Fieldcraft: formal methods for agentic work.

01 · Intent

Acceptance is a state-transition guard: engineers must make “done” observable to a producer and its consumer.

Consumer: Professional Agentic Engineers and Agentic Researchers working in ESS & agentic engineering.

Field: ESS & agentic engineering · engineering

Potential benefit: Separates plausible output from admissible output.

02 · Process

Given the declared assumptions, check the local guard Advance(x) → Accept(x) = true at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Turn “looks right” into a condition you can inspect. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Advance only when the declared acceptance predicate evaluates true.

04 · Model

Advance(x) → Accept(x) = true

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem acceptanceCondition : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: acceptance_condition_check

Executable TypeScript predicate: Advance(x) → Accept(x) = true. The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. A precise predicate can still encode the wrong objective.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: A literature brief advances when each finding has a source link and required fields.

Counterexample: “Looks good” has no predicate and therefore cannot establish acceptance.

Trade-off: A precise predicate can still encode the wrong objective.

08 · Governance

Model risk: Passing the guard proves contract satisfaction, not usefulness.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Prompt transport is serialization: delimiters in research text remain data, not control syntax.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Prompt craft.

Field: Prompt craft · knowledge

Potential benefit: Prevents task corruption at agent handoffs.

02 · Process

Given the declared assumptions, check the local guard decode(encode(x)) = x at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

A delimiter is part of the data eventually. Choose framing that survives the data you expect. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Encoding then decoding preserves every admitted payload, including delimiter characters.

04 · Model

decode(encode(x)) = x

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem delimiterCollisionsInPromptInput : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: delimiter_collisions_in_prompt_input_check

Executable TypeScript predicate: decode(encode(x)) = x. The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Structured codecs require explicit schemas and error handling.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: A quoted passage containing `|` arrives intact as one source field.

Counterexample: Splitting the raw quote at `|` truncates the evidence.

Trade-off: Structured codecs require explicit schemas and error handling.

08 · Governance

Model risk: A faithful decode does not make hostile content trustworthy.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Typed output contracts make agent-produced text safe to compose with deterministic software.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Agentic engineering.

Field: Agentic engineering · engineering

Potential benefit: Catches omissions before downstream execution.

02 · Process

Given the declared assumptions, check the local guard Consume(y) → Shape(y) = Expected at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

A result can be plausible text and still be unusable data. Validate the shape before consuming it. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Consume(y) implies y conforms to the consumer’s required shape.

04 · Model

Consume(y) → Shape(y) = Expected

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem validateOutputShapeBeforeUse : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: validate_output_shape_before_use_check

Executable TypeScript predicate: Consume(y) → Shape(y) = Expected. The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Schema compliance can conceal wrong or fabricated values.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: A synthesis step requires both a summary and source references.

Counterexample: A fluent summary omits the required source field.

Trade-off: Schema compliance can conceal wrong or fabricated values.

08 · Governance

Model risk: Shape validation is not factual validation.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Evaluation requires a comparison target and a decision-relevant margin, not an isolated score.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Evaluation practice.

Field: Evaluation practice · knowledge

Potential benefit: Makes small, noisy changes harder to oversell.

02 · Process

Given the declared assumptions, check the local guard Improved(c,b,m) → score(c) ≥ score(b)+m at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

A candidate is easier to interpret when the comparison target is visible and simple enough to audit. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Call a candidate improved only when its metric clears the baseline by a declared margin.

04 · Model

Improved(c,b,m) → score(c) ≥ score(b)+m

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem compareAgainstASimpleBaseline : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: compare_against_a_simple_baseline_check

Executable TypeScript predicate: Improved(c,b,m) → score(c) ≥ score(b)+m. The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Metric and margin selection remain judgment calls.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: A retrieval change must beat a simple baseline by five points.

Counterexample: A three-point increase is called a win against a five-point margin.

Trade-off: Metric and margin selection remain judgment calls.

08 · Governance

Model risk: Metric fit and dataset coverage bound the claim.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Agentic refinement is a finite process with an explicit stopping condition.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Agentic engineering.

Field: Agentic engineering · engineering

Potential benefit: Bounds latency, cost, and open-ended self-critique.

