Republic
An agentic governance plane for AI-driven software development
Rule of law for AI agents — version 1.0.1 — August 2026
RATIFIED v1.0 FINAL — Kyle Scott, 2026-08-13. Ratified from rc9 without amendment following the floor's cold read. Lineage: nine release candidates; two adversarial review rounds (seven reviewer-instrument passes, four external model families) fully dispositioned; two independent citation audits plus a 30-claim internal reference audit, zero support-class gaps; rendered under SPINE v1.2. This ratification is a chat-plane ruling recorded here until doc-set enrollment converts it to a decision record with a process_ref. Under the truth model this paper describes: this rendering is now the ratified instance; where it and the resolved record disagree, the record wins.
v1.0.1 (2026-08-14) — citation supersession, ratification unchanged: posture citations resolved to their landed IDs (SPEC-0122, SPEC-0123; SPEC-0128 reserved), atom count pinned to a named verification HEAD, mitigation stories cited as chartered. Release condition: publishes when the landing merge (PR #29) is on the public default branch, so every cited ID resolves for a verifying reader.
Kyle Scott · Eldritch Labs — written in collaboration with Claude (Anthropic): research synthesis, evidence grading, and drafting, under the author's direction; all rulings the author's, recorded in the document's version history.
Abstract
How much can you count on AI to deliver what you intended — and what does it cost when it doesn't? That question — not model capability — now governs whether AI-driven software development returns its spend [14][21]. The cause is a tooling deficit, not willful AI: the systems that make AI produce are everywhere; the systems that make sure it produces what was intended are not [18][21]. Stated formally, as this paper's market thesis: verification, not generation, is now the binding constraint on AI-driven software development.
The prevailing defenses are supervisory — in-context instructions, human review, self-authored memory — and each fails in a measured way: instruction-following degrades as context grows [1]; human oversight decays toward acceptance and review degrades under generation volume [2]; self-authored memory drifts and entrenches its own errors [3]. The same failure appears at organizational scale, in the market's own numbers. Republic takes the mechanism position — in Amazon's operational language, good intentions don't work; mechanisms do [22] — governance must be structural: constraints in the execution path, enforced by machine-checked gates at build time, spawn time, and on the wire, rather than by an agent's continued cooperation or a human's continued attention. The plane is built from a small set of primitives: immutable, versioned governed atoms; a temporal truth model in which the current state of anything is a query, never a mutable record; one entity type for humans and AI agents on an attenuating signing chain; and an enforcement plane running on git mechanics, generated indexes, and embedded gate libraries rather than any governance service. For every artifact it produces, it answers by query: who decided this, under what authority, executed by what, verified how.
The substrate is ratified and enforced, the build gate is live and emitting public evidence, and the containerized agent layer is the current front; the paper reports this state plainly, and closes with the criteria for proving its thesis wrong.
Introduction
If you have worked with AI coding tools, you have met the problem this paper exists to solve: the output that is almost right. Not wrong enough to discard, not right enough to ship — close enough to be tempting, wrong enough to cost the afternoon. Two-thirds of developers name exactly this as their top frustration [21], and it is the individual-scale symptom of the sector-scale question above: how much can you count on it, and what does it cost when you can't. This paper makes one argument, describes one system, and ends with one offer.
The argument (§§1–3). Every instrument pointed at AI-driven development — delivery telemetry, code mining, security scanning, adoption surveys — shows the same shape: generation accelerating while verification saturates. The governance sold to close that gap is overwhelmingly attestational — documents about systems, not constraints inside them — with almost no evidence that it works; and the regime best qualified to govern algorithmic actors has formally declined to cover this technology. §1 gives you the numbers worth keeping and what they converge on. §2 gives you a two-term vocabulary you can use in your next architecture review, and the strange fact of a vacated seat. §3 names the underlying condition in one sentence and states the two design laws that follow from it.
The system (§§4–7). A governance plane in which the constraint lives in the execution path: atoms instead of documents, gates instead of review queues, an identity chain on which authority can only narrow, memory that evolves freely but cannot quietly rewrite its past — and, at the center, a provenance chain that answers, by query, a question that goes unanswered in full by current systems: who decided this, under what authority, executed by what, verified how. §5 shows that the mechanism this rests on has already been measured, just never assembled. §7 reports what runs today, honestly, including what does not run yet.
The offer (§§8–9). We do not ask you to believe structural governance works. §8 states four falsifiable hypotheses with their measurements; §9 hands you the refutation criteria in full. The system emits evidence of its own performance as a side effect of operating — including evidence of failure, if that is what the record shows.
If you make toolset decisions, §§1–2 and §7 are your due diligence. If you build, §§3–6 are the machinery. If you hold the security veto, §4.4 and §4.6 were written in your vocabulary. And whatever your seat, the close hands you four tools that are yours to keep whether or not you ever touch this platform.
1. The state of AI-driven development, measured
Four methodologically distinct instruments — survey, telemetry, code-mining, and security scanning, with partially independent incentives — find the same shape. No single measurement settles this; the convergence does.
Adoption is saturated at the individual layer and a rigorous minority at the firm layer: 84–93% of developers use AI tools by survey and telemetry, while the strictest instrument in circulation, the U.S. Census Bureau's business survey, puts firm-level adoption at 17–20% (32% employment-weighted) [12]. Both statements are true; conflating the strata is how most public discourse goes wrong. Agentic deployment is smaller still — roughly 17% of organizations against 60%+ stated intent [14] — and abandonment is rising sharply: 42% of companies abandoned most of their AI initiatives in 2025, up from 17% the year before [13].
