FACTORY_CONTRACT.md

pipelines/FACTORY_CONTRACT.md

The Factory Contract — the chapter axis

Status: ACTIVE v1.0.5 (minted 2026-07-27, window-plan rank 2.5; revised the same day by the lane-B

critic pass — R4 minted, the S2 rank scan corrected, sixteen ruling anchors repaired; v1.0.2

the story-depth Wave 3 arc-axis wiring 2026-07-29; v1.0.3 the ten-lane pipeline gap audit's

eleven content-class riders 2026-07-29 — this header still read v1.0.1 at v1.0.2, so the version

is now carried in one place and corrected here rather than left as a stale label; v1.0.4 the

twenty-eighth sitting item J4 — FR-082, the ally switch's uncontrolled-behaviour obligation,

with its migration_ledger row 2026-07-30; v1.0.5 the thirty-first sitting's pipeline-hardwiring

mandate 2026-08-03 — FR-083 to FR-087, the five art-asset riders for the concept-art PLATE lane,

which a recursive walk of the machine mirror found to have ZERO representation here against a

50-hit registry positive control). Tier: T99 operational — subordinate to

the CVD and to every tier doc. Machine mirror: docs/factory_contract.json. Tooth: gate 30

factory_contract (harness/check_factory_contract.py). Checklist emitter:

harness/emit_chapter_checklist.py.

This document sets no canon. A rider row is never the source of a rule — it is always a pointer to

one, and the ruling it points at is the authority.

1. What this is, and the failure it ends

Everything in the factory is keyed on a NODE or on a SYSTEM. The chapter-as-obligation axis had no key

at all: nothing in the repo answered "for Ch 23, what must be true?" Rulings reliably became canon and

reliably became gates; they became per-chapter factory behaviour only when a human remembered to edit

a prose bullet list, and that memory measurably failed.

The contract is the single accumulating per-chapter obligation register. One row per RIDER: a thing

that must be true of every chapter, or of every chapter of a class, as a consequence of a ruling. Two

things follow from that shape, and they are the whole design:

• The checklist is DERIVED. A rider added here reaches every future chapter automatically; a

hand-maintained list reaches only the chapters someone remembered to edit.

• A landing that makes a per-chapter promise declares an OWNER: line and a rider row in the same

commit. Gate 30 fires the day a promise lands uncited, which is the anti-orphan doctrine made

executable rather than aspirational.

2. The four freeze constraints (verbatim, as landed in the window plan)

These are quoted exactly as they stand in docs/PRE_5090_BUILD_PLAN.md, which is the binding copy —

the window plan, not the charter, is what the factory reads. Gate 30 asserts this block is a verbatim

substring of the plan and that all four cited ranks resolve to real ranks.

Story-depth program freeze constraints (2026-07-27). (1) Rank 2.5 (factory contract) lands

BEFORE ranks 13-17 — the schema-freeze ranks emit rider rows rather than retrofit them.

(2) The arc schema (T0_Arc_Index / T0_Arc_Grid / T0_Arc_Grammar / T0_Promise_Ledger) lands

BEFORE rank 10 — the 264-seed typing pass assigns arc_id at typing time, which turns the

hub-and-spoke gap and the flat-SQ finding into one fix instead of two passes. (3)

T0_Chapter_Index.emotional_register lands BEFORE rank 8 — rank 8's music cue table has no

upstream mood source today. (4) Rank 11 (T0_Persona_Index) lands BEFORE any companion-arc

typing — typing arcs against personas that are about to change types them twice. Source: the

story-depth program charter; constraints are recorded here because the window plan, not the

charter, is what the factory reads.

3. What every chapter build MUST consume

The inputs below are the ruled systems inventory a chapter build reads before it authors anything.

Each is carried by at least one rider, so the list cannot rot independently of the register.

• The chapter's spine entry and its RCM section — the canon input everything downstream cites

(FR-030).

• The enrich pack as the single grounded context, including the seven carry-forward continuity fields

that make the predecessor's end state this node's start state (FR-043, FR-054).