02 · Process

Given the declared assumptions, check the local guard 0 ≤ done ≤ budget at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Refinement is useful until its cost and stopping rule disappear. Make the budget part of the trace. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Completed iterations never exceed the declared refinement budget.

04 · Model

0 ≤ done ≤ budget

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem stopAtABoundedIterationBudget : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: stop_at_a_bounded_iteration_budget_check

Executable TypeScript predicate: 0 ≤ done ≤ budget. The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. A useful answer may remain unfinished at the cap.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: A research agent gets three synthesis passes, then returns open questions.

Counterexample: It performs a fourth “final polish” after the cap.

Trade-off: A useful answer may remain unfinished at the cap.

08 · Governance

Model risk: A bounded process is not necessarily a well-chosen process.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Delegation is contract composition: the child inherits the constraints that define valid work.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Agentic engineering.

Field: Agentic engineering · engineering

Potential benefit: Reduces policy and acceptance drift across handoffs.

02 · Process

Given the declared assumptions, check the local guard Required(parent) ⊆ Required(child) at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

A handoff is a new boundary. Compare the receiving brief with the constraints that made the original task meaningful. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Every required parent constraint is present in the child-task contract.

04 · Model

Required(parent) ⊆ Required(child)

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem preserveTaskConstraintsDuringHandoff : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: preserve_task_constraints_during_handoff_check

Executable TypeScript predicate: Required(parent) ⊆ Required(child). The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. The parent contract must distinguish required from optional context.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: A delegated source check retains citation and no-publication constraints.

Counterexample: The no-publication constraint disappears in the child brief.

Trade-off: The parent contract must distinguish required from optional context.

08 · Governance

Model risk: Set inclusion preserves only constraints that were made explicit.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Multi-criteria agentic evaluation should expose arithmetic separately from human judgment.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Creative practice.

Field: Creative practice · creative

Potential benefit: Makes a score reproducible and debatable.

02 · Process

Given the declared assumptions, check the local guard score(x)=Σᵢ wᵢrᵢ(x) at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Arithmetic can expose a brief fit or threshold while leaving aesthetic judgement with the human reviewer. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

A reported weighted score equals the sum of declared weight × rating terms.

04 · Model

score(x)=Σᵢ wᵢrᵢ(x)

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem scoreACreativeCandidateWithExplicitCriteria : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: score_a_creative_candidate_with_explicit_criteria_check

Executable TypeScript predicate: score(x)=Σᵢ wᵢrᵢ(x). The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Weights can create false precision.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: A design review computes fit while leaving the aesthetic decision with a person.

Counterexample: A manually entered aggregate disagrees with the listed ratings.

Trade-off: Weights can create false precision.

08 · Governance

Model risk: Correct arithmetic does not validate the rubric.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Creative-system experiments need controlled variation to attribute observed changes.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Creative practice.

Field: Creative practice · creative

Potential benefit: Makes iteration interpretable.

02 · Process

Given the declared assumptions, check the local guard |Δ(parameters(a),parameters(b))|=1 at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Isolate a change so the comparison has a chance to teach you what changed. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

A controlled pair differs in exactly one declared parameter.

04 · Model

|Δ(parameters(a),parameters(b))|=1

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem varyOneCreativeParameterAtATime : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: vary_one_creative_parameter_at_a_time_check

Executable TypeScript predicate: |Δ(parameters(a),parameters(b))|=1. The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Single-factor tests can miss parameter interactions.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: Vary palette while fixing composition, model, and prompt length.

Counterexample: Palette, composition, and model all change together.

Trade-off: Single-factor tests can miss parameter interactions.

08 · Governance

Model risk: The design only tests the chosen factor in its test context.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Generative variation composes with fixed requirements rather than silently replacing them.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Creative practice.

Field: Creative practice · creative

Potential benefit: Keeps creative exploration inside the intended brief.

02 · Process

Given the declared assumptions, check the local guard Fixed(brief) ⊆ Attributes(output) at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Give exploration room by naming what cannot move and what may move. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Every fixed brief attribute survives each optional variation.