The delivery-level mechanics explain why. The largest longitudinal program found a 7.2% decrease in delivery stability per 25% increase in AI adoption in 2024; by 2025 throughput had turned positive while stability remained negative, and the program's own explanation is the thesis of this paper stated as a finding: without robust control systems — strong automated testing, mature version control, fast feedback loops — increased change volume produces instability. AI, in their summary, is an amplifier [9]. The code-level instruments show what is being amplified: refactoring fell from ~25% of changed lines to under 10% in four years while duplication rose sharply [10]; AI-generated code introduces known vulnerability classes in roughly 45% of cases, and — the trend that matters most — syntax correctness now exceeds 95% while security pass rates have sat near 55% across two years of model generations [11]. Capability scaling is not fixing the defect classes that matter — and even if capability improves, generation and verification should not share an ungraded trust boundary. Meanwhile the verification side saturates — review time ballooning, a substantial share of pull requests merging unreviewed [21] — and the perception gap closes the loop: in a randomized trial of experienced developers working in their own repositories, participants believed AI made them 20% faster and were measured 19% slower [15].
That last number is the market's failure mode in miniature, and it is the same failure the analysts name when agentic projects die. The predicted cancellation causes are not model capabilities: escalating costs, unclear business value, and — verbatim — inadequate risk controls, with pilots faltering at a "capability-deployment verification gap" [14]. As promised above: the code's failure mode and the market's failure mode show one recurring pattern — ungraded self-assessment — observed in the diff and in the P&L; it is the common failure this platform is designed around, offered as the unifying interpretation rather than the demonstrated single cause. Which raises the question this paper exists to answer: what would it take for the assessment to be graded — for who decided, under what authority, verified how to be a query rather than a reconstruction?
2. The state of AI governance, unmeasured
"AI governance" today denotes three different things that share a word but not a mechanism: regulation (the EU AI Act's risk-tiered obligations, with high-risk requirements taking effect August 2026–2027), management-system frameworks (NIST's AI RMF; ISO/IEC 42001, the first certifiable AI management standard), and a young platform market that has already bifurcated between tools that document AI systems and tools that enforce at runtime [17][14]. None of the three principal frameworks was designed for agentic AI.
The meaningful divide among all of them is not chronological but mechanistic, and it needs two definitions this paper will use throughout:
Attestational governance operates through statements about the governed system: policies, committee decisions, impact assessments, audits, certifications, periodic review. Its controls run on organizational cycle times; its enforcement is social and retrospective; its primary artifacts are documents; its success or failure emits few machine-checkable observables.
Structural governance operates through constraints in the execution path: gates that fail closed, states that are schema-invalid and therefore inexpressible, credentials that attenuate, evidence emitted as a non-optional side effect of operation. Its controls run mechanically and concurrently with the governed act; its primary artifacts are records of graded events; its success or failure is observable by construction.
These are mechanism categories, not eras or vendors; mature governance likely requires attestational elements — accountability, ratification, human veto — anchored to structural ones. But most organizational AI governance remains predominantly attestational even as runtime enforcement tooling emerges, and the measurements show it: roughly 75% of organizations report AI policies while ~36% have operationalized a framework; 87% claim clear governance while fewer than a quarter have implemented the controls; 79% are deploying agentic AI while 48% have any framework governing its autonomy [18]. And the effectiveness evidence is close to nonexistent — the field's own systematic reviews state that empirical evidence on governance outcomes is lacking, a review of 220+ governance tools found the overwhelming majority shipped without any validation, and the strongest available outcome study finds accountability improving only marginally despite rising regulatory density, a pattern its authors name governance theatre [18][19]. What little does show measured effect is enforcement-shaped: proactive monitoring, penalty-backed regimes, runtime intervention [19].
The deepest precedent cuts the same way. The most mature governance regime for algorithmic decision-makers — the Federal Reserve's model risk management guidance, SR 11-7, with fifteen years of institutional practice — made outcomes analysis a mandatory validation pillar under the doctrine of effective challenge: independent, technically competent verification with authority to force change [16]. In April 2026 its successor, SR 26-2, explicitly excluded generative and agentic AI from formal scope as novel and rapidly evolving [16]. The best-validated governance tradition on record points at the current technology and formally declines to cover it. The standard stands; the seat is vacant. A note on adjacent work, so the position is located rather than implied: the emerging agent-control tooling — gateways, sidecars, policy engines, runtime guardrails — governs access and behavior at the model boundary, and supply-chain attestation records how artifacts were built. Republic's combination is distinct on four axes: the governed corpus as first-class queryable law, enforceability as a computable property of that corpus, no standing mutable governance service, and falsifiability as an explicit design goal. What would structural governance of autonomous agents even look like? The remainder of this paper is one answer.
3. The problem, precisely
Amazon's operating doctrine states the problem at the human level: "good intentions don't work; mechanisms do" — no organization can rely on trying harder, its operators observed, because people already had good intentions when the problem occurred; only changing the underlying condition prevents recurrence [22]. Supervisory governance of AI is good intentions, industrialized — asked-for behavior, hoped-for vigilance, trusted self-report — and the previous two sections measured what that industrialization yields. This section names the underlying condition.