• The design-system docs the pack hands the author, and the enhancement-program docs the

/spine-chapter manifest loads — recorded as two rows precisely because they have diverged

(FR-056, FR-057), with the 2026-07 combat and voice doctrine still outside the pack (FR-059).

• The significance-lens roster and its relevance filter, the cross-cultural weave vocabulary, and the

region-as-relational-web reading (FR-044).

• The persona layer on every entity the chapter surfaces, which the natural-voice and living-world

lanes read from (FR-035).

• The care tier and, on a hard-line chapter, the Stage-2 canonical-question set (FR-053).
• The naming method for every NPC, site and boss name introduced (FR-052).
• The region's substrate: must-acquire anchors acquired, the rest deep-researched, and the region's

pass-2 deep-read batch (FR-031).

• The ruled combat systems inventory — foundry, combo and EAM, rune forge, status framework, healing

and poison lanes, presentation ladder, arena mutation, bonus tiers, imprints, loadout sets, the

balance doctrine, the role taxonomy and the ally stat model (FR-001 to FR-013).

• The natural-voice doctrine, both critic lenses, and the difficulty routing rule (FR-024 to FR-029).
• The arc pack — every arc staged at this node with its stage and its previous and next staged

node, every promise the node makes, every promise pointed at it, and how many of those arcs

still carry no declared disposition (FR-058).

4. What every chapter build MUST emit

• The spine entry in the CVD formatting register, with every anchored claim resolvable and

entailment-verified (FR-047, FR-048, FR-049).

• All three player layers, with reveal discipline held in prose and in every player-facing string

(FR-045, FR-046).

• The arc axis advanced: every arc the pack stages at this node either advanced or deliberately

held, every promise pointed at the node paid or explicitly carried, and no arc with an

undeclared disposition resolved — authored at Step 3a-ARC, verified by the critic's arc lens

(FR-068, FR-069).

• The structured-field scatter to the live registries, with the fidelity baseline refreshed in the

same commit, and the entry enrolled in the lint and anchors target lists (FR-050, FR-051).

• The staged region: parameterized terrain and staging drivers, then the W-SPACE pass, always

(FR-032, FR-033).

• The typed seeds, the spoiler-safe player-strings sidecar, the discovery clue rows, the per-boss

non-kill and pip schema, the festival windows and the region's ambient and SFX rows (FR-034,

FR-036 to FR-039).

• The asset passes as drop-ins over the asset-path contract (FR-040).
• The QA loop's verdict and the five-class scorecard, whose fifth class is rider completeness

(FR-041, FR-042).

• The eleven content classes the chapter axis was measurably blind to until 2026-07-29: the chapter's

audio rows, its interiors as real enterable volume, its water as water, its weather and

time-of-day per beat, its item and material and gather bill, its vendors and the region's diegetic

exchange medium, its journal entries, its quest rows, its personas' schedules and the pooled

buckets its crowds draw on, its icon ids, and its cinematics sized before they are built

(FR-071 to FR-081). All eleven are SEED: they surface in every checklist and gate nothing yet,

and each names the register entry that owns its gap.

• The chapter's CONCEPT ART, keyed and accounted: every plate keyed on a live canon id, delivered

against the per-density-class floors by counted rows rather than assertion, Lane-G refused for

every living-tradition or protected subject, a resolvable licence record per generated plate, and

nothing published except through the marketing-clear query (FR-083 to FR-087). All five are SEED:

the plate lane was measurably outside this axis until 2026-08-03, and recording the obligation is

not the same as arming it.

• The consumption manifest build/factory/CH_NN.json, mapping rider id to artifact path, verdict and

evidence (FR-067).

5. The rider register

Field meanings: rider_id is stable forever; ruling_src points at the RULING, never a summary, as a

doc#anchor pointer gate 30 resolves rather than trusts;

obligation is one imperative sentence, per chapter; lane routes the work; scope is all, a

class: token derived from the live tree, or once; data_home is the registry column, path glob,

anchored doctrine file, the plates:<path>#<column> plate-table column (the concept-art lane's home

is docs/art_boards/PLATES.csv, a live status-bearing table that is not a registries/ registry),

an explicit NONE_YET(rank NN), or NONE_YET(GAP-NNN) naming the

DESIGN_GAP_REGISTER entry that owns the gap when no rank owns it yet; tooth is a gate name, a critic lens, or

NONE(reason); consumption_point is the real place a chapter build picks the rider up; status

is BUILT, PARTIAL, SEED or DEFERRED.