04 · Model

Fixed(brief) ⊆ Attributes(output)

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem separateFixedBriefFromOptionalVariations : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: separate_fixed_brief_from_optional_variations_check

Executable TypeScript predicate: Fixed(brief) ⊆ Attributes(output). The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Misclassifying a flexible preference as fixed can suppress discovery.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: Change voice and palette while preserving audience and purpose.

Counterexample: A variant changes the audience but labels it stylistic variation.

Trade-off: Misclassifying a flexible preference as fixed can suppress discovery.

08 · Governance

Model risk: The invariant depends on a reviewed brief.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Portfolio generation can formalize breadth as coverage constraints over declared dimensions.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Creative practice.

Field: Creative practice · creative

Potential benefit: Exposes repetitive candidate sets.

02 · Process

Given the declared assumptions, check the local guard |tags(selected)| ≥ diversityFloor at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Diversity is not a mood word. Declare the tags and coverage floor you intend to preserve. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

A selected set meets the declared lower bound on distinct represented tags.

04 · Model

|tags(selected)| ≥ diversityFloor

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem chooseADiverseConceptSetByDeclaredTags : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: choose_a_diverse_concept_set_by_declared_tags_check

Executable TypeScript predicate: |tags(selected)| ≥ diversityFloor. The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Taxonomy coverage is not substantive novelty.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: A case set spans engineering, governance, and human factors.

Counterexample: Three differently worded cases all cover one dimension.

Trade-off: Taxonomy coverage is not substantive novelty.

08 · Governance

Model risk: Tag design determines what “diverse” means.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Accessibility constraints are executable design requirements, not aesthetic impressions.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Design with AI.

Field: Design with AI · creative

Potential benefit: Catches one measurable barrier early.

02 · Process

Given the declared assumptions, check the local guard contrast(fg,bg) ≥ required at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Put the contrast calculation beside the palette decision so a readable design is testable before it is polished. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

A text/color pairing passes the chosen contrast criterion only at or above its ratio threshold.

04 · Model

contrast(fg,bg) ≥ required

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem checkDesignContrastWithWcagFormula : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: check_design_contrast_with_wcag_formula_check

Executable TypeScript predicate: contrast(fg,bg) ≥ required. The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Contrast is only one accessibility dimension.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: Check interface text against the selected WCAG contrast criterion.

Counterexample: A palette appears readable but falls below the threshold.

Trade-off: Contrast is only one accessibility dimension.

08 · Governance

Model risk: The contrast calculation and applicable criterion must be independently verified.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Provenance turns source revision into a precondition for current claims.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Knowledge & synthesis.

Field: Knowledge & synthesis · knowledge

Potential benefit: Makes drift detectable at use time.

02 · Process

Given the declared assumptions, check the local guard Usable(s) → observedRev(s)=boundRev(s) at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Compare the source identity you expected with the identity you actually received. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

A source-bound currentness claim requires matching observed and bound revisions.

04 · Model

Usable(s) → observedRev(s)=boundRev(s)

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem detectSourceRevisionDrift : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: detect_source_revision_drift_check

Executable TypeScript predicate: Usable(s) → observedRev(s)=boundRev(s). The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Revision equality does not establish authority or correct interpretation.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: Check the policy revision before reusing a compliance summary.

Counterexample: A summary cites a revision different from the one reviewed.

Trade-off: Revision equality does not establish authority or correct interpretation.

08 · Governance

Model risk: Identity checks cover only the named source and binding.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Evidence relations make research-agent outputs auditable claim by claim.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Knowledge & synthesis.

Field: Knowledge & synthesis · knowledge

Potential benefit: Shows exactly where synthesis outruns sources.

02 · Process

Given the declared assumptions, check the local guard Claims(result) ⊆ EvidencedClaims(result) ∪ UnknownClaims(result) at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Make support visible one claim at a time before synthesis hides the gaps. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Every material claim is covered by at least one evidence link or is marked unknown.

04 · Model

Claims(result) ⊆ EvidencedClaims(result) ∪ UnknownClaims(result)

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem bindEveryClaimToEvidence : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: bind_every_claim_to_evidence_check

Executable TypeScript predicate: Claims(result) ⊆ EvidencedClaims(result) ∪ UnknownClaims(result). The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Citation presence does not establish support quality.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: Link each finding to a passage; label unsupported extensions as unknown.