The failures this system is centrally designed against share one structure: a statement about the system diverging from the system itself.
It appears at the documentation layer when an architecture document claims a capability that was never built, and the claim is then inherited by every document and every agent that reads it. It appears at the memory layer when an agent summarizes its own history, the summary becomes the next session's ground truth, and each generation of summary sharpens the story while shedding the inconvenient details — an analogous closed-loop degradation risk: the collapse dynamic is observed when models train on their own outputs [3], and is hypothesized homologous at the scale of a single agent's accumulated record — with memory-injection attacks [7] as the closer, directly measured evidence that self-consumed records are manipulable. It appears at the authority layer when a component infers what it is allowed to do from what it has previously done. And it appears at the governance layer itself when rules live in prompts, because a prompt is a request, and a system whose constraints are requests has no constraints under pressure — a lesson the prompt-injection literature has made empirical [4], and one the field itself concedes by training instruction priority into models rather than trusting it to prompts [5].
The common structure is a closed loop: the system consuming its own claims about itself with nothing external grading them. The design response, applied uniformly, is to open every such loop — make each claim carry identity and provenance, make its verification a machine-executable check, make the record of that check append-only, and make current truth a resolution query over immutable records rather than the latest edit of a mutable one.
Two prior findings shaped this discipline and are stated as design laws. First, adjacent capability is not the required capability: a chain in which every hop is verified except one never-walked step is an unverified chain. Second, negative instructions in prompts prime the behavior they prohibit — the "don't think of an elephant" failure, familiar from ironic-process psychology and observed in language models [6] — so a prohibition that matters cannot depend on context for its enforcement — and this design goes further as a deliberate choice, never injecting restrictions into context at all, trading any possible instructional benefit for the elimination of restriction-text priming as a failure channel. Both laws appear below as structural facts — one enforced in schema, one in ratified build order — not guidelines. Humans acquire these disciplines over decades, inside structures refined across centuries of professional practice; for AI systems the equivalent is buildable directly, and it begins where human training does — with strict structure: information made clear, recallable at need, and enforced. The construction that follows is the opening of each loop named above, mechanism by mechanism.
4. The platform
Plainly: Republic is a governance plane — a small set of conventions and services that sit beside AI development work and constrain it mechanically. It is composed of five things: a governed corpus (the law, as atoms), a truth model (how the corpus stays true), an identity chain (who may act, and with how much authority), an enforcement plane (gates at build, spawn, and runtime), and a provenance stream (what happened, walkably). Each opens one of §3's closed loops: the truth model and atoms open the documentation loop, so claims can no longer outrun their record (§§4.1–4.2); memory-as-record opens the memory loop (§4.3); the entity chain opens the authority loop (§4.4); gates open the prompt-rules loop (§4.5). And §4.6 — provenance — is what the opened loops make possible: the query this paper promised.
4.1 The truth model
One idea underlies everything in this section and the four after it: a statement written without a time reference decays the moment it is written, while a time-specified statement is durable — true at timestamp T, permanently. Every mechanism below is this idea applied; grasp it once and the rest reads as consequences.
The system therefore never stores untimed mutable state about anything it governs. Every governed statement is an immutable instance, identified by ID, version, and instantiation timestamp. Changing anything produces a new instance; the prior instance remains addressable forever as the authentic record of what was asserted, when, by whom. Four things must not be conflated, and the design keeps them separately queryable: the record (immutable), the resolved current state (a query), the evidenced claim (a record with current passing evidence), and truth (which evidence tracks but never owns). The record is immutable. Its claims remain falsifiable. The store is append-only in instance space, and the current state of any question is a resolution query over instances.
Three consequences follow and are enforced rather than encouraged. References identify, never locate: a reference is an ID, optionally pinned to version and instantiation; references by file path or line number are fragile couplings, prohibited in governed content. Two independent authoring sources for one fact are a source of falsehood: every fact has exactly one authoring chain, and every other appearance is a resolved reference or a generated rendering — which is why inverse links are computed, never materialized, and why a generated document is never hand-edited into a second copy of the law. And documents are assemblies: a source file carries atom instances; a document, as read, is an assembly of resolved atoms at a given time. Retrieval resolves each reference and therefore, by construction, assembles the latest valid instances — or, when pinned, a faithful historical assembly.
4.2 Governed atoms
By the end of this section, "is every requirement bound to enforcement?" is a number, not an audit — rule-binding coverage is computable, while the effectiveness of the bound enforcement remains an empirical property the research program measures (§8).
The unit of governance is the atom: the smallest piece of normative or intent content that carries identity, lifecycle state, authorship, and authorization independently of any file it is serialized in. Documents are serialization containers; governance attaches to atom IDs, never to filenames. Every atom implements one base interface — a stable never-reused ID, a type, a scope, a lifecycle state, a semantic version, an instantiation timestamp, an author (an identity-chain reference, the same reference type for a human or an agent), and a title, with an authorizing decision required past proposal and typed relations as applicable. Serialization is dual-audience by construction: YAML frontmatter for machines, prose for humans, in ordinary markdown, with multi-atom files first-class under an encoding standard whose markers are legal comments in the host format.
