evidence without adding a per-instrument Reframe switch. |
| The Governed Semantic Transformation Instrument | Defines the deterministic MIDI2 instrument that transforms semantic publication State A into State B, while keeping WebKit rendering and FountainStore/deployment logistics outside semantic authority. |
| Commands Must Be Legible to Reasoning | Defines the MIDI2-native command declaration standard that lets companion agents reason over live commands, conduct grounded dialogue, select one existing operation, and follow it to terminal evidence. |
| MIDI2-Timed WebKit Transitions | Defines the boundary in which the semantic transformer decides what changes, MIDI2 discovers and schedules visual slots, Teatro plans motion, WebKit renders the full web surface, and AX plus FountainStore prove the settled result. |
| The Store Publication Graph | Defines the typed Store graph that maps a selected route from one admitted domain to another as a reversible State A → State B publication, with atomic promotion and separate DNS/HTTPS evidence. |
| The Fountain Coach Organization Web Projection | Defines the human-facing organization projection: agents administer through typed Swift/FCIS-KIT operations, Git preserves source history, FountainStore preserves governed projection state, and the browser remains a read-oriented face rather than an authority. |
| The Estate Template Is the Publishing Path | Defines the CMS-shaped publishing norm: domain records enter the institutional Fountain Coach Publication Core, Personal Pointer remains the adjacent founder publication and design provenance, and routes reach public state only through AX/VRT, metadata proof, and route-scoped FountainStore promotion. |
| The Deployed Estate Is a Read-Only WebKit Mirror Authority | Defines the read-only HTTPS/DNS/WebKit observation boundary, dual State A/B capture, deterministic semantic/image diff, and exact-mirror acceptance claim. |
| Native Animated SVG Is a Governed Publication Projection | Defines native animated SVG as a deterministic, accessible projection of an admitted publication object, with script-free defaults, reduced-motion parity, complete static route bundles, and Store-backed atomic promotion. |
| Human–Machine Scenario Naming Is a Governed Identity Boundary | Defines the stable relationship between a writer-facing scenario name, Reframe's live command declaration, one typed MIDI2 operation, the owning FCIS-KIT identity, and terminal FountainStore evidence. |
| Remote SecretStore Authorization and Approval Sessions | Defines the cross-operation approval-session and short-lived credential-lease boundary for local and remote SecretStore custody, including phone approval and redacted terminal evidence. |
| EstatePublisher Is Codex’s Governed IP-Network Topology Mutator | Defines the human, Codex/agent, EstatePublisher, and joining-device roles; IP-network discovery and mutation; MIDI-CI/MIDI 2 boundaries; enrollment; record creation; and acceptance proof. |
| Each Joining Machine Is a Governed MIDI2 Instrument | Makes MIDI2 instrument admission the precondition for EstatePublisher: named native instrument, signed artifact and identity, authenticated peer readiness, MIDI-CI capabilities, FountainStore lifecycle proof, and the handoff into Chapter 140. |
| FountainAuthKit: Fountain Coach Is Its Own Governed OAuth/OIDC Authority | Proposes the reusable Swift-native FCIS-KIT authorization and identity boundary: upstream authentication remains distinct from Fountain authorization; OAuth/OIDC discovery and grants are resource-bound; MCP, HTTP, MIDI2, and infrastructure authorities remain separate; human mediation, key custody, safe FountainStore lineage, recovery, adversarial review, and scenario-first acceptance remain explicit. |
| Simplicity Is Key: One Bootstrap, One Trusted Session | Corrects the security ceremony boundary: one owner bootstrap may establish one bounded remote-vault session; normal operation produces no repeated Keychain or human-approval prompts; rotation, recovery, scope expansion, and re-enrollment remain explicit trust transitions; ACME remains TLS-only. |
| Fountain Media Service Is the Governed Media Plane | Defines the Media Service as the compilation and delivery plane for inspected, content-addressed derivatives and truthful progressive readiness, while FountainStore remains durable authority, EstatePublisher remains sole promotion authority, Teatro remains a projection client, and MIDI2 carries lifecycle only—not media bytes. |