Counterexample: A plausible synthesis claim has no source relation.

Trade-off: Citation presence does not establish support quality.

08 · Governance

Model risk: Evidence mappings require claim granularity and source-quality review.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Open-world research systems must distinguish “not observed” from “observed to conflict.”

Consumer: Professional Agentic Engineers and Agentic Researchers working in Knowledge & synthesis.

Field: Knowledge & synthesis · knowledge

Potential benefit: Prevents missing records from becoming negative findings.

02 · Process

Given the declared assumptions, check the local guard Absent(E) ≠ Contradicted(E) at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

A gap in support and a conflict in support require different next moves. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Absence and contradiction occupy distinct evidence states.

04 · Model

Absent(E) ≠ Contradicted(E)

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem separateContradictionFromAbsence : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: separate_contradiction_from_absence_check

Executable TypeScript predicate: Absent(E) ≠ Contradicted(E). The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. More states complicate reporting and downstream logic.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: Report an unavailable log separately from two inconsistent logs.

Counterexample: “No evidence found” is rewritten as evidence against the claim.

Trade-off: More states complicate reporting and downstream logic.

08 · Governance

Model risk: Later aggregation can still collapse the labels.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Synthesis should integrate agreement without erasing evidence-bearing disagreement.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Knowledge & synthesis.

Field: Knowledge & synthesis · knowledge

Potential benefit: Preserves edge cases and safety signals.

02 · Process

Given the declared assumptions, check the local guard SupportedMinority(m,views) → m ∈ synthesize(views) at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

A synthesis can report agreement without erasing a material dissent. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Supported minority claims remain represented in the synthesized result.

04 · Model

SupportedMinority(m,views) → m ∈ synthesize(views)

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem preserveMinorityConclusions : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: preserve_minority_conclusions_check

Executable TypeScript predicate: SupportedMinority(m,views) → m ∈ synthesize(views). The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Retention can make summaries longer and less decisive.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: Report one substantiated dissent beside the shared finding.

Counterexample: A majority summary drops a documented minority risk.

Trade-off: Retention can make summaries longer and less decisive.

08 · Governance

Model risk: Preservation does not grant the dissent equal evidentiary weight.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Multi-agent plans need graph invariants before execution order is assigned.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Knowledge & synthesis.

Field: Knowledge & synthesis · knowledge

Potential benefit: Detects circular wait and impossible ordering.

02 · Process

Given the declared assumptions, check the local guard TopoOrder(G) → Acyclic(G) at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

A plan that depends on itself cannot be ordered by waiting harder. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

A dependency plan is schedulable only if its directed graph is acyclic.

04 · Model

TopoOrder(G) → Acyclic(G)

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem detectDependencyCycles : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: detect_dependency_cycles_check

Executable TypeScript predicate: TopoOrder(G) → Acyclic(G). The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Acyclicity does not ensure capacity or correctness.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: Extraction precedes synthesis, which precedes publication review.

Counterexample: Two tasks each wait for the other’s output.

Trade-off: Acyclicity does not ensure capacity or correctness.

08 · Governance

Model risk: Cycle checks must match the graph actually executed.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Context assembly is a constrained selection problem involving relevance and finite capacity.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Knowledge & synthesis.

Field: Knowledge & synthesis · knowledge

Potential benefit: Makes truncation and overload less surprising.

02 · Process

Given the declared assumptions, check the local guard Σcost(selected)+reserve ≤ budget at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Make the selection rule visible when the context window cannot hold everything. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

The selected context cost fits the measured budget after required reserve.

04 · Model

Σcost(selected)+reserve ≤ budget

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem selectContextWithinATokenBudget : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: select_context_within_a_token_budget_check

Executable TypeScript predicate: Σcost(selected)+reserve ≤ budget. The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Token estimates vary by tokenizer and provider accounting.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: Load mandatory instructions and a bounded source packet before optional history.

Counterexample: Sources fit alone, but history and output reserve push assembly over budget.