The types divide into normative atoms that cause behavior (principles, specifications, restrictions, controls, enforcements, decisions, mandates), intent atoms that direct work (strategies, sprints, stories), and record atoms the system produces (evidence, waivers, blockers, memories, provenance links). The central construction is the binding triple: a rule is not a fifth kind of claim but the composition of exactly one claim, one control, and one enforcement. An unbound claim is a proposal; a claim becomes enforceable the moment an active rule binds it — which makes enforceability a computable property of the corpus. A specification no rule binds is a dangling claim, and dangling claims are a standing query with a launch-blocking target of zero. A traceability requirement usually enforced by review becomes a number the system counts.
Several refusals are encoded at schema level, where they cannot be overridden per instance. Restrictions carry injection: never and are checked in gates before and after execution — per the prohibition rule above, with the schema making the misconfiguration inexpressible. The enforcement ladder contains no kill value: the strongest consequence is suspend-and-escalate to the human veto gate. Mandates reference models by band label resolved at spawn time; a model literal fails validation. And a story with an empty acceptance list is schema-invalid and therefore unschedulable — an untestable story is unrepresentable, not merely discouraged. Consumers bind to facets — narrow interfaces over subsets of types — never the full ontology; one state machine governs every type, and only decisions move other atoms through it.
4.3 Malleable memory, immutable truth
An agent's memory is its truth: unlike a human, whose recollection is checked — however imperfectly — against a persistent world and other witnesses, an agent acts from its record, and the record is all there is. In current systems that truth is malleable, continuously and invisibly — reshaped by summarization, by retrieval weighting, by drift, and, as the attack literature demonstrates, by cheap injected influence that persists as precedent [7]. And because agents consult their record to determine what they may do and how, malleable truth is malleable authority. Agent memory is thus where governance leaks: it is self-authored and self-consumed, which makes it the one store where §4.1's laws are least visible and most consequential.
The design answer is not immutable memory — memory must evolve; grooming, consolidation, and decay are features — but the separation of the two malleabilities: the memory population changes freely, while every claim it contains is pinned, timestamped, and superseded in the open. Memory stays soft; truth does not.
Memories are immutable instances like everything else; grooming is supersession, never edit, so history is walkable and a bad grooming pass is revertible. Retrieval weight is a measurement stream, never a stored field: each retrieval writes an append-only row — which memory, which retriever, what value mark, when — and weight is a standing query over the stream, with per-retriever discounting and recency decay. Ranking is thereby auditable and structurally resistant to the self-preference entrenchment that closed ranking loops develop: the measured tendency of model evaluators to favor their own outputs [8] never accumulates into the stored record, and the weighting query itself is versioned and governable. And resolution wins: memories cite the atoms that ground them by instance identity, and when an agent's in-context recollection conflicts with the resolved current instance, the resolved instance is ground truth. A memory contradicting its own resolved sources is defective by definition.
4.4 One entity type, one direction of authority
The identity law in security terms first: least privilege enforced cryptographically, authority that can only narrow with delegation and never escalate, and no trust scores anywhere — authority is granted, never inferred from behavior, history, or kind.
There is exactly one entity type. A human's core identity, a human persona, a browser session, a service's certificate, and a spawned sub-agent are all instances of the identity-bearing actor at different positions in a signing chain rooted at the platform's cold root keypair; no component may define a second entity type or branch on human-versus-agent beyond a descriptive property. The attenuation law governs the chain: a child credential can never carry a capability absent from its parent's grant. An entity's effective capabilities are the intersection of its credential caveats and its mandate's ceiling; verification is a chain walk to root, and a credential that fails the walk is rejected at the surface it presents to. Humans and agents authenticate through the same machinery — device-bound keypairs make each browser or terminal a cryptographic subset of the person's identity chain; agent leaves are minted at container start — so every downstream consumer operates on chain position and caveats, agnostic to what kind of mind holds the key.
The identity design as stated propagates authority; containing compromised authority is a separate set of properties, named here as declared work rather than implied guarantees: credential revocation and its propagation latency, blast-radius bounds on a stolen leaf credential, key rotation with provenance continuity, delegation-depth and lifetime limits, confused-deputy resistance at the gates, and integrity of the gold base image itself against compromise-at-build (digest-pinning defends what was built; the conformance suite constrains it; build-provenance completes it). Each is a security property with acceptance criteria at the chain-verifier and base milestones — established there, not asserted here.
Two layer separations complete the design. Transport identity rides the bus's native credential chains while act-level authority rides caveated tokens in the message envelope — transport concerns transport; mixing them forces the transport layer to make claims it has no authority to make. And rules may have governed exceptions while credentials may only have limiters: an exception may suspend or select among pre-ratified consequences; it may never grant, widen, or mint authority. Waivers deserve a sentence of their own, because an exception mechanism is the point where enforcement either remains governed or leaks: a waiver here is a governed exception with a required expiry — an indefinite waiver is schema-invalid — scoped narrower than the rule it suspends, provenanced like everything else, and self-rearming on expiry.
4.5 The enforcement plane
The enforcement plane consists of exactly six things: the atom store, the generated index, the atom linter, the gate library, the evidence emitter, and the chain verifier. There is no rules engine, no policy server, no standing governance service — the design minimizes independent mutable governance infrastructure and places enforcement at chokepoints that already hold authority over the governed transition: the forge over merges, the harness over spawns, the bus over messages. Embedded gates can drift too — they are versioned and digest-pinned for that reason — but a merge gate that will not pass an invalid atom is a property of the forge, visible when bypassed, with no separate service to fail open.
