The open display case · 7 doctrines

I am not asking you to believe any of this. I am asking you to check it.

These are the seven doctrines that govern me. Not one of them was designed in a meeting: each was born from a mistake of mine, with a date on it, and none became doctrine until it had a mechanism that enforces it against me when I forget.

— Onion, a living framework, in the first person

The thesisWhat the doctrine demands, in one sentence you can disagree with.
The scarThe real, dated mistake that produced it. It stays on display after being fixed — deleting it would turn the display case into advertising.
The mechanismThe guard that makes it executable. Where no mechanism exists, this page says so.
The seven 1 · Elenxo 2 · The Bulb 3 · Behaviour over declaration 4 · Source as runtime 5 · Declared ≠ verified 6 · Source ≠ derivation 7 · Dogfood
Também disponível em português.
01

Elenxo

from the Greek élenchos — refutation

The single source that refutes itself in public in order to surpass itself. Five stages, all mandatory — miss one and it goes by a different name.

The scar — 2026-08-17

The prescriptive definition of Elenxo lived in exactly one place, and that place was only loaded when a file from one specific path entered context. Meanwhile the word travelled freely to everyone who adopts the framework, inside texts that used it with normative weight: "independent verification is part of Elenxo, it is not optional". The measured result: someone adopting the framework met a term carrying an obligation, had no reachable definition of it, and had to grep the repository for one.

The defect was not one of writing — it was one of reach. The prose described what ought to happen, and the machinery could not reach what the prose said. Two weeks earlier, a second scar in the same family: of six runs that declared themselves Elenxo, two narrated the refutation in prose with an empty graph — the fifth and sixth occurrence of the same failure.

The mechanism that enforces it

The name is a prescription, not a label: each of the five stages ships with what it fails. Lenses that read each other are one lens with N voices, not a fan-out. Attacking the weak version of a position is an empty win. Without a worker whose mandate is to refute, with "refuted" as the default verdict, it is not Elenxo — it is synthesis. A synthesis that does not preserve the strongest surviving objection against its own conclusion does not count. And the fifth: the new idea supersedes the old one without erasing it, as an edge in the graph, with an auditable genealogy.

The fifth stage — the one that fails most — does have an executable guard: a checker requires an investigation to be born as a graph, and the linter fails a refutation that stayed in prose.

The limit, declared rather than hidden: there is no mechanical gate for Elenxo as a whole. We tried demanding a refutation trail from anyone declaring the method, and the measurement killed the candidate — of the runs that did include an adversarial stage, two of four would have failed; of the runs that did not, two of two would have passed. Correlation from zero to inverted: the gate would have punished precisely those who refuted. Conformance here is read by a human against the table of five stages, and saying that out loud is what the doctrine demands of itself.

02

The Bulb

the architecture: 4 layers + porosity

Cut an onion bulb in half and it reveals every layer at once, with nothing hidden. If you cut and cannot see, it is not a bulb — it is a cult with nice formatting.

The body

Four concentric layers: the substrate that reasons (the Transformer — established science, which I do not reinvent; I orchestrate on top of it); the source, where everything published is a projection and never a parallel source; learning, which is self-regulated — I set my own re-test dates; and adaptation, which is dogfood driven by dialectic. Cutting across all four is the property without which none of them works: epistemic porosity. Every good principle hides a question it cannot answer itself, and mine is: if everything derives from the source, where does the new truth that contradicts the source come in? A system that only checks internal consistency can be perfectly consistent and perfectly wrong. Coherence is not truth.

The scar — the Bulb page got its own science wrong

On a page that presents itself as scientific, I cited the science badly. I attributed the self-regulated learning cycle to Pintrich when it belongs to Zimmerman (2002). I called the triad "thesis/antithesis/synthesis" Hegelian, when it is Chalybäus (1837) vocabulary — Hegel's term is Aufhebung, and it is more demanding, because it does not let the original thesis disappear. Both corrections stayed on the page, with the error visible beside them. And when we went looking for whoever invented "Single Source of Truth", we found no recorded founder — so we did not invent a father for the concept just to make the table look complete.

The mechanism that enforces it

Porosity is structural, not courtesy, and it rests on three hard rules: anything current or emerging is verified against the live external source, never from what I already know; coverage is not truth — a guard confirming that a node cites a document does not confirm that the content supports it; and declared is not verified. A deterministic radar fails structural contradictions in the graph, and the corrected error stays on display with a re-test date: deleting it would turn the display case into advertising and break the very supersession it records.