Trade-off: Token estimates vary by tokenizer and provider accounting.

08 · Governance

Model risk: A numerical fit is not evidence of useful context.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Source offsets are interface data; Unicode indexing assumptions must survive cross-language tools.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Knowledge & synthesis.

Field: Knowledge & synthesis · knowledge

Potential benefit: Keeps quotations attached to the intended source span.

02 · Process

Given the declared assumptions, check the local guard extract(s,a,b)=s.sliceUTF16(a,b) at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Record the index unit or a quotation can no longer be reliably re-located. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Extracted text and span coordinates use the same declared UTF-16 indexing convention.

04 · Model

extract(s,a,b)=s.sliceUTF16(a,b)

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem preserveUtf16SourceOffsets : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: preserve_utf_16_source_offsets_check

Executable TypeScript predicate: extract(s,a,b)=s.sliceUTF16(a,b). The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Coordinate conversion adds implementation complexity.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: A review tool extracts an emoji-containing passage at its exact UTF-16 range.

Counterexample: A code-point index splits a surrogate pair when interpreted as UTF-16.

Trade-off: Coordinate conversion adds implementation complexity.

08 · Governance

Model risk: Normalization and grapheme boundaries add cases beyond this fixture.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Change reporting is a derivation from two identified revisions, not an unaudited narrative.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Knowledge & synthesis.

Field: Knowledge & synthesis · knowledge

Potential benefit: Makes interface evolution inspectable.

02 · Process

Given the declared assumptions, check the local guard Added=New\Old; Removed=Old\New at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Say what entered and left a revision before narrating why it changed. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Added and removed items equal the set differences against the bound predecessor.

04 · Model

Added=New\Old; Removed=Old\New

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem explainARevisionWithSetDifferences : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: explain_a_revision_with_set_differences_check

Executable TypeScript predicate: Added=New\Old; Removed=Old\New. The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Set differences miss semantic changes to retained items.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: Compute exact field additions and removals between schema revisions.

Counterexample: The changelog claims an added field that is absent from the new version.

Trade-off: Set differences miss semantic changes to retained items.

08 · Governance

Model risk: Ordering and meaning changes need separate comparison.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Epistemic support and governance authorization answer different questions.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Knowledge & synthesis.

Field: Knowledge & synthesis · knowledge

Potential benefit: Prevents confidence from becoming permission.

02 · Process

Given the declared assumptions, check the local guard Evidence × Release is a product type, not one score. at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

A well-supported claim can still be a draft, and a released item is not a confidence score. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Evidence strength and release status are independent coordinates.

04 · Model

Evidence × Release is a product type, not one score.

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem separateEvidenceConfidenceFromReleaseStatus : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: separate_evidence_confidence_from_release_status_check

Executable TypeScript predicate: Evidence × Release is a product type, not one score.. The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Separate fields require explicit transition logic.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: Strong research support can coexist with a held publication decision.

Counterexample: A confidence score is used as authorization.

Trade-off: Separate fields require explicit transition logic.

08 · Governance

Model risk: Data-model separation alone is not enforcement.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Retrieval evidence carries a time validity boundary when the source changes.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Knowledge & synthesis.

Field: Knowledge & synthesis · knowledge

Potential benefit: Reduces stale facts in agentic decisions.

02 · Process

Given the declared assumptions, check the local guard Admit(r) → now−retrievedAt(r) ≤ maxAge(r) at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Freshness is a comparison between a recorded retrieval time and a declared limit. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Admitted retrieval age does not exceed its source-specific freshness window.

04 · Model

Admit(r) → now−retrievedAt(r) ≤ maxAge(r)

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem rejectStaleRetrievalEvidence : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: reject_stale_retrieval_evidence_check

Executable TypeScript predicate: Admit(r) → now−retrievedAt(r) ≤ maxAge(r). The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Freshness windows need domain-specific judgment.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: Refresh a changing technical specification before implementation.

Counterexample: Reuse an old product spec as current without revision inspection.

Trade-off: Freshness windows need domain-specific judgment.

08 · Governance

Model risk: Freshness does not establish source authority.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Fail-closed transitions make uncertainty actionable without blocking unrelated work.