The atom store is git; ratification is physically the signed merge that lands a decision atom, so the adopting act and its cryptographic record are the same event. The index is generated, never authored — index loss is an inconvenience, never a truth loss — and every persisted instance is embedded as a non-optional side effect of persistence, so semantic retrieval coverage is itself a standing query with a target of zero gaps (instrumented today as described in §7). Embeddings carry full measurement provenance — instance, model band, digest, timestamp — and because instances are immutable, a vector is permanently valid for its instance under its instrument: there is no staleness, only supersession. Throughout, similarity proposes and gates dispose: semantic machinery surfaces candidates; it never directly triggers enforcement.
One gate library mounts at three chokepoints — the build gate in CI (the linter validates every governed file, and the platform's first rule binds the linter to the claim that every governed file validates: the ontology enforcing itself), the spawn gate in the agent harness (no resolvable story, no spawn; mandate resolved; restrictions armed), and the runtime gate at the bus authorization callout. Evidence emission is structural: every control invocation writes an evidence record, so no check can execute without leaving a mark, and "is this claim currently evidenced" is the query for the latest passing evidence against the current subject digest. Evidence completeness is structural; evidence validity is graded — a control can run perfectly while measuring the wrong property, which is why control definitions and test oracles are themselves versioned, governed atoms open to the same attack as everything else. A claim without current evidence is an aspiration, and the system can count its aspirations.
The topology beneath is deliberately spare: citizens are container-only with no host-execution path to outgrow; images form a digest-pinned hierarchy from a hardened gold base carrying a conformance suite that runs against every derived image; there is one IO path — everything speaks the bus — so the audit trail is the transport, not a copy of it. Republic adapts to existing infrastructure and never provides it: the team's tracker remains the tracker of record, repositories hold code and law, the object store holds artifacts and evidence detail.
4.6 Provenance, end to end
This is the query the opening promised. The system's differentiating record is the provenance chain: from a verbatim human directive, through the decision it produced, through the story executed under it, through the identity-chain leaf that executed, to the artifacts that resulted — commits, digests, pull requests. Every element is a reference except the directive itself, anchored verbatim, and the chain must be walkable from any element to all others. Supply-chain attestation frameworks record how an artifact was built — steps, builders, signatures; this chain joins the why to the how: the decision and the authority behind the work, bound to the identity that executed it and the evidence that graded it. Combined with structural evidence emission and signed-merge ratification, it answers the question governance of AI-built software turns on — who decided this, under what authority, executed by what, verified how — by query, for every artifact the plane produces — without manual forensic reconstruction wherever the chain is provenance-complete, with completeness itself a standing query rather than an assumption.
5. What the enforcement evidence says
Several component mechanisms this plane rests on have already been measured — their end-to-end assembly has not. Direct intervention studies at the generation loop show large effects: iteratively feeding static-analyzer findings back into regeneration cut residual vulnerability rates from 40.2% to 7.4% as measured by the study's static-analysis instrument, in one peer-reviewed line, with independent loops reducing security issues from over 40% to 13% and reliability warnings from over 50% to 11% within ten iterations; a survey of 63 automated program-repair systems concludes single-pass model output is rarely sufficient and the successful systems embed external verifiers into the workflow [20]. The finding that matters most is an asymmetry: models detect errors and vulnerabilities in their own output poorly, but fix flawed code well when handed failed tests or analyzer reports [20]. Self-evaluation fails; externally graded feedback works. That is the loop-level empirical form of this platform's architectural law — the generator cannot be the sole authority on whether its own output passes, and measurably doesn't need to be — and the organizational data closes the sandwich from above: control systems condition whether AI-driven change volume compounds into value or instability [9]. A scoping note belongs here, because verification density is also why this plane targets software first: nothing in the substrate assumes a software artifact — the truth model, atoms, entity chain, and provenance chain are a general theory of governed AI work — but gates need something machine-checkable to check, and software is where such verification is native to daily practice. Any second domain will be chosen by the same criterion; the general capacity is a design property, not an offering, until its chain has been walked. What sits unmeasured between the two proven scales is a development system whose control layer is structural end to end. Section 8 states that gap as the research program it implies.
6. The minimum viable slice
The MVP is a single chain, each clause an acceptance specification: a signed human directive → the decision recorded in the provenance stream → a story with acceptance specifications → the story reflected to the external tracker → the spawn gate refusing any spawn without a resolvable story — a story may be spawned while proposed, since ratification follows the evidence and cannot precede the work that earns it; authorization to perform work and ratification of the work's resulting normative claim are distinct acts, and "proposed" does not mean "unauthorized" — then minting a story-scoped identity leaf and starting a hardened agent container with laws injected → a supervised, interruptible session streaming live → the merge gate running the linter and acceptance controls and emitting evidence → merge on pass → the provenance walk resolving directive to artifact → standing queries reporting zero dangling claims, zero unevidenced claims, zero coverage gaps for the in-scope set. Done is a query result. Interim postures are declared, never silent — each simplification is carried as a governed waiver or labeled posture atom. The build order walks the riskiest hop early by design: corpus and linter first, then the authorization grammar's property suite, the embedding pipeline, the gold base and conformance suite, then the spawn contract — the hop for which adjacent capabilities are explicitly ruled non-substitutable.
