Four classes, never assembled until now
This book builds four classes of thing across thirty chapters and never quite says, in one place, how they compose. Models were introduced early and constrained to propose. Agents were given a loop, typed jobs, and no rights. A harness was given the sole authority to spend. Pipelines were given the job of making all of it executable, on every commit, without a human in the loop. This chapter states the composition law plainly: a model's proposal is data for an agent's draft; an agent's draft is a candidate for the harness's verdict; the harness's verdict, if allow, opens a lease that a pipeline enforces on every subsequent run. No layer may skip the one before it. No layer may grant itself the authority of the layer above it.
The register
The book's central case is one nameplate and one float. CEH-001 carries two honest frames near 1.50 and 2.10; 1.80 is the midpoint, and it is denied. That denial has been re-derived, chapter by chapter, by instruments that share no machinery whatsoever. A sample of the full register:
| Instrument | The arithmetic that refuses | Code |
|---|---|---|
| Rate convention | Annual↔continuous wedge of 0.9583 on a 10-year note at 6%, larger than the 0.60 frame gap itself | SILENT_CONVENTION_SWAP |
| Bootstrap amplification | A 5bp move on the 10-year spot moves the 9-to-10-year forward by 50.5bp, a 10.1× amplification | CURVE_PILLARS_MISSING |
| Selection | Best-of-nine exposure of 0.3698 against a Holm-corrected first bound of 0.005556 | SELECTION_UNCORRECTED |
| Question framing | P(mark > 1.80) reads 3.4×10-10 under one frame, 0.999999 under the other, a ratio of three billion | QUESTION_UNDERSPECIFIED |
| Prior coordinate | Maximum-entropy means of 1.8259 / 1.8000 / 1.7738 / 1.7477 across four legal coordinate choices; the midpoint is a theorem about the grid, not a fact about the claim | PRIOR_COORDINATE_UNDECLARED |
| Residual battery | A residual built around 1.80 runs at 6.17 standard deviations; the level CUSUM crosses its threshold on day two | RESIDUAL_STRUCTURE |
The full register runs to nineteen rows, spanning rate conventions, cashflow completeness, market proxies, live monitoring, family coupling, crowd diameter, attainability, and drift horizon, each one arriving at the same verdict from a completely different direction.
Why nineteen, and why that number is the point
Three things about the register matter more than any single row in it. No two entries share an instrument: row two is arithmetic on a cashflow schedule, row thirteen is a change of coordinate on a probability grid, row nineteen is an accumulator on a residual series. There is no common dependency whose failure disables more than one row, which means the register is solid to a bug in any single gate. A plane with one excellent gate has a single point of failure. A plane with nineteen mediocre, independent gates does not.
The pipeline itself contributes no rows to this list, and that is correct by design. Twelve CI stages and dozens of fail codes exist to execute the nineteen reliably, on every ticket, without a human in the path — but none of them is itself a refusal of 1.80. Confusing execution with judgement is how a stack ends up with elaborate continuous integration and no actual gates behind it.
And the refusals get cheaper as the list goes on. An early row needs a full cashflow engine to compute. A late row needs one division, or a running sum. A desk that cannot afford to build the whole plane at once should build from the cheap end of that ordering, and it will find that the cheap rows alone refuse most of what needed refusing in the first place.
A 97% success rate that loses 97% of the book
The autonomy ladder's rungs are not a taste choice. They are forced by arithmetic that is easy to state and easy to miss. Consider a promotion policy that ships challengers with a genuinely good hit rate: ninety-seven promotions return +0.55% each, and three turn out to be catastrophes at -50% each. 97(0.55%) + 3(-50%) = 53.35% - 150% = -96.65%. A ninety-seven percent success rate that loses ninety-seven percent of the book.
The break-even catastrophe rate here is 0.55/(0.55+50) ≈ 1.09%, one bad promotion per ninety-two, and no amount of improving the hit rate above that fixes a policy whose loss branch is a hundred times its gain branch. Only truncating the branch does. That is the entire justification for the ladder: each rung caps what a mistake made at that rung can cost, so that discovering the mistake is survivable instead of existential. Research rights carry no spend path at all. Shadow carries no money. Canary is capped at a fixed token, deliberately not a percentage of mandate, because a canary sized as a fraction grows with the book and stops being a canary. Sized execution is capped by a family budget divided by the effective number of independent names, not the nominal count, so three correlated cousins don't quietly borrow three times the risk budget they actually deserve.
What was bought, and what was not
What the plane buys: a system that can refuse a bad ticket even after every model weight is deleted, because the refusal lived in the cards, not in the intelligence. What it cost: nothing that looks like a shortcut — every right routed through a card, every card routed through a hash. What it is not: any claim that all of this machinery makes 1.80 a defensible number under some sufficiently clever combination of the nineteen instruments. That claim stays refused, structurally, all the way to the top of the stack.
Book: Chapter 31 in Rulers Before Models.