ADR 0050: Separate The Safety Kernel, Optional Contracts, And Guidance

Status

Accepted.

Context

STAGE 0.5 grew by turning lessons from one primary project and a sequence of model-bound behavior probes into a broad conformance specification. The resulting method was honest about its evidence limits, but its form implied more certainty than that evidence supported:

• SPEC.md contained 134 RFC-style requirement keywords, including more than 100 MUST or MUST NOT occurrences;
• the universal delivery section alone contained 28 normative requirements;
• the repository retained 49 earlier decision records and 244 tests;
• tests/test_core_workflow_routing.py used hundreds of exact phrase and regular-expression assertions to preserve prompt wording; and
• the installed delivery skill had expanded to more than 300 lines.

Several recent rules were valid corrections to a failed detached visual rehearsal. They were nevertheless transcript-shaped: each correction added a new universal clause and another prose-lock test. The resulting prompt burden did not have corresponding independent-adoption or productivity evidence. The recorded behavior probes also remained expensive after the route improved.

This conflicts with four relevant evidence lines:

• RFC 2119 says imperatives should be used carefully and sparingly, for interoperability or harm prevention rather than to impose an unnecessary method.
• Anthropic's Building effective agents recommends the simplest sufficient system, clear agent-computer interfaces, and added complexity only when it demonstrably improves outcomes.
• Anthropic's context-engineering guidance treats context as finite and advocates curating useful tokens rather than front-loading every possible instruction.
• Gloaguen et al.'s repository-context study found no significant success improvement from repository instruction files in its evaluated software tasks while observing greater agent cost and activity. Its task population is not Unity game development, so it is directional evidence against unmeasured instruction growth, not a universal result.

Decision

STAGE 0.6 separates three kinds of material.

1. Universal Safety Kernel

Only behavior needed to prevent plausible harm or preserve human authority is universally normative:

• follow the newest authorized outcome and stop a rejected or diagnosis-only branch before unauthorized implementation;
• protect pre-existing, unrelated, and human-authored state;
• fail closed when ownership, destructive scope, credentials, publishing authority, or actual execution outcome is unresolved;
• use canonical project sources and the real production consumer for material claims;
• do not substitute compilation or automated tests for runtime, visual, experiential, or human product acceptance;
• disclose unavailable or inconclusive verification;
• keep high-risk experiments reversible; and
• leave final product, taste, destructive, and release decisions with the accountable human.

These requirements are deliberately few. They constrain unsafe conduct rather than prescribe one architecture or ceremony.

2. Optional Interoperability Contracts

Project maps, manifests, named operations, ownership records, evidence coordinates, schemas, and migrations remain normative only after a project or tool deliberately adopts that interface. Their requirements exist so separate humans and tools can interpret the artifact consistently. They do not become requirements for ordinary game work.

3. Practitioner Guidance

The STAGE qualities, domain questions, delivery loop, consumer-complete verification heuristic, earned-infrastructure rule, inspection stopping heuristics, architecture patterns, and visual guidance become recommendations and question sets. They remain important, but a project does not fail conformance because it uses a different safe route.

STAGE will report bounded application and adopted contract status instead of implying that a project architecture is conformant to a universal ideal. There is no aggregate maturity or product-quality score.

Section Disposition From 0.5

0.5 section	0.6 disposition
Purpose and non-goals	Retain as scope and evidence boundary.
Normative language	Restrict to harm prevention and adopted interoperability contracts.
Five pillars	Retain as descriptive qualities and design questions.
Practitioner Kernel	Reduce to the universal Safety Kernel plus a short delivery loop.
Project mapping	Keep as an optional adopted contract.
Domain contract	Convert to a non-normative inspection lens.
Project-native mapping	Keep as guidance inside the optional map contract.
Operation contract	Keep normative only for a declared named operation.
Ownership authority	Protect authored state universally; keep the detailed taxonomy optional.
Evidence coordinates	Keep claim honesty universal; keep record fields optional.
Earned infrastructure	Retain as guidance, not a conformance gate.
External inspection	Retain source-preservation requirements when read-only status is claimed.
Human-agent authority	Keep product and destructive authority in the Safety Kernel.
Delivery loop	Keep as the recommended default; compress transcript-specific branches into authority principles.
Conformance	Replace with application and contract reporting.
Compatibility	Keep normative for versioned public artifacts.

Testing Consequence

Repository tests will validate executable behavior, schemas, package shape, link integrity, version consistency, absence of retired duplicate routes, and small context budgets. They will not freeze paragraph wording as a proxy for agent behavior. Semantic prompt review and model-bound probes remain explicit human-evaluated activities.

Consequences

• Ordinary use becomes shorter and easier to understand.
• A safe project can use STAGE without adopting STAGE's architectural vocabulary or artifacts.
• Existing map and study schemas remain supported.
• Some 0.5 claims called "conformance" become non-normative guidance or narrower adopted-contract claims.
• The method becomes easier to revise without adding a new prompt clause and phrase assertion for every correction.
• STAGE still needs independent and longitudinal evaluation; simplification improves claim discipline but does not establish effectiveness.

Evidence Boundary

This decision combines STAGE's own specification and test audit, the failed visual-rehearsal path, model-bound behavior probes, primary agent-engineering guidance, and RFC requirement-language discipline. It has not yet been tested through independent long-term adoption. The 0.6 release must therefore be described as a simplification and evidence-alignment change, not proof that the new kernel is optimal.