Operating Doctrine
Decision principles and operational gates. The canonical requirements remain frozen; the applicability notes describe the current institutional record.
Three Filter Levels
| Filter | Scope | Authority | Execution trigger |
|---|---|---|---|
| Constitutional Filter (3 gates) | Strategic — initiative level | Absolute; evidence cannot bypass | Once at initiative charter registration. Evaluates whether the proposed initiative satisfies foundational capability, correctability, and mandatory exit requirements before resources or repositories are created. |
| Correctability Check (4 gates) | Tactical — architectural decision level | Tactical constraint per-decision | Only when crossing defined decision thresholds: (a) blast radius extends beyond a single module/service, (b) estimated rollback time exceeds 1 engineering day, or (c) a new external interface or dependency is introduced. Routine low-blast-radius commits bypass formal check. |
| Project Decision Filter (8 gates) | Milestone — infrastructure commitment | Milestone gatekeeper before promotion | At infrastructure commitment transitions: (a) prototype promoted to shared platform/infrastructure, (b) deployment serving external users or external data, or (c) resource commitment exceeding 3 months of runway. |
Seven Principles
ACTIVE NOW / Decision obligations; operational checks follow the thresholds above.
Correctability is senior to capability
- CANONICAL DECISION TEST
- Before any significant commitment, write down: the failure signal, the blast radius, the rollback cost, and the exit path. If any are undefined, the commitment is not ready.
Use dependencies aggressively. Keep exits mandatory.
- CANONICAL DECISION TEST
- For every dependency above a criticality threshold: what is the documented path out, and what does it cost today?
Complexity must earn its existence
- CANONICAL DECISION TEST
- Before adding a new component, service, or abstraction — what is the simplest working system that proves the hypothesis? Start there.
Reality outranks the narrative
- CANONICAL DECISION TEST
- For every belief driving a major decision — what evidence would cause us to abandon it, and how quickly would we see it?
Intelligence is a latency reducer, not a destination
- CANONICAL DECISION TEST
- Which latency cell in the discovery → reality loop does this actually reduce? Name the cell. Measure it before and after.
Every project must leave Ostrium more capable
- CANONICAL DECISION TEST
- At project close, which compounding output did we produce? See RESEARCH §Capability Ledger for the full ledger schema and current entries.
Optimize for decades, not demos
- CANONICAL DECISION TEST
- Would this decision still look correct in ten years if the landscape changed significantly?
Eight Project Decision Gates
Prototype promotion to shared infrastructure; deployment serving external users or external data; or resource commitment exceeding three months of runway.
The gate applies at a commitment transition. Publication of a requirement does not certify that it has been passed.
Durable capability
- APPLICABILITY
- ACTIVE WHEN TRIGGERED
- CANONICAL QUESTION
- Does Ostrium become meaningfully more capable?
- PRINCIPLE / PURPOSE
- Prevents shipping without compounding
- TRIGGER
- Prototype promotion to shared infrastructure; deployment serving external users or external data; or resource commitment exceeding three months of runway.
- ENFORCEMENT / PUBLIC NOTE
- Document the reusable artifact and its intended capability. Independent demonstration remains blocked while the ledger reviewer role is vacant.
- CURRENT EVIDENCE STATE
- No gate certification is asserted here. BLOCKED — ROLE VACANT: Adversarial Ledger Reviewer
Future options
- APPLICABILITY
- ACTIVE WHEN TRIGGERED
- CANONICAL QUESTION
- Can we change our minds later?
- PRINCIPLE / PURPOSE
- Preserves optionality
- TRIGGER
- Prototype promotion to shared infrastructure; deployment serving external users or external data; or resource commitment exceeding three months of runway.
- ENFORCEMENT / PUBLIC NOTE
- Record future options, rollback cost and intrinsic irreversibility before commitment.
- CURRENT EVIDENCE STATE
- No gate certification is asserted here. The initiating project must provide its commitment record.
Detectable failure
- APPLICABILITY
- ACTIVE WHEN TRIGGERED
- CANONICAL QUESTION
- Will we know when the thesis is wrong?
- PRINCIPLE / PURPOSE
- Forces falsifiability
- TRIGGER
- Prototype promotion to shared infrastructure; deployment serving external users or external data; or resource commitment exceeding three months of runway.
- ENFORCEMENT / PUBLIC NOTE
- Record the failure signal, measurement method and detection window.
- CURRENT EVIDENCE STATE
- No gate certification is asserted here. The initiating project must provide its commitment record.
Containable failure
- APPLICABILITY
- ACTIVE WHEN TRIGGERED
- CANONICAL QUESTION
- Can the mistake remain local?
- PRINCIPLE / PURPOSE
- Limits blast radius
- TRIGGER
- Prototype promotion to shared infrastructure; deployment serving external users or external data; or resource commitment exceeding three months of runway.
- ENFORCEMENT / PUBLIC NOTE
- Record internal and external blast-radius ceilings. Bound external effects before execution.
- CURRENT EVIDENCE STATE
- No gate certification is asserted here. The initiating project must provide its commitment record.
