The lifecycle

One cycle, at every level

An idea, a project, a specification and a single function are worked by the same seventeen activities. Any step may expand into a whole cycle one level down.

Work goes down as constrained, isolated, fully specified units. Results come up as verified claims plus a summary. In between, agents judge, tools execute, and the owner says yes at a small number of fixed points.

Five rules govern the graph

Entry is a condition over artifact states, not a predecessor finishing. Feedback never returns; it creates new work. Doubt promotes. Every activity declares eight things.

1. 1

   Entry is a predicate

   An activity starts when what it needs exists — a condition over artifact states that a tool evaluates — not when the previous step “finished”.

2. 2

   Two regimes

   Before the specification is accepted, items move freely and cost nothing to drop. After it, the graph is append-only.

3. 3

   Feedback creates work

   A defect, a failed check, an incident or a changed mind becomes a new item linked to the original. Nothing is reopened.

4. 4

   Doubt promotes

   Where a guard is uncertain, the higher-touch path is taken. No guard resolves downward on ambiguity.

5. 5

   Eight declarations

   Every activity declares all eight. A declaration missing any one is malformed, and a tool rejects it.

   • requires
   • produces
   • performer
   • touch level
   • done when
   • blocked when
   • weight
   • owner

The first rule is what lets the graph survive work that branches, loops and revisits. A national process standard once tried the opposite — each activity declaring a list of input products — and its own successor removed it in favour of gates over product states.

Feedback never returns; it creates new work.

Accepting the specification is the commitment

Before it, ideas move freely and cost nothing to drop. After it, work is owned, budgeted and tracked — and nothing flows backwards.

Iteration before the commitment is the point, and it is cheap because nothing depends on it. After it, every artifact has dependants, so changing course means new work that names what it supersedes — never an edit that quietly moves the ground under someone else’s run.

Gate where a mistake becomes uncorrectable

Not where the work looks important. Four triggers put the owner in the path — irreversible, cascading, frame-extending, intent-bearing — and nothing else interrupts the owner.

Important work that is easily undone needs no gate. Trivial work that cannot be undone needs one. Gating by importance — the default in practice — gets both wrong.

Importance is the wrong variable; reversibility is the right one.

Four steps always need a positive yes: specify, brief, validate, publish. The owner accepts every specification and every publication. A brief goes to the owner when it branches into further briefs or trips another trigger; a leaf brief is accepted by its issuer. A result is validated by its brief’s issuer, and against the original intent by the owner.

Beyond those four, the owner is gated only on a deploy with no way back, a new category at triage, a new tool, and a decision that is irreversible or changes a rule. That is the whole list.

Read as a shape: the owner sets intent at the top, accepts the specification and every brief that branches, judges the final result against intent, and authorises anything that cannot be taken back. The middle — leaf briefs and the results they return — runs without the owner.

Gates are enforced, never requested

Five touch levels name the owner’s role at each step. Every gate is enforced by the harness withholding capability, doubt only ever promotes, and approvals expire.

The levels follow the published autonomy ladders — Parasuraman, Sheridan and Wickens on levels of automation — and are named for the owner’s role at each step, not for what the agent or tool does.

1. Author

   the originator

   Only the owner may create it.

2. Accept

   the approver

   Silence is refusal. A positive act is required, with no timeout.

3. Review

   the consultant

   Silence is assent — within a stated window, which is recorded.

4. Notify

   the observer

   The agent acts and the owner is told. The act must be revertible.

5. Unattended

   absent

   The agent acts inside containment, visible in the record.

A gate the agent is asked to respect is not a gate.

At Accept, silence is refusal — never assent. At Review, silence is assent, but only inside a window that is itself on record.

Three rules make the gates real:

1. Withhold, don’t ask. Every gate is enforced by the harness withholding a capability. A rule written only in a brief’s prose is advisory, however firmly it is worded. Two vendors say so independently — GitHub of automated pipelines, “Approvals are a workflow convenience, not a security control”; Anthropic of its AI coding agent, “Permission rules are enforced by Claude Code, not by the model.” The rule holds for any agent: a gate is something the agent cannot get past, not something it is trusted to honour.
2. Two declarations, not one. What is possible — what a run can reach and write — and when the owner is consulted are orthogonal. A brief carries both.
3. Doubt promotes, and acceptance decays. An uncertain guard takes the higher-touch path. An approval already given expires, sooner as consequence rises, so a stale approval cannot be spent on work it never saw.

The issuer accepts; the owner accepts what branches

A brief goes to the owner only if it is cascading, irreversible, frame-extending or intent-bearing. Otherwise its issuer accepts it — at any depth.

The cascading test is mechanical. A leaf is multiplied by nothing, so its issuer can accept it wherever it sits; a brief that branches is multiplied by everything beneath it, so it reaches the owner wherever it sits. Whether a brief will be decomposed further is read from the plan, not judged. An agent that issues a leaf sub-brief accepts it; an agent never satisfies a gate that belongs to the owner.

The owner sees the briefs that branch, not the ones that work.

Oversight and capability run beside the work

The checks are chosen on a track the work cannot reach. A missing tool is raised as separate, gated work — never improvised inside the run.

Oversight selects and runs the checks at Verify. It is deliberately unreachable from the delegation graph: if it could be reached by walking up from the work being checked, the producer’s chain would control its own verification.

