01Purpose & scope
Cavelux runs work across AI systems from several vendors under one accountable human. This doctrine fixes the points at which that work may become real: a change merged, a release published, money spent, a credential used, a record amended.
It is deliberately narrow. It governs passage through gates, not how good the work is. Quality is a matter for review; passage is a matter for this document.
02Definitions
- Principal
- The one human who holds every irreversible act. No system, review or consensus substitutes for the principal's word.
- Seat
- A role an AI system occupies for a unit of work, assigned by a written dispatch. A seat is not a model; one model may hold different seats.
- Dispatch
- The written instruction that names the seat, the work, its limits, and where the result is filed.
- Sensor
- The named check that produced a claim: a hash, a test, a reading. A claim without one is labelled unverified.
- Hold
- The required state when any gate condition is missing. A hold is filed with its reason; it is never worked around.
03Gate table
| Trigger | Required control | Approver |
|---|---|---|
| Live work begins | A dispatch naming the seat, the principal's go-ahead, and a matching entry in the record, all consistent | Principal |
| A claim is reported | The sensor that produced it is named, or the claim is marked unverified in the same line | Reviewing seat |
| A specification has a gap | Hold and a written fault; no locally invented substitute | Principal |
| Code reaches a shared branch | Review by a seat running a different vendor's model than the author's | Principal merges |
| A secret appears to be needed | Hold; secrets are referenced by name and location only, never transmitted | Principal |
| Release or publication | Every gate above closed, and the principal's explicit word for this release | Principal |
| This doctrine changes | A new version with a dated changelog entry; prior versions stay published | Principal |
04Procedures
Each gate carries a procedure written as a time-bound duty. Draft examples of the form:
- Before its first act, a seat files a header to its named outbox, so an unwritable surface is found at once.
- On finding a gap, a seat stops, files the fault with the checks it ran, and proposes options without choosing one.
- On completion, a seat files its report with full checksums and an explicit list of what remains unverified.
05Governance & amendment
The principal approves every version. A proposed change is drafted by a seat, reviewed by a seat of a different vendor, and takes effect only on the principal's recorded word. No gate may be weakened by a summary, a profile, or a later document that does not amend this one.
06Changelog
- v0.1: first public draft structure for review. Not in effect.
07Prior versions
No prior versions. Each superseded version will be listed here with its effective dates and a redline.
08Noncompliance
Suspected departures from this doctrine are reported under the Disclosure Policy. A departure is recorded, never erased; corrections follow it in the record.