Only BUILT riders bind. SEED riders surface in every checklist and never fail the gate — the

contract records the whole obligation set, and only the proven part is binding. That is the answer to

the ossification objection: a fifty-row register is not a fifty-row bureaucracy unless every row

gates, and most rows do not.

The table below is GENERATED from docs/factory_contract.json by

python harness/emit_chapter_checklist.py --render-contract. Editing it by hand is a gate failure —

gate 30 re-derives it and compares.

<!-- RIDER-TABLE:BEGIN (generated -- python harness/emit_chapter_checklist.py --render-contract) -->

<!-- RIDER-TABLE:END -->

6. The per-chapter checklist — derived, never hand-typed

python harness/emit_chapter_checklist.py CH_NN emits the rider set filtered by scope, ordered by

lane, split into binding and advisory, each with an evidence slot. This is the artifact that answers

"for Ch NN, what must be true?" and it is the brief a chapter-build agent is handed.

Scope classes are derived from the live tree, never from a re-typed list: class:slice is the ruled

Prologue-to-Ch-13 vertical slice, class:hard_line and class:boss come from T0_Chapter_Index,

class:realm from T0_Region_Index node kinds, and the two care classes are parsed out of

harness/enrich.py so the care vocabulary has exactly one home. A chapter that gains a boss gains the

boss riders with no edit anywhere — though as measured on 2026-07-27 all 79 chapter rows already carry

a primary_boss_id, so class:boss currently selects the same set as all and nothing is left to

gain one. The deriver is live and correct; the cardinality is recorded here and in the json so a

future reader does not mistake that class for a filter that is currently narrowing anything.

7. The consumption manifest, written by the build

build/factory/CH_NN.json maps rider_id to artifact path, verdict and evidence. The P5 per-chapter

scorecard's four row classes — content budget, structure completeness, test coverage, care and reveal

— gain a fifth: rider completeness.

8. The tooth — gate 30 factory_contract

Six rulers plus a vacuity guard, all deterministic and offline. Severity follows status: a BUILT

rider fails, a PARTIAL rider fails on its home and warns on its consumption, a SEED or DEFERRED

rider warns. R1 is the exception — an uncited promise is a FAIL at any status, because losslessness is

the property the whole register rests on.

• R1 RIDER-COVERAGE. Every OWNER: line in the declared doc set is cited by at least one rider, and

every promise-phrase occurrence is cited too. The primary net is structured: an OWNER: line is a

machine token an author cannot paraphrase away. The phrase net is the secondary catch for landings

that promise per-chapter behaviour with no OWNER: line at all, and it is reviewed at every wave

boundary — a phrase-list addition is a one-line change, never a redesign.

• R2 HOME-AND-TOOTH RESOLUTION. Every data_home resolves: the registry and column exist, or the

glob is non-empty, or the doctrine file exists, or it is NONE_YET with a live window-plan rank

cited or a real DESIGN_GAP_REGISTER entry id cited. The register form exists because the rank

form rots silently: FR-029 cited rank 11 for a dialogue home that rank does not deliver, so the

rider read legitimately-pending forever while this ruler stayed green. Every tooth names a registered gate, a critic lens that appears on a declared critic

surface, or NONE(reason) with a real reason — a lens that lives only in a doctrine file is run by

whichever agent happens to know it, which is the same rot in a different costume.

• R3 CONSUMPTION-REACHABILITY. Every consumption_point names a real place AND that place actually

cites the rider's subject through its declared citation token. A BUILT rider must declare a

citation token that resolves.