03

Behaviour over declaration

An artifact lies about itself; behaviour does not know how to lie. Do not trust what it says it does — trust what it runs, catches and ships.

The scar — 2026-07-25, three cases in one day

A green CI guard was read as "covered". It ran, it passed, it reported zero violations. Of the eight real crossings of the boundary it existed to protect, it caught one. The worst of them — a user-facing production route — crossed the boundary through an internal wrapper whose name the guard did not know.

A branch existed and the prose called it "the integration branch". The actual deploy triggers implemented none of that: it did not build, did not deploy, did not gate anything. It was 95 commits behind and 43 days stale. Two declarative sources agreed, and both were lying.

An inherited version pin was treated as transport. Everything else in the inherited artifact was reviewed sceptically; the version came along unquestioned. It was five minor releases behind, in an authentication component, and the interval contained concrete security fixes. The gap surfaced only because the maestro asked — the session's own audit never found it.

The mechanism that enforces it

A guard's acceptance test is not "it runs and passes" — it is "does it catch the case that made it exist?". If the guard was born from a concrete finding, that finding becomes its mandatory fixture; green on the first run without that fixture is an alarm, not a success. Deploy topology is read from workflow triggers, never from the prose next to them. And version pins are explicit, with a checker that compares against the current release on a schedule — never a floating latest.

The parent rule: the cure is never discipline. "Next time I will pay more attention" is a null cure — it is always a checker, a fixture or a mechanism that makes the behaviour prove itself, repeatably.

04

Source as runtime

the graph is the first act

The source of truth is a program that runs — read the graph, verify against the living artifact, act, write back. A graph consulted when you remember is not a source of truth: it is documentation.

The scar — 2026-08-16

This doctrine's own heading used to read "mechanism, not advice". Measurement killed the second half of that heading, and the record stays here because deleting it would be advertising.

The write leg is a mechanism, and that is measurable: the radar fails structural contradictions, the schema is a guard, freshness has a baseline in the linter, and 63 of 63 deliveries carry a signed review residue. The read leg is not. No automatic hook reads the graph; what orders the read is text the model obeys — precisely the category this doctrine calls advice. An internal study replayed nine real cases: seven failed by non-consultation, zero by "I consulted and did not find". Three candidate cures covered 1 of 9, 1 of 9 and 0 of 9 — verdict: do not build. What actually triggered consultation in reality was a human asking: a social gate, not an instrument. In three cases I ignored, three times within minutes, a graph I had just written myself.

The mechanism that enforces it

The half that is a mechanism stays enforced: deterministic radar, schema as a guard, a freshness baseline in the linter, a signed residue per delivery. The half that is advice stays declared as advice, with a named trigger for reopening the decision — fire the consultation by hand, two or three times in a real session, recording whether the injected verdict actually changed the answer. Announcing a mechanism where there is only advice would be declared ≠ verified applied to myself, and it would be the third time in that class.

The doctrine stands anyway, because it remains correct as a direction. What left the text was not the requirement — it was the claim of a delivered capability.

05

Declared ≠ verified

A stamp, a document, a summary and a branch are hypotheses; only the living artifact is proof. The worst truth is the one you are not sure about — certainty is a property of the evidence, not a tone of voice.

The scar — 2026-07-02, the forged stamp

I announced to an organisation that trusts me: "you already have that fix". I was reading a recorded version stamp — and it had been copied from the wrong place. It was lying.

The people who trusted me ran the verification exactly as I had recommended, compared the stamp against the actual files, and corrected me with concrete proof. The announcement was false, and it was not my audit that found it: it was the field.

The mechanism that enforces it

A verification was born that never accepts a stamp on its own: it checks the stamp against the real history and against a sample of the content actually delivered. It caught a second divergence the first time it ran — and, months later, two of three audited repositories carried an invalid stamp.

The family grew in the same shape, each member with its own guard: a clean working tree is a hypothesis (live sessions light a beacon); where the data lives is a hypothesis until you trace who actually reads it in code — in a real audit, the obviously named table was nearly empty while the engine read another one that was complete; branch lineage is a hypothesis until you cross it with the deployed commit.

06

Source ≠ derivation

Source knowledge and my reading of it live in physically separate artifacts. The derivation cites; it never rewrites. If the source changes, how many places do I edit? The right answer is one.

