Power stone
Worker
Acts, never remains. The stone that carries the blow is also the stone most tightly chained: created by a Directive, killed by its boundary, gone.
The discipline
Worker is not a fifth product. It is an ephemeral execution role: a Directive creates it, its boundary kills it. It never persists, never loops, and never schedules itself.
Watch is cheap, thought is rare, and action is final. Final things get fences. The gauntlet grants the Worker no memory of its own, no clock of its own, and no permission to exist past its job. When the boundary hits, the hard kill lands within 30 minutes and nothing of the Worker stays behind.
This is why v0.1 stops where it stops: the chain ends at a signed directive sitting in the Outbox. A signed directive is a promise recorded, not an action performed, and this page will never pretend otherwise.
Action is final, so action is fenced
An observer can be wrong and a council can be talked out of it. An actor cannot be un-acted. That asymmetry is the whole reason the Worker gets the shortest leash of any stone.
A Directive
The Directive is the Worker's entire world: its creation order, its leash, and its death certificate in one document.
A Directive must not grant persistence, looping, or scheduling. Identity and recall writes never touch the disk directly; they route through Librarian approval.
The allowed verbs come from ALLOWED_ACTIONS: read, report, notify, review, escalate. Everything else is refused: delete, write, the wildcard *, and even whitespace-padded verbs are rejected by the shared fence corpora.
Proposals travel under the schema irin.directive.proposal.v1 with authority recommend and verdicts Act or Dismiss. A verdict of Act pins scope.tenant to the expected tenant, so a directive cannot drift across tenant lines.
The Outbox lifecycle
Signed directives wait in the Outbox. Everything below is the lifecycle of that artifact: staged, claimed, heartbeated, acknowledged, or returned.
created_at:id.X-Tenant-Scope header, and canary. claim_limit is 1..200, lease is 1000-300000 ms.opaque_handle. Extension window: 1s to 300s.not_actionable when the row cannot be acted on.WorkerProvenanceGuard. The route is always mounted, but the built-in worker loop is default-off and not operator-ready.Signing
Every Outbox entry passes the same three-step sealing: Canonicalize (RFC 8785) then Sign (Ed25519) then Chain (an append-only, hash-chained outbox where pruning is forbidden). The result is non-repudiation plus tamper-evidence: the artifact cannot be quietly edited, and it cannot be quietly denied.
Provenance guards
When something claims a Worker did it, the system states exactly how much of that claim is proven. No rounding up.
opaque_handle_only, verified_exact, or unavailable, each paired with an explicit fabrication_guard.Who may act today
Power answers to gates, claims, and ceilings. All of them fail closed.
The three gates
- Sentinel loaded.
- Dispatcher enabled.
- Producer armed.
There is also a boot triple-gate: WATCH_PRODUCER_ENABLED plus EXECUTION_MODE=LIVE plus WATCH_DISPATCHER_GATEWAY_KEY. Passing it starts the producer for recovery and testing, but it never writes active_arm. Spend reserves fail closed without the hardware ceremony.
Writer claim
Exactly one live writer per watch.db. Heartbeat every 30s; a claim goes stale at 90s; a lost claim self-disarms.
Spend ceilings
min(daily_ceiling, charge_unit*claims_per_tick + in_flight_at_disarm)Fine print: read before you snap your fingers
- v0.1 ends at the signed directive artifact. Never describe a signed directive as an action that happened.
- A signature proves what was signed, not that the signer should have been trusted.
- The built-in worker loop (
WATCH_WORKER_ENABLED) is a default-off development path, not an operator-ready autonomous execution path. WATCH_PRODUCER_ENABLED=truealone is not arming.make runtime-statusproves liveness only;make verifyproves the isolated no-spend path only. Neither proves live provider calls, an armed producer, or Worker execution.