Rule 24: what is being built, and a feature list of what that needs

[OpenCnid]

The build converged on the nearest familiar shape — a retrieval system with a fact store bolted on — because the target was written in records a construction decision never had to open. This adds the target as a rule, a feature list of what it needs, and the audit that found the drift.

The occasion was my own error. Hours after ratifying the slice/frame layering, I wrote into config.py that "a corpus arrives in ~500 round trips per GB" — presenting a bound as the lever for bulk transfer, an operation this architecture does not have. DATA_MODEL §6 is titled "The bounded materialisation exception" and says so in its first paragraph.

Rule 24 — what is being built

AMBIENT.md gains rule 24: Trellis is an agentic knowledge-work system over a large context of domain-specific user information — a toolset the user works with, not a retrieval system with a fact store bolted on. Two sentences carry it and one act falsifies each:

• A query produces a deliverable, not a reply. A schema that can only carry a string cannot carry a deliverable — so a terminal action requiring non-empty prose, an artifact envelope with one hardcoded text part, and an answer sink rendering a single value each make it false.
• The worker queries the corpus; it never transports it.

The collaborator wrote the charter sentence; the falsifiable clauses are what make it a rule rather than a description.

It is numbered last and printed first, deliberately. Rule 20 already names this failure for measurement — reach for a comparison because it is closer to hand than a target. Rule 24 is the same ordering one level up, and burying a target where construction cannot see it is the error itself. Fitting it compressed this file's least-decisive prose rather than growing past the ceiling (rule 22): 8,070 / 8,192.

What four read-only sweeps found

docs/architecture/, the prompt surface, the REPL-sandbox records, and the runtime — plus a fourth arm whose only job was to disprove the diagnosis. That arm changed the conclusion.

The diagnosis holds where it matters. No model anywhere is told what it is building (grep -i artifact over src/rlm/ returns two docstrings about module packaging). The deliverable is a string by schema at every layer. ITERATION BUDGET instructs the worker to collapse turns, against the doctrine's "composed over several turns."

And it is much narrower than "rebuild." The successor worker layer already has the corpus locate, a bounded narrow window, text-free get_ast_blocks, byte metering in both directions, and an llm_query whose context slot is typed Handle so a string cannot fit — built, with no non-test caller, while production spawns the legacy path. Grounded authoring is the response artifact done correctly for one case: a run with zero retrieval affordance that writes a multi-file directory. So the doctrine is implemented one layer down and one layer over from where the model actually lives.

A defect found while assessing the turn budget. When a run exhausts its iterations, rlms re-prompts the model over the whole transcript and returns that as FINAL_ANSWER — bypassing the answer channel: no literal check, no cap, no telemetry, no protocol violation. More turns spent composing means more chance of landing on the guard-free path, so the iteration budget cannot be widened before this is closed.

The feature list

docs/product/FEATURE_LIST.md — eight capability groups, every row marked shipped, built, unreachable, partial, absent, or PLACEHOLDER. Written before security hardening on purpose: a hardening pass over an unspecified feature set yields a queue of follow-ups rather than a boundary.

Collaborator answers folded in: the artifact is a Trellis-side object with A2A as one rendering; an artifact carries standing — filed as a fact, a belief, or a doubt — so §3 and §6 are one subject and artifact provenance rides machinery that already exists.

One conflation named. STANDING_MODEL.md is ratified with a status line authorizing no build, and its §3 says what that covers: the reduction "removes shipped engine surface", so deleting disposition code needs its own authorization. The gate is on a removal. Surfacing doubts/beliefs/facts as REPL state spaces is an addition, already designed in DATA_MODEL §7 as three pre-allocated root handles, and no gate covers it. It was never scheduled, not never approved.

Corrections to records written earlier in this branch

• answer.submit(H) does not exist. Three places cited it as the route for bulk content; submit takes an expression string and renders a value, with no handle argument. The doctrine's wholesale hand-off is unbuilt, not capped — and an unbuilt escape hatch reads exactly like a built one.
• The corpus is not bounded by address space. A layering table asked what corpus size RLIMIT_AS permits, putting the corpus inside the namespace — the one place the handle model says it never is. RLIMIT_AS bounds the working set.
• TEST_TIME_TRAINING §12.2 is withdrawn from the audit. I read a literature-applicability argument as a workload target. §12.2 argues LaCT's long-context results do transfer — a claim about research relevance. TTT is a mechanism for rule 24's second sentence, not a counterweight: the composed prompt sets the mode, the model self-plays over REPL data, and properly filtered programmatic slicing is the rewarded behaviour, scored by RLVCG. It targets a local open-weights model that does not exist yet.
• charge_outbound fires only for the llm_query prompt, so the answer is not on the exfil ledger, and THREAT_MODEL already calls the 64 KiB cap output-shaping "not a confidentiality or escape control." The collapse lives in DATA_MODEL §6 alone.

Verification

• pytest 1,042; vitest 1,416 / 119 files.
• check:repo-surface PASS (0 issues), AMBIENT.md 8,070/8,192.
• wiki:check --check-html PASS; density-trellis C12 and C13 updated alongside the code that made them stale, leaving C11 (from Route the front door to where the rules now live #189) and the seven fff40f4 left git-stale on purpose.
• Every quotation re-read from the tree it cites, including all four module statuses and DEFAULT_SELECTION.

Nothing here is authorized beyond the rule and the framing repairs. No prompt bytes, no engine change. §5 of RESPONSE_ARTIFACT.md states that, and states plainly that the record has no enforcing surface.