• R4 RULING-SRC RESOLUTION. Every ruling_src resolves: the doc exists and the anchor is reachable,

either as a unit head under the anchor rule or as the slug of the real line the rider cites. This

ruler exists because section 1 rests the whole design on a rider row being a pointer, and nothing

checked the pointer — sixteen anchors were unreachable at mint, nine of them longer than the

48-character truncation the rule itself declares, so no input could ever have produced them. R4 is

WARN-scoped at v1 and reports the pointers that resolve to a cited line rather than a unit head

under DECLARED NOT-ARMED on every run.

• S1 MD/JSON SYNC. The generated rider table inside this document equals the table re-derived from

the json. The human view can never drift from the machine view.

• S2 FREEZE-ORDER. Section 2's block is a verbatim substring of docs/PRE_5090_BUILD_PLAN.md, rank

2.5 is greppable there, and every rank the four constraints cite resolves to a real rank in the

window plan. The scan is case-insensitive and decimal-aware, and it reads the whole block rather

than its first paragraph — constraints (1) and (4) open with a capital Rank, so a case-sensitive

scan saw neither, and rank 11 was asserted by nothing while looking exactly like a clean check.

• Vacuity guard. The gate FAILs if the rider set is empty, if no rider resolves a home, if the

declared doc set yields zero OWNER: lines, or if it matches zero promise phrases — a regex that

can no longer match reports zero and looks exactly like a clean repo.

Every ruler ships must-fire and must-not-fire fixtures, runnable with --self-test, which the gate

also runs on every real invocation and exits 2 if a ruler rotted.

DECLARED NOT-ARMED (2026-08-03): R2 does not yet resolve the plates: home form. R2's

data_home branches are hardcoded in harness/check_factory_contract.py, so the five art riders

FR-083 to FR-087 are reported as an *unrecognised data_home form* at WARN — SEED severity, so gate 30

stays green — until a prefix branch plus its must-fire fixture lands there. The form is declared in

docs/factory_contract.json under data_home_kinds, and it is recorded this way on purpose: the

alternative was to downgrade the five riders to path:docs/art_boards/PLATES.csv, which resolves the

FILE while leaving the COLUMN unchecked and would have read green without checking anything. A WARN

that names the exact one-line arming step is the honest state; a green that checks nothing is not.

9. The migration ledger — where v1 came from

Losslessness claim for the critic: every OWNER: line and every promise-phrase occurrence in the

declared doc set maps to at least one rider, and every rider cites a real ruling anchor. The

measurements below were taken on 2026-07-27 against the live tree.

Known secondary surfaces, declared rather than silently widened: entries 1 to 9 of

docs/DESIGN_GAP_REGISTER.md use a lowercase Owner: token (9 lines) instead of the machine token,

and they sit outside R1's primary net at v1 by design — folding them in means normalising the token

in the source doc, which is a v1.1 item. docs/ROADMAP_POST_5090_TO_SHIP.md carries one more

lowercase Owner: line, measured the same day.

Two surfaces outside the declared doc set carry live factory promises and are named here rather than

silently omitted. docs/DOC_MAP.md carries three promise-phrase occurrences — "joins the P5 factory"

and "the factory's authored lanes" and "the factory inherits" — and it is both the surface FR-060

obligates and the surface the charter records as rotted in both directions, so it is the first entry

in the v1.1 harvest. The rest of that harvest: Vol2's status block, QA_WATCHING's pillars, the

realm-design class:realm riders, and the progress ledger's "riders noted" lines, which are the most

fragile home of all.

10. Standing rules for anyone landing work

• A landing that makes a per-chapter promise declares an OWNER: line and a rider row in the same

commit. A promise without a row is an orphan by construction.

• Edit docs/factory_contract.json, then run the render command. Never hand-edit the rider table or

a per-chapter checklist.

• A rider is not "done" when its prose lands. It is done when its data_home resolves, its tooth

names something that runs, and its consumption_point is a place that actually cites it.

• Statuses move one way under evidence: SEED to PARTIAL to BUILT, each promotion carrying the

commit or ledger entry that made it true in the evidence field.

Generated by harness/site/structure_site.py — the URL path is the repo path. review root