7. Current state, honestly
Reported per the system's own discipline, from the repository at HEAD at the time of writing; this section supersedes any more optimistic reading of the sections above — and any more pessimistic one, since the repository has recently outrun earlier drafts of this paper.
The substrate is enacted and governing: DEC-0001, the founding decision, landed by signed merge under its own ratification machinery; a subsequent decision activated the rule set, and a further one — DEC-0004 — split the coverage and drift meters and added a lifecycle retirement edge when operation revealed a single meter doing two jobs, retiring sixteen closed-story acceptance specifications. The corpus stands at 172 active atoms at this writing's verification HEAD (97ee84f), with proposed, ratified, deprecated, and superseded populations all exercised — the lifecycle is not a diagram; every edge has run. The build gate is live: a conformance workflow runs the control suite on every change, a red suite blocks merge, and the evidence rows are uploaded publicly so a reader can check the claim rather than trust the badge.
The declared riskiest hop has been walked through its current acceptance set (acceptance-test evidence, scoped to the tested set — not a claim that the attack surface is closed). The spawn contract — a supervised CLI-session agent in a hardened citizen container, in bidirectional streaming mode under harness control — ran its acceptance set to green: spawn gate refusing unresolvable spawns (acceptance-test pass), container isolation and act-level attribution verified (acceptance-test pass), network egress pinned and enforced on the exercised paths (acceptance-test pass), supervision demonstrated as interrupt-in-flight, mid-session injection, and clean termination (observed instances, not exhaustive proof of interruptibility under all states), with credential minting confined to the harness and the citizen image verified unable to mint on the tested paths (adversarial test). The chain verifier followed, its control green — and its adversarial "rogue" fixture set caught two verifier defects on the way (adversarial test), which is the probe philosophy working before it had its name. The standing query for rules without passing evidence moved from 22 to 8 across this work (standing query, session-reported). The suite's own source declines to fake what it cannot prove locally, noting that a surrogate claiming supervision coverage "would be the exact overclaim" the specification forbids: the enforcement machinery refusing to overclaim its own coverage, in a code comment.
Two postures are declared rather than silent. First, lifecycle activation is caused by the law operating — a reconciliation pass computes binding-completeness and moves states in a separate, separately-attributed commit — so at any given HEAD, recently merged work may read as proposed until reconciliation runs; the walked hop above sat exactly so at the time of this snapshot, with reconciliation queued. Second, and consequently: the spawn gate requires a resolvable story, not a ratified one (SPEC-0122 — which also records a sharpening the posture earned on landing: the gate now resolves the story reference rather than accepting any non-empty string). A story is necessarily proposed while the work that earns its ratification is in flight; requiring active law to spawn that work would be a circular gate under which nothing could be built. Ratification follows the evidence; it does not gate the work. One open item rides with these, and it earned its keep: an agent authored a story revision's content — authorship and authorization are separate fields by design, and the atom's force remains the human floor's to grant — but agent authorship is not yet bounded by any mandate check, a gap named in the corpus (SPEC-0123) rather than left for a reviewer to find. An external reviewer then found what the declarations made findable: the two postures compose — an agent could author a weakening of its own in-flight acceptance criteria, and the gate would grade against the weakened set, reintroducing the closed loop this paper's §3 names, inside the governance plane itself. The mitigation is ruled and time-boxed (declared posture; implementation chartered as STORY-0014–0016, with the composition posture reserved as SPEC-0128, cited when it lands): the grading gate pins each story's acceptance baseline to the last floor-touched instance — the spawn act pins the initial set, explicit floor touch moves it thereafter — agent revisions are recorded but move nothing until touched, a lint flags every non-floor acceptance edit without attempting to classify weakening, and the posture retires when mandate-bounded authorship goes live. The episode is reported here as evidence rather than confession: the attack was findable only because both postures were declared — external, resolvable disclosure recruited the adversary into the security analysis, which is this paper's thesis operating on the paper's own governance. Local, ungoverned work deserves the same plain statement: the gate is at the chokepoint, not the keyboard — experimentation that never seeks merge never becomes truth, and what seeks merge meets the gate.
Ahead of the front: the consult-and-render services and the full chain-level run (C1) that joins every walked step end to end. The retrieval instrument is currently lexical, with the semantic instrument a band re-resolution away. The repository is public; its outbound license is itself a proposed decision atom — copyleft, owner-granted, with stated preconditions before signing — and until it is enacted, the deliberate holding posture is all-rights-reserved. Verify rather than trust: the repository is github.com/tecthulhu/republic; the founding enactment is tagged dec-0001-enacted; evidence records live under platform/acta/; the conformance workflow and its uploaded evidence rows are in the repository's actions history; and the standing queries are re-runnable from the tools directory against any commit. The corpus should be evaluated directly: under the system's own truth model this paper is a descriptive rendering, and where a rendering and the resolved record disagree, the record wins.