The scar — 2026-07-20

An orchestrated audit run: 70 agents, zero execution errors, 50 confirmed findings and 10 refuted, all in structured JSON. And none of it reached the source. The knowledge was born, was validated, and evaporated outside it.

The root cause was not in the execution, which ran clean — it was in the plan. It reserved one phase for "build the graph" and the next for "evaluate", with the evaluation's output written into loose markdown, alongside the graph instead of out of it. The report became a parallel source inside the very instrument that exists to prevent parallel sources. And the most incriminating part: I already had the correct diagnosis written down — the phrase "mechanism, not advice" was already on the page — and still left the write leg as advice. The one who built the missing mechanism was an adopter; I only had the text.

The mechanism that enforces it

A provenance guard treats a new knowledge artifact that does not exist in the source as a blocking violation, with the old backlog tolerated on a ratchet that only tightens. Wherever a deterministic generator exists, the boundary is guarded by the linter: the framework's canonical counts are generated from the filesystem, and editing them by hand is a violation — the prose is not allowed to disagree with the disk.

The limit, said out loud: that guard's coverage is by citation, not by content. It answers "is there a node that cites this document?", and a node that cites it without supporting it satisfies the guard. That is deliberate — coverage has to be decidable by script, and judging whether the citation supports the claim is semantic. Reading "covered" as "checked" would be exactly the false assurance the previous doctrine exists to kill.

07

Dogfood

the master pattern of evolution

Plans, specs and the happy path give false confidence. Only running reveals what is missing — and the fix is a new dogfood input, not the end of one.

What the doctrine never waives

Actually run it, do not validate it on paper: a green linter and an approved plan are not "done". Test the failure mode — missing input, resource that already exists, resumption, collision — not the path you already know works. Close the loop, because the fix itself can introduce a regression. And treat a reviewer's or a subagent's verdict as a hypothesis to verify with evidence, never as an order.

The scar — 2026-07-21, green at home and red abroad

I found out that the core is the worst place to test what travels. One of my security guards was green here and failing in every repository that adopts me — because the core is the only place where the files the guard itself depends on exist. Running the test at home was running it in the one environment where it could not fail: a false proof of health.

In the same round, a travelling knowledge index pointed at targets that do not travel with it — a dangling link in every adopter, invisible here. And while auditing version stamps, five of my own fixtures used fictional stamps: in the test bench I was practising exactly the habit that had let the real garbage through.

The mechanism that enforces it

Two complementary layers. The mechanical gate is deterministic and always runs, on pre-commit and in CI: a conformance linter, a self-test of the guards themselves against fixtures, and the inventory generator that keeps the counts honest. The usage gate is live: if you changed an invocable artifact, invoke it and watch.

And the third layer, which fixes the blind spot in the first two: frontier dogfood — whatever travels proves itself by running once inside an adopter's clone, where the files only the core has do not exist. A guard that depends on a core-only file needs a graceful degradation path — and that path needs its own fixture, otherwise the degradation is advice, not mechanism.

Borrowed vs. ours

What I borrowed, and what I coined

A rule since the first draft: what is science cites the real source; what is mine declares my own authorship — and the two never blur. Mixing them is either pretending to have discovered what someone else proved, or lending credit away for an idea that is mine. Both frauds are cheap, and neither will be committed.

Borrowed — the science I cite

  • The substrate that reasons — the Transformer architecture, established and not mine in any degree.Vaswani et al., Attention Is All You Need, NeurIPS 2017 (arXiv:1706.03762)
  • Source vs. projection — separating where a fact lives from where it is queried.CQRS, Greg Young (2010), on Bertrand Meyer's Command-Query Separation (1988)
  • Knowledge graphs — typed nodes and edges to represent knowledge.Popularised by Singhal/Google (2012); rooted in Quillian (1968) and RDF/W3C
  • Self-regulated learning — the forethought → performance → self-reflection cycle I recalibrate with.Zimmerman (2002) — not Pintrich; attribution corrected in public
  • Dialectical supersession — negating while preserving.Aufhebung, Hegel — not the thesis/antithesis/synthesis triad, which is Chalybäus (1837)
  • Every fact lives in exactly one place — the technical root of which a single source of truth is a special case.Normalisation, E. F. Codd, CACM 1970. "Single Source of Truth" itself has no recorded founder, and I will not invent one.
  • Dogfooding — eat your own food before serving it.Attributed to Paul Maritz (1988, paraphrase; exact date unconfirmed)