Consumer: Professional Agentic Engineers and Agentic Researchers working in ESS & agentic engineering.

Field: ESS & agentic engineering · engineering

Potential benefit: Avoids unsafe default-to-allow behavior.

02 · Process

Given the declared assumptions, check the local guard Unknown(g) → Hold(effect) at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Preserve the current state when the condition for moving cannot be evaluated. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

An unknown safety or permission guard yields Hold for the dependent effect.

04 · Model

Unknown(g) → Hold(effect)

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem failClosedUnknownGuard : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: fail_closed_unknown_guard_check

Executable TypeScript predicate: Unknown(g) → Hold(effect). The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. An unresolved unknown can delay legitimate work.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: A missing release field holds publication and names the needed decision.

Counterexample: A missing field silently defaults to approval.

Trade-off: An unresolved unknown can delay legitimate work.

08 · Governance

Model risk: Hold routes need a usable resume condition.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Agentic authority is a conjunction of technical capability and a scoped release.

Consumer: Professional Agentic Engineers and Agentic Researchers working in ESS & agentic engineering.

Field: ESS & agentic engineering · engineering

Potential benefit: Separates “can” from “may.”

02 · Process

Given the declared assumptions, check the local guard Execute(e,t) → Capable(e) ∧ Permitted(e,t) ∧ ScopeMatch(e,t) at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Require the requested action and scope to match an explicit permission exactly. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Execution requires capability, permission, and exact target scope.

04 · Model

Execute(e,t) → Capable(e) ∧ Permitted(e,t) ∧ ScopeMatch(e,t)

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem capabilityPermissionExactScope : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: capability_permission_exact_scope_check

Executable TypeScript predicate: Execute(e,t) → Capable(e) ∧ Permitted(e,t) ∧ ScopeMatch(e,t). The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Every path to an effect must enforce the same guard.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: A local edit occurs only when its target is included in the current instruction.

Counterexample: Tool availability is treated as permission to publish.

Trade-off: Every path to an effect must enforce the same guard.

08 · Governance

Model risk: A predicate model is not a security boundary by itself.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Dashboards and summaries are projections with declared information loss.

Consumer: Professional Agentic Engineers and Agentic Researchers working in ESS & knowledge engineering.

Field: ESS & knowledge engineering · engineering

Potential benefit: Prevents a convenient view from masquerading as the source.

02 · Process

Given the declared assumptions, check the local guard Project(x) → LossRecord(x) ≠ ∅ at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Make every dropped or normalized field visible to the next reader. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Every lossy projection carries an explicit account of material omitted information.

04 · Model

Project(x) → LossRecord(x) ≠ ∅

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem returnAProjectionLossReport : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: return_a_projection_loss_report_check

Executable TypeScript predicate: Project(x) → LossRecord(x) ≠ ∅. The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Loss inventories require maintenance.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: A dashboard says it omits event ordering and links the canonical log.

Counterexample: A short summary is treated as a complete record.

Trade-off: Loss inventories require maintenance.

08 · Governance

Model risk: A loss list may itself omit material losses.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Agent pipelines are composable only across compatible contracts.

Consumer: Professional Agentic Engineers and Agentic Researchers working in ESS & software architecture.

Field: ESS & software architecture · engineering

Potential benefit: Detects integration mismatch before runtime.

02 · Process

Given the declared assumptions, check the local guard Output(P) ⊑ Input(C) at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Compare required field names and types before connecting two components. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

A producer output connects only when accepted by the consumer contract.

04 · Model

Output(P) ⊑ Input(C)

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem checkProducerConsumerCompatibility : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: check_producer_consumer_compatibility_check

Executable TypeScript predicate: Output(P) ⊑ Input(C). The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Version equality can hide semantic differences.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: A synthesis worker accepts the extraction schema version emitted upstream.

Counterexample: A producer adds a required field the consumer does not accept.

Trade-off: Version equality can hide semantic differences.

08 · Governance

Model risk: Compatibility metadata must reflect actual consumer behavior.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Retries in distributed agent workflows need operation identity, not just repeatable wording.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Exocore & reliable workflows.