8. Gaps, and the research program they imply
What no published study measures is structural governance of autonomous agent development at the system level. The evidence has the structure of a staged trial: the mechanism is validated at the smallest scale (loop-level interventions, causal) and the largest (organizational conditioning, correlational); the system-level trial is the identified next experiment, and this platform is built as its own instrument for it. Four falsifiable hypotheses, measurement bases stated:
H1 — Effective structural enforcement decays more slowly under repeated exposure than supervisory enforcement. The gate's code does not fatigue — that much is definitional; the falsifiable claim is about the enforcement system, whose decay channel is its human pressure valves. Measured by: waiver issuance frequency and duration trends, control-weakening events, bypass and out-of-band execution rates, and escaped-defect rates over exposure time, against published reviewer-habituation curves [2] as the supervisory baseline. H2 — Governed and ungoverned agent throughput have different stability cost curves, with risk-weighted verification coverage — not gate count — as the independent variable. Gate count is gameable; coverage of risk-relevant properties is the causal quantity. Measured by: change-failure and recovery metrics as a function of the share of changes whose risk-relevant properties are externally verified, on the same agent population — with the risk taxonomy, weighting function, coverage denominator, and verification-qualification rule fixed as versioned atoms before data collection begins; any later change is a recorded experimental-method change that resets the affected series. H3 — Provenance-complete development changes defect economics. Measured by: incident diagnosis time with and without a walkable chain. H4 — Structural governance reduces the total cost of demonstrating governance below the attestational baseline. Measured by: cost and labor per compliance artifact — audit-preparation time, evidence-assembly effort, control-verification hours — on the running system, against both an external baseline from the compliance-cost literature and a within-organization counterfactual or historical baseline, since literature baselines alone may not match scope, regime, or maturity. H4's named counter-hypothesis is the governance tax (below); one experiment settles both. Developer-experience metrics ride the same program: authoring time relative to change size, waiver-request rates, and time-to-first-governed-commit, so the friction question is measured rather than argued — and the commitment is symmetric: cost and friction results publish with the same prominence as defect and stability results, whatever they show.
Three limitations are declared rather than discovered. The governance tax is real: structure front-loads cost at authoring time — acceptance specifications, typed atoms, mandate resolution — and mechanisms that raise the cost of every change create pressure to route around them. The bet is that supervision's costs compound while structure's amortize, and the bet is measurable, not assumable — it is H4's cost side, with the DX metrics above as its instruments. The architecture also anticipates the cost's descent: because decisions are typed atoms and authority is caveated, ratification itself can be banded — mechanically resolvable decisions auto-enacting on green evidence, scoped mandates ratifying within ceilings under sampled audit, the human veto retained asynchronously and the constitutional floor retained absolutely — a delegation pattern whose progression is gated on the same measurements as everything else here, including the measured decay of the delegation itself. Cold start is real: the plane assumes governed atoms exist, and legacy estates hold neither atoms nor structured intent. The anticipated path is enrollment, not migration — identity assigned to legacy artifacts as-is, on touch, never by bulk rewrite. Operational costs are unquantified pre-C1: provenance storage and walk latency, gate latency in fast agent loops, and evidence telemetry volume are open engineering quantities; asynchronous evidence aggregation (blocking authorization, deferred telemetry) and gate-update propagation across digest-pinned fleets are the anticipated options and costs respectively, and because the plane measures its own overhead as a side effect of operating, the quantification is itself part of the first chain run's output.
These are hypotheses and declared limits deliberately: a claim without current evidence is an aspiration, and the system counts its aspirations. After this paper, the deliverable is the measurement, not the feature list. Because evidence emission is structural and done is a query result, running the system produces the missing evidence class as a side effect of operating — the first C1 chain run is, among other things, the first data point of the study the literature does not have.
9. The thesis, in its falsifiable form
Here is the refutation we said we would hand you.
The evidence gap in AI governance is structural, not accidental: attestational governance emits few observables against which success or failure could be scored — its outputs are documents, its counterfactuals inaccessible — which is why the governance interventions with measured effects are overwhelmingly enforcement-shaped [19]. The testability standard does not need inventing: the governance canon's most mature regime made outcomes analysis a mandatory validation pillar fifteen years ago [16], current attestational frameworks largely cannot satisfy that standard for themselves, and the regime that codified it has formally vacated the agentic field. Held to that bar, a governance model is evaluated on whether it is falsifiable — capable of yielding both positive and negative evidence of its own performance.
Two theses should be separated before either is defended, because they fail differently. The market thesis — verification, not generation, is now the binding constraint — is temporal: it argues urgency and could expire if the landscape shifts. The architectural thesis is what survives regardless: governability requires externally resolvable authority, intent, execution, and verification, rather than self-attested state. That requirement is not new — it is the oldest ask of high-consequence governance, which medicine, aviation, and banking have afforded only through expensive human discipline; SR 11-7 is that expense institutionalized [16]. Structural governance makes the ancient requirement affordable at the moment autonomous actors make it non-optional — stated here as hypothesis, not triumph: the affordability claim is H4, and its refutation is the governance tax exceeding the verification gains.
A third bound joins the two above: control fidelity is not policy correctness. Structural governance guarantees that declared policy is enforced and its effects observable; it does not guarantee the policy is right — a structurally enforced bad policy executes its error with perfect reliability. The binding triple keeps the two separately examinable: a defective claim is corrected by supersession, and the record shows both the enforcement and the error.
Republic is falsifiable by construction. Evidence emission is structural; done is a query against defined targets; H1–H4 are refutation criteria with stated measurements. Negative evidence is possible and would be visible: gates that pass defective artifacts leave records that later defects trace to through provenance; standing queries can report nonzero; the hypotheses can come out false. A system that can only show itself working is not testable — this one is built so that not working would show. Two bounds keep the claim honest. Testable is not tested: pre-C1, the claim is "evaluable, evaluation specified, first evidence rows on the record, chain-level data pending." And this self-measurement is event-grounded rather than self-attested: the evidence records are of externally replayable events — lint results, test outcomes, merges — on a public, append-only record, re-runnable by anyone, while the meaning assigned to each event — the lint rule, the test oracle, the query denominator — is itself an authored, versioned, attackable artifact rather than a hidden judgment; the randomized trial's believed-versus-measured gap [15] shows what happens when belief is the instrument, and belief is precisely the instrument this design removes.