| One Estate, One Publication State: EstatePublisher and Reframe as a Governed Semantic Browser | Joins EstatePublisher's single estate-wide publication state to Reframe's Semantic Browser and Copilot: EstatePublisher publishes, every domain reflects, and Reframe observes and mediates without becoming a second publisher. |
| Local FountainStore, Remote Caddy: The Production Static Estate | Establishes the static-production profile: local FountainStore authors and preflights, EstatePublisher/FCIS-KIT promotes one immutable release, remote Caddy serves it, and Reframe observes it; the Store-native profile remains explicit until migration is proven. |
| Local Route Materialization: EstatePublisher Preview Before Check-In | Governs the existing local estate.preview.draft-refresh and estate.preview.draft-check-in operations: one typed route patch supports update or create, FountainStoreHTTP remains read-only, and remote publication remains separate. |
| Remote CodexKit: Reframe and Codex Meet as Governed MIDI2 Peer Instruments | Extends the existing CodexKit and Reframe iPad boundaries across MIDI-CI and RTP-MIDI2: CodexKit remains the app-server boundary, streaming remains lifecycle, disconnect/resume remain typed states, and complete remote acceptance requires durable evidence. |
| One MIDI2 Instrument Plane, Multiple Governed Transports | Establishes one transport-neutral governed MIDI2 instrument plane: RTP-MIDI2 remains admitted, Network MIDI 2.0 is the standards-facing target, transport discovery does not grant authority, and operation semantics remain invariant across transports. |
| Csound Teatro: Speaking Sound in Space | Governs the finite machine-readable sound/space grammar joining canonical entities, Scenario admission, physics, Csound, WebGL, Ear, MIDI2 and Store evidence while keeping local deterministic interpretation as the guaranteed provider-independent path. |
| The Host Is the Instrument | Governs the host as the authority for terminal, filesystem, process, build, git, Scenario, publication and optional Codex capabilities, reachable through independent admitted Reframe and ChatGPT lanes without constitutional dependence on a commercial relay or model provider. |
| Domain Admission and Edge Binding Are Separate Governed Capabilities | Establishes hostname identity as an explicit estate capability before DNS, certificate lifecycle, or serving effects; separates domain admission, Chapter 96 ACME lifecycle, provider DNS, and edge binding so the estate composes services instead of manufacturing authority from deployment side effects. |
| Domain-Neutral Local-Model Reasoning Testing | Defines the offline, domain-neutral harness in which a local model reasons from a supplied MIDI2 contract and grounded state, emits only a typed candidate/clarification/refusal, and is checked by native resolution in direct and MIDI2 loopback modes without performing effects. Publication state is supplied by the hosting projection metadata, not by this reading index. |
| The Matrix and EstatePublisher Are One Governed REST Projection | Defines the Matrix FountainStore as observed state and EstatePublisher as the executable native projection, with generated OpenAPI addressability that preserves MIDI2, Swift-kit, adapter, Store, receipt, and unavailable-state authority. |
| FCIS 156 — The Writer Never Operates EstatePublisher | Defines the writer-facing semantic boundary: intention is resolved through the authoring surface to an admitted native operation; EstatePublisher executes it; FountainStore proves it; and the interpreted result returns to the writer. The rule generalizes to every scenario matrix. |
Vocabulary
Canonical source means the imported manuscript stored under the source document identity. It is evidence, not a work surface for generated analysis.
Grounding Profile means the writer-confirmed policy document that directly governs downstream interpretation. It is not a summary of the source.
Storify Source Auto means the chapter-aware structural reading that converts source atoms into kept/noise decisions, beats, uncertainty, synopsis, and arcs.
Cut Script means the mutable, authored draft product assembled from chosen Storify units and later composition.
Continuity means the audit over Cut Script or other explicitly selected units. It is not a substitute source reader.
Legacy semantic artifacts means index passages, reading states, semantic memory, published semantic objects, repair debt, and index performance memory created before this refactor. They may remain inspectable, but they have no authority in the final pipeline.