canon(E0010 draft): Rulebook Transfer principle + Models-Do-Not-Mutate-Canon refinement (DRAFT)

[git-repo-auth]

Status: DRAFT — merge held for captain ratification. Pushing to this branch is the review surface; the merge is yours, pinned to head SHA, and gated by release-validation-gate (active reviews must complete first).

What this is

• New Tier-1 principle — canon/principles/rulebook-transfer.md. Discernment transfers down tiers as an articulable rulebook; authority over canon flows one way (downward, acyclic); the delegation ladder has fewer rungs than the execution ladder.
• In-place refinement of a stable Tier-1 decision — canon/decisions/models-do-not-mutate-canon.md. Adds the delegated-stewardship axis while preserving the original prohibition for the operator's sovereign canon.

Cross-check you should see first

The refinement reopens a boundary the original explicitly rejected (Alternative 3: graduated edit-rights inside one canon). It survives because it is a different axis — separate delegated jurisdictions, not tiers of your canon. The doc's Alternatives Considered now defends that distinction in-line so it doesn't read as quietly reversing a settled decision. Your call whether the distinction holds.

Decisions taken, pending your ratification — overturn any in review

1. In-place amendment of the stable decision (vs. a superseding decision). If you'd rather supersede, say so and I'll restructure as a new decision pointing back.
2. stability: stable → semi_stable on the decision, reflecting active refinement. Revert on ratify if you prefer.
3. target_repo: outcomes-driven-development on the principle, to match convention (not "klappy.dev").
4. status: draft on the principle; flips to active on your ratify.
5. epoch: E0010 per your stated intent — see blocking markers below.
6. Date 2026-06-26, UTC-derived. Correct if your civil date differs.
7. Companion append-not-mutate ratification mechanism lives in the kirigami-mcp policy PR, not here.

Blocking before merge — governance-change-discipline (your authorship)

This is a behavior-affecting change to Tier-1 canon and names a new epoch, so four markers are required. I have not authored them, because all four frame Epoch 10's identity — and epoch appendices currently stop at epoch-9, so E0010 is not yet declared. Declaring an epoch is your authorial act, not mine:

1. Canon version bump in canon/CHANGELOG.md (0.38.0 → 0.39.0).
2. Changelog entry declaring the E0010 theme.
3. Release note at docs/oddkit/release-notes/2026-06-26-<slug>.md.
4. docs/appendices/epoch-10.md declaring the epoch — or retag the principle to E0009 if you'd rather not open E10 yet.

I can draft the mechanical parts (changelog entry, release note) the moment you give me the epoch's framing; the epoch declaration itself stays yours.

Companion

kirigami-mcp PR #31 (the internal policy that consumes this principle). It derives_from this principle and should not merge first.

---

Note

High Risk
Tier-1 governance and authority rules for models, delegation, and canon mutation—behavior-shaping even as markdown-only, with in-place amendment of a previously stable decision pending operator ratification.

Overview
Draft Tier-1 canon that introduces Rulebook Transfer and refines Models Do Not Mutate Canon so multi-tier agent loops can delegate downward without models editing the operator’s sovereign canon.

New principle canon/principles/rulebook-transfer.md states that frontier discernment can crystallize into articulable rulebooks for lesser tiers to run faithfully, with loss bounded by articulability and adjacent-rung handoffs only. It separates execution capacity (run rulebooks) from stewardship capacity (author rulebooks and hold bounded domains), and locks safe self-building loops on acyclic authority: information may flow everywhere, but ratification flows downward only (no self-promotion, no upward canon edits, delegated bounded revocable scopes).

In-place refinement of canon/decisions/models-do-not-mutate-canon.md keeps the core rule—models must not mutate the operator’s canon—but adds delegated stewardship over a separate sub-scope with explicit guards (upward reach, self-promotion, boundary capture) and updated verification. Alternatives Considered is rewritten to accept narrow attributed ratification within delegated scopes while still rejecting graduated edit-