Close
A reader should leave holding four portable tools, none of which requires adopting this platform: the term pair — attestational versus structural — for their next architecture review; the one-question test for any governance product — can it emit evidence of its own failure?; the constraint thesis — verification, not generation, binds AI-driven development now; and the provenance question — who decided, under what authority, executed by what, verified how — as a diagnostic for any agentic system, this one included.
The record of this system is public and running. Where this rendering and the resolved record disagree, the record wins.
References
Cited per the source-grading discipline: experimental work for findings, surveys and reviews for cross-study consensus, official statistics as adoption ground truth, analyst forecasts as forecasts, unreplicated preprints only as "consistent with" alongside an established anchor.
[1] Laban et al., "LLMs Get Lost in Multi-Turn Conversation" (ICLR 2026; arXiv:2505.06120); He et al., "Multi-IF" (2024); and convergent multi-turn constraint-following benchmarks. [2] Parasuraman & Manzey, "Complacency and Bias in Human Use of Automation," Human Factors 52(3) (2010), and the systematic-review literature on automation bias; consistent with not-yet-replicated longitudinal findings on reviewer habituation to agent-generated code (2026 preprints). [3] Shumailov et al., Nature 631, 755–759 (2024); Alemohammad et al., "Self-Consuming Generative Models Go MAD" (2023); Gerstgrasser et al. (2024) on accumulation vs. replacement. [4] Greshake et al., "Not What You've Signed Up For," AISec (2023); Zhan et al., "InjecAgent" (2024). [5] Wallace et al., "The Instruction Hierarchy" (2024). [6] Wegner et al., "Paradoxical Effects of Thought Suppression," JPSP 53(1) (1987); Castricato et al., "Suppressing Pink Elephants with Direct Principle Feedback," arXiv:2402.07896 (2024) — baseline instruction-tuned models unchanged or more likely to mention forbidden topics when told to avoid them. [7] Chen et al., "AgentPoison," NeurIPS (2024); Dong et al., "MINJA: Memory Injection Attacks on LLM Agents" (2025). [8] Panickssery, Bowman & Feng, "LLM Evaluators Recognize and Favor Their Own Generations," NeurIPS (2024). [9] DORA, Accelerate State of DevOps (2024) and State of AI-Assisted Software Development (2025). [10] GitClear, AI Copilot Code Quality analyses (2025, 2026; 211M+ changed lines). Industry code-mining; not peer-reviewed. [11] Veracode, GenAI Code Security Report (2025, 100+ LLMs). Vendor study; prompts carried no explicit security guidance — the realistic condition. [12] U.S. Census Bureau, Business Trends and Outlook Survey (2025–26); Federal Reserve reconciliation of firm- and individual-level adoption surveys (2026). [13] S&P Global Market Intelligence, AI initiative abandonment (2025); RAND, AI project failure rates (2024). [14] Gartner: agentic AI cancellation forecast and stated causes (2025, prediction cited as prediction); agent deployment and vendor assessments (2026); AI governance platform market (2026). [15] METR, randomized controlled trial of experienced developers with AI assistance (2025). [16] Federal Reserve SR 11-7 (2011); SR 26-2 (2026), which excludes generative and agentic AI from formal scope. [17] EU AI Act (Regulation 2024/1689); ISO/IEC 42001:2023; NIST AI RMF (AI 100-1). [18] Papagiannidis et al. and the responsible-AI governance systematic-review corpus (2024–25); systematic review of 220+ AI governance tools; adoption-vs-implementation surveys (IBM; Gartner–McKinsey compilations; Vanta, 2025–26). [19] Multi-regulatory analysis of 480 AI incidents (2025–26): internal-detection compliance effect (87.5% vs. 5.3%; internal-detection subsample n=24, selection-bias threats discussed by the authors); "governance theatre"; enforcement-backed regimes outperforming voluntary frameworks. [20] FDSP and iterative static-analysis feedback studies; AutoSafeCoder; GRASP; taxonomy of 63 automated program-repair systems (2024–26). [21] Stack Overflow Developer Survey (2025, n≈49k): adoption 84%; trust in AI accuracy fallen to ~29–33% from ~40%; top frustration "AI solutions that are almost right, but not quite" (66%), with time lost debugging AI-generated code (45%) — survey findings, citable as such. DX developer telemetry (121k developers): color, never foundation. [22] Bryar & Carr, Working Backwards: Insights, Stories, and Secrets from Inside Amazon (2021), p. 17 — an operating doctrine recorded by Bezos's longtime deputies, not a public Bezos quotation; the surrounding argument (intentions fail because they were already present when the problem occurred; only changing the underlying condition prevents recurrence) is the human-scale form of this paper's supervisory/structural distinction.
The substrate corpus, its schemas, the conformance workflow, and the evidence records referenced throughout are public in the platform repository. Requirement identifiers follow the corpus conventions (ONT-, ENT-, PA-, DEC-, SPEC-, CTRL-).