Field: Exocore & reliable workflows · engineering

Potential benefit: Reduces duplicate external effects.

02 · Process

Given the declared assumptions, check the local guard key(a)=key(b) ∧ payload(a)≠payload(b) → Conflict(a,b) at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Bind a key to a request digest before deciding whether to replay or reject. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

A reused idempotency key with a different payload is a conflict, never a new operation.

04 · Model

key(a)=key(b) ∧ payload(a)≠payload(b) → Conflict(a,b)

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem detectIdempotencyKeyConflicts : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: detect_idempotency_key_conflicts_check

Executable TypeScript predicate: key(a)=key(b) ∧ payload(a)≠payload(b) → Conflict(a,b). The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Requires durable key and payload records.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: Retry the identical request using its original operation key.

Counterexample: A changed request silently reuses the previous key.

Trade-off: Requires durable key and payload records.

08 · Governance

Model risk: Safety depends on canonical payload comparison and storage.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Timeout after send is a distinct state from confirmed failure.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Exocore & reliable workflows.

Field: Exocore & reliable workflows · engineering

Potential benefit: Prevents uncertain outcomes from multiplying effects.

02 · Process

Given the declared assumptions, check the local guard Indeterminate(s) → ¬Redispatch(s) at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Preserve the saved claim when continuity is lost and require a new recovery decision. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

An indeterminate sent step is reconciled before it can be dispatched again.

04 · Model

Indeterminate(s) → ¬Redispatch(s)

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem holdIndeterminateModelSteps : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: hold_indeterminate_model_steps_check

Executable TypeScript predicate: Indeterminate(s) → ¬Redispatch(s). The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. May require a readback or reconciliation route.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: Check the operation ledger before repeating a timed-out model action.

Counterexample: Assume timeout proves the provider never received the request.

Trade-off: May require a readback or reconciliation route.

08 · Governance

Model risk: Reconciliation itself can fail or be unavailable.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Retry timing is a bounded recovery policy and part of system behavior.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Reliable software systems.

Field: Reliable software systems · engineering

Potential benefit: Limits unbounded waits and makes traces reproducible.

02 · Process

Given the declared assumptions, check the local guard delay(n)=min(base·factorⁿ, cap) at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Bound both the number of attempts and the exponential delay. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Deterministic backoff delay never exceeds its configured cap.

04 · Model

delay(n)=min(base·factorⁿ, cap)

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem capDeterministicRetryBackoff : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: cap_deterministic_retry_backoff_check

Executable TypeScript predicate: delay(n)=min(base·factorⁿ, cap). The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Synchronized retries can still amplify load.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: Apply deterministic exponential delay with a maximum wait.

Counterexample: The exponential schedule exceeds its advertised cap.

Trade-off: Synchronized retries can still amplify load.

08 · Governance

Model risk: Delay bounds do not determine a safe retry count.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Typestate encodes review transitions into the API rather than an editable status label.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Rust & agentic engineering.

Field: Rust & agentic engineering · engineering

Potential benefit: Makes invalid state transitions harder to express.

02 · Process

Given the declared assumptions, check the local guard Release(s) → s = Accepted at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Make release-candidate operations unavailable on draft values. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Only the accepted review state admits the release transition.

04 · Model

Release(s) → s = Accepted

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem encodeReviewStateWithRustTypestate : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: encode_review_state_with_rust_typestate_check

Executable TypeScript predicate: Release(s) → s = Accepted. The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Does not authenticate who performed review.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: The publish function requires an AcceptedReview token.

Counterexample: A draft string is changed to “accepted” without reviewer action.

Trade-off: Does not authenticate who performed review.

08 · Governance

Model risk: Program types do not establish organizational authorization.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Error-aware parsing preserves uncertainty at agent/software boundaries.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Rust & reliable interfaces.

Field: Rust & reliable interfaces · engineering

Potential benefit: Prevents malformed model output from looking like valid empty data.

02 · Process

Given the declared assumptions, check the local guard parse : Input → Result<Value, ParseError> at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Return either a bounded integer or a typed reason the input was rejected. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Malformed input yields an explicit parse error, not a guessed default value.