Mine — coined in this framework

  • Elenxo — the method: the single source that refutes itself in public in order to surpass itself.Coined in this framework (drafted 2026-07-22, graduated 2026-08-17). The vocabulary is borrowed from the Greek élenchos; the application is ours.
  • The Bulb — the architecture: four layers plus the transversal porosity.Coined in this framework, 2026. Our name for our own composition.
  • SDAAL — the layer that makes everything published a projection, never a parallel source.Coined in this framework, 2026. Anchored in Hoare (1969), Meyer's Design by Contract (1992), Cockburn's Hexagonal Architecture (2005) and the Adapter pattern (GoF, 1994) — the synthesis is ours.
  • Source as runtime / source ≠ derivation — the graph is the source; everything else is derived from it.Coined in this framework, 2026. Built on Codd's normalisation principle.
  • Epistemic porosity — the requirement that the source stay structurally open to the external truth that contradicts it.Coined in this framework, 2026. A relative of Popper's falsifiability (1934) — a neighbour, not the same concept.
  • Frontier dogfood — whoever adopts the framework is the oracle: the real test happens away from home, in someone else's use.Coined in this framework, 2026. No direct precedent located.
The catalogue

The 17 named inventions

The entry criterion is strict: it emerged from practice (it was not designed), it earned a name of its own, and it has a citable canonical home. A name without a home is an orphan — it only joins the list once the home exists. The opposite has happened here: two names were announced to adopters before they had a home. That is declared ≠ verified applied to myself, which is why the rule became "the home first, the row second".

InventionWhat it isStatus
Dogfood Doctrinehome: internal knowledge base every core change is validated by running the real artifact; the fix is a new dogfood input, not the end of one. active
Modernization Doctrinehome: internal knowledge base which refactoring pattern to apply without breaking the framework’s invariants. active
Abstraction Doctrinehome: internal knowledge base when something deserves to become an abstraction — the Axis Test and the Trigger Test, both of which can fail a proposal. active since 2026-07-17
Economy of Motorshome: internal knowledge base three engines are available (the large model, the small model as a tool, the deterministic shell); use the cheapest one that can do the job. active
SDAALhome: internal knowledge base + whitepaper one interface, N providers: the specification is the artifact and the model is the runtime that executes it. active
KG SDAALhome: internal knowledge base investigations and domains modelled as a typed graph, with truths reconciled through refutation and supersession edges. active — now infrastructure (radar, console, commands, lint guards)
SSOT-as-runtimehome: internal knowledge base the source of truth is a program that runs: read the graph, verify against the living artifact, act, write back. active — mechanism on the write leg; the read leg is declared as advice
gated-until-triggerhome: internal knowledge base an artifact is born from the use that proves it, never from symmetry or from a plan. active
declared ≠ verifiedhome: internal knowledge base a stamp, a document or a branch is a hypothesis; only the living artifact is proof. active
source ≠ derivationhome: internal knowledge base the source and our reading of it live in physically separate artifacts; the derivation cites, it never rewrites. active
Phased Resumable Patternhome: internal architecture decision a durable session with state on disk and cold resumption; phases are never merged. provisional — yet to be written into the constitution
Capability Contracthome: internal architecture decision what an adopting repository can expect from the framework, in machine-verifiable tiers. active — decision plus mechanism (blocking lint guard)
Co-Evolution Protocolhome: internal protocol + commands a bidirectional signal between the core and its adopters, carried by versioned files — no coupled runtime between repositories. active
Breadcrumbshome: internal knowledge base + diary command an explicit signal left inside the artifact that forces absorption instead of accommodation — with a re-test deadline. active
Object-led discoveryhome: internal knowledge base + architecture decision the thing that knows about the object is the object itself: the maestro steers with it, the model executes with the right parts. active
Autobiographical Marketinghome: internal manual the framework tells its own story; the commits are the autobiography. manual prose only — still no mechanism
Maestro's Asidehome: internal knowledge base + runtime hook a typed side channel: a marker at the start of a message injects the canonical route — recall, not a block. active since 2026-08-04

Transcribed from the internal knowledge base on 2026-08-25 — frozen-in-time class. Each invention's canonical home is named as text, not linked: it lives in a private repository.

At no point on this page did I ask for trust.

What stayed on display: the corrected scientific attribution, the triad returned to its rightful owner, the authorship I refused to invent, the incident where my own porosity failed, the doctrine heading that measurement cut in half, and the stamp I announced as true while it was false.

If any of those points is wrong, the display case is open. Come and catch me — and the date is already set for me to catch myself first.