Capability provisions new tools. When decomposition reaches a leaf that no declared tool or agent can perform, there are exactly two moves: decompose further, or raise the missing tool as separate work on its own track, gated because it changes what all future work can do. Improvising the capability inside the run is not a third option.

Nothing checks its own work.

The producer cannot choose, write or fund the checks that judge it.

Consequence decides what; size decides how hard

Weight is three layers keyed on different things. Size is never a reason to produce less — it is a reason to be checked harder. No step is ever skipped.

How much process does a piece of work deserve? Established practice answers in roughly fifty weight schemes: proposal processes (Rust RFCs, Kubernetes KEPs, Python PEPs, TC39, JEPs, IETF), change classes, assurance levels (IEEE 1012, DO-178C, IEC 61508, ISO 26262, NASA software classes, Common Criteria) and project governance. Read together, they give three layers, not one ladder.

1. Layer 1

   What must be produced

   keys on Consequence

   breadth of who is affected · external visibility · reversibility

2. Layer 2

   What may be reduced within that

   keys on Size, complexity, competence

   a step may be discharged in one line, with its reason

3. Layer 3

   How hard the result is checked

   keys on Size, novelty, track record

   size is never a reason to produce less — it is a reason to be checked harder

Size is never a reason to produce less. It is a reason to be checked harder.

No step is ever skipped; any step may be discharged in one line, with its reason. Boehm’s phrase for a reduced step is “addressed but not exercised”: a recorded fact, not an omission. That removes the need for an exemption list — the working schemes without one simply make their minimum artifact so small that exemption is pointless.

Weight is not sorted into named classes. One activity set serves all work: consequence fixes what must be produced, a size cap bounds every piece, the bias is toward small, and the floor for any step is one line with its reason.

Err small

The two sizing errors do not cost the same. Cutting too small wastes bounded effort; cutting too large can make work impossible to verify. So the bias is toward smaller.

A bounded cost against an unbounded one: the bias toward smaller is a consequence, not a taste. The only measured sizing evidence agrees, and it comes from AI agents: the task length they finish 80% of the time is four to ten times shorter than the length they finish half the time.

Size work to what the agent finishes reliably, not to what it finishes half the time.

Decompose until every leaf passes four tests

Primitive for its executor, objectively measurable, singly owned, independent of its siblings. How small is small enough is a question about the executors, not the work.

1. ✓

   Primitive

   Performable directly by a declared tool or agent. “Small enough” becomes a question about the executors, not the work.

   from HTN planning

2. ✓

   Measurable

   Short, or carrying interim objective milestones. Work-breakdown standards contain no hour figure — their rule is measurability.

   from NASA WBS handbook · MIL-STD-881F

3. ✓

   Singly owned

   Exactly one owner. Partitioning terminates on ownership, not size; fragmented ownership is the strongest known defect predictor.

   from TOGAF · defect statistics

4. ✓

   Independent

   Whoever does it can choose the best course without talking to anyone doing the other units. Inputs from one producer; no sibling needs its intermediate state.

   from Spark’s narrow dependencies

“Make it small” was only ever a lossy compression of “make its progress measurable”. Three independent routes reach the ownership rule — doctrine, measured AI-agent behaviour, and defect statistics.

A budget is a fuse, not a decision

A bound ends one run at exhaustion. A reconsideration factor stops the work while budget remains and asks the issuer — never the performer — whether it is still right.

A bound fires too late to reconsider — nothing is left to reconsider with. The factor exists for the case where nothing has concluded, nothing has failed and no verdict is coming: the work was estimated at a day, a day has passed, and no end is in sight. It lives on the partition because retries are new runs against the same estimate; a per-run trigger would reset before it ever fired.

When the factor trips:

• The breaker stops by default. The running work is preempted; continuing takes a positive act. Shape Up’s circuit breaker inverts the usual default the same way.
• The issuer answers. One of continue — with a revised estimate, or the breaker becomes a loop that trains its reader to wave it through — decompose, or abandon.
• Progress travels with spend. 2× with nine of ten done conditions met is nearly finished; 1.2× with none met is the case that needs cutting.
• Abandon cascades effort, not records. No further briefs; every verified result beneath it stays on record and citable.

Work does not rule on whether it is still worth doing.

Consumption is observed by the harness, not reported by the agent: whoever is measured never does the measuring. Budget exhaustion ends a run as blocked, not fail; a breaker trip ends it as preempted — see One cycle, at every level for all seven.

The record is the process

Every step is a record and every rule a query over records, so the process observes itself for free. A reconciler, not a timer, closes each gap.

Because every step is a record, the process can be asked about itself at no extra cost: how many briefs were accepted first time, how long gates wait, where work stalls, how often verification fails after validation passed — which means the checks are wrong, not the work. Delivery measures such as change-failure rate and time to restore are derived from the same facts, never typed into a dashboard.

Triggering is level-based, not event-based. Instead of a timer that fires when a waiver expires, and silently never fires if nothing was running at that instant, expiry is computed whenever anyone asks — expired(W) :- now > expiry(W).

A reconciler compares what must be true with what is true. It closes mechanical differences unattended, raises a gate on intent-bearing ones — and when it finds no difference, writes nothing.

A missed event is permanently wrong; a missed look is merely late.