External dependency exit
- APPLICABILITY
- ACTIVE WHEN TRIGGERED
- CANONICAL QUESTION
- Can every external dependency be replaced at bounded, tolerable cost?
- PRINCIPLE / PURPOSE
- Prevents operational entrapment
- TRIGGER
- Prototype promotion to shared infrastructure; deployment serving external users or external data; or resource commitment exceeding three months of runway.
- ENFORCEMENT / PUBLIC NOTE
- Document and test a bounded exit from every external dependency.
- CURRENT EVIDENCE STATE
- No gate certification is asserted here. The initiating project must provide its commitment record.
Right bottleneck
- APPLICABILITY
- ACTIVE WHEN TRIGGERED
- CANONICAL QUESTION
- Are we attacking the constraint that actually matters?
- PRINCIPLE / PURPOSE
- Prevents Amdahl violations
- TRIGGER
- Prototype promotion to shared infrastructure; deployment serving external users or external data; or resource commitment exceeding three months of runway.
- ENFORCEMENT / PUBLIC NOTE
- Identify the targeted latency class and measure the relevant workflow before and after.
- CURRENT EVIDENCE STATE
- No gate certification is asserted here. The initiating project must provide its commitment record.
Kill condition
- APPLICABILITY
- ACTIVE WHEN TRIGGERED
- CANONICAL QUESTION
- What observation makes us stop?
- PRINCIPLE / PURPOSE
- Forces commitment to falsifiability
- TRIGGER
- Prototype promotion to shared infrastructure; deployment serving external users or external data; or resource commitment exceeding three months of runway.
- ENFORCEMENT / PUBLIC NOTE
- Pre-register the decisive observation that stops or narrows the initiative.
- CURRENT EVIDENCE STATE
- No gate certification is asserted here. The initiating project must provide its commitment record.
Sustainable runway
- APPLICABILITY
- ACTIVE WHEN TRIGGERED
- CANONICAL QUESTION
- Does this preserve enough operational runway to reach a meaningful falsification point? Does it avoid dependencies or commitments that collapse within the research horizon?
- PRINCIPLE / PURPOSE
- A killed organization cannot run 18-month experiments
- TRIGGER
- Prototype promotion to shared infrastructure; deployment serving external users or external data; or resource commitment exceeding three months of runway.
- ENFORCEMENT / PUBLIC NOTE
- Document runway, dependency stability, talent continuity and reversible commitment.
- CURRENT EVIDENCE STATE
- No gate certification is asserted here. The initiating project must provide its commitment record.
Threshold Controls & Bootstrap Blockers
These controls derive from the principles and research requirements. They do not renumber the project decision gates.
Independent capability review
- APPLICABILITY
- BLOCKED BY BOOTSTRAP
- TRIGGER
- A claim of Capability demonstrated or independent certification.
- ENFORCEMENT
- BLOCKED — ROLE VACANT: Adversarial Ledger Reviewer
- CURRENT STATE
- Independent completion is not certified by this presentation.
Independent class selection
- APPLICABILITY
- BLOCKED BY BOOTSTRAP
- TRIGGER
- Third-party capability-class selection for TC-H validation. A precommitted algorithm remains a distinct canonical alternative.
- ENFORCEMENT
- BLOCKED — ROLE VACANT: Capability Class Selector
- CURRENT STATE
- Independent completion is not certified by this presentation.
Self-improvement containment
- APPLICABILITY
- BLOCKED BY BOOTSTRAP
- TRIGGER
- Any experiment testing recursive or self-modifying capability, before it begins.
- ENFORCEMENT
- BLOCKED — ROLE VACANT: Termination Mechanism Holder 1 BLOCKED — ROLE VACANT: Termination Mechanism Holder 2
- DETECTION LATENCY BOUND / CANONICAL
- How fast can the loop run? Detection must be faster than one full iteration. If it cannot be, the loop cannot run unsupervised.
- BLAST RADIUS CEILING / CANONICAL
- What is the maximum effect of one undetected bad iteration? This must be bounded and documented before the experiment starts.
- OUT-OF-BAND INDEPENDENT TERMINATION MECHANISM / CANONICAL
- A verified interrupt entirely outside the control loop and execution environment of the system under test — such that the system cannot modify, disable, intercept, or acquire authority over it — must exist and be verified to halt execution before any self-modifying run. Must be held by two reachable, named individuals from the Institutional Role Registry (MANIFESTO §Institutional Role Registry).
- ROLLBACK CHECKPOINT / CANONICAL
- A verified rollback to the pre-experiment state must be demonstrated before the experiment begins, not after a failure.
- CURRENT STATE
- No qualifying self-modifying execution is documented in the current public research record. The frozen Manifesto records both termination-holder roles as vacant; qualifying runs are categorically blocked.
Independent constitutional audit
- APPLICABILITY
- BLOCKED BY BOOTSTRAP
- TRIGGER
- Non-provisional constitutional certification and scheduled independent audit.
- ENFORCEMENT
- BLOCKED — ROLE VACANT: Independent Constraint Reviewer
- CURRENT STATE
- Independent completion is not certified by this presentation.