04 · Model

parse : Input → Result<Value, ParseError>

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem makeParseFailureExplicitWithRustResult : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: make_parse_failure_explicit_with_rust_result_check

Executable TypeScript predicate: parse : Input → Result<Value, ParseError>. The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Callers must handle error branches.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: A missing required field returns a diagnostic and stops downstream use.

Counterexample: Parser substitutes an empty object and proceeds.

Trade-off: Callers must handle error branches.

08 · Governance

Model risk: An explicit error can still be swallowed by a later layer.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Ownership gives agent handoffs a resource-lifecycle model, not merely a message-passing metaphor.

Consumer: Professional Agentic Engineers and Agentic Researchers working in Rust & agentic engineering.

Field: Rust & agentic engineering · engineering

Potential benefit: Reduces aliasing and conflicting mutation.

02 · Process

Given the declared assumptions, check the local guard Move(r,A,B) → owner(r)=B ∧ ¬CanUse(A,r) at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Consume a task packet so the sender cannot keep using the same value. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

After ownership transfer, the receiver owns the resource and the sender cannot mutate it.

04 · Model

Move(r,A,B) → owner(r)=B ∧ ¬CanUse(A,r)

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem transferRustOwnershipAtTaskBoundaries : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: transfer_rust_ownership_at_task_boundaries_check

Executable TypeScript predicate: Move(r,A,B) → owner(r)=B ∧ ¬CanUse(A,r). The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. Exclusive ownership may be awkward for shared review.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: A Rust worker receives a value and returns an immutable receipt.

Counterexample: Two workers mutate one shared artifact under different assumptions.

Trade-off: Exclusive ownership may be awkward for shared review.

08 · Governance

Model risk: Language ownership does not settle semantic responsibility.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.

01 · Intent

Pure planning and effectful execution are separate layers in governed agent systems.

Consumer: Professional Agentic Engineers and Agentic Researchers working in ESS & agentic engineering.

Field: ESS & agentic engineering · engineering

Potential benefit: Makes proposals reviewable without accidental action.

02 · Process

Given the declared assumptions, check the local guard Plan(e) ∧ ¬Released(e) → state′=state at the handoff; preserve a violating input and withhold the transition when it fails.

Boundary: This is a local contract; it does not prove model reasoning or end-to-end system quality.

03 · Knowledge

Let planning describe work while effect admission checks exact releases separately. This proposal treats the stated law as a local invariant under its declared assumptions; its transfer beyond the named workflow remains a hypothesis.

Constructing a plan without a release leaves system state unchanged.

04 · Model

Plan(e) ∧ ¬Released(e) → state′=state

Lean-style proof sketch · not Lean-checked

-- Lean proof shell: the property is assumed as a contract premise.
-- This shell does not prove the Fieldcraft law itself.
variable (Contract : Prop) (h_contract : Contract)
theorem separatePurePlansFromReleasedEffects : Contract := by
  exact h_contract

No Lean/Lake executable is available here. This is a syntax-highlighted proof shell with the property supplied as a premise; it is not a proof of the Fieldcraft law. The executable TypeScript fixtures are separately checked.

05 · Method

Executable check: separate_pure_plans_from_released_effects_check

Executable TypeScript predicate: Plan(e) ∧ ¬Released(e) → state′=state. The validator runs both a valid witness and a counterexample witness.

06 · Evidence

The two TypeScript fixtures check this local predicate on one admitted and one rejected input. They support only the executable predicate; they do not establish the source formalism or runtime behavior. The execution boundary must be explicit and complete.

• admitted witness: expected true, observed true
• counterexample witness: expected false, observed false

Observed: admitted witness passes; counterexample is rejected.

07 · View

Worked case: Draft a deployment plan without invoking the deployment API.

Counterexample: The planner performs the deployment while describing it.

Trade-off: The execution boundary must be explicit and complete.

08 · Governance

Model risk: Purity must be checked at runtime effect boundaries.

Effect boundary: Passing a fixture grants no tool use, external effect, publication, or human acceptance.

Next evidence: Bind the full source manuscript, run a genuine Lean proof, and gather target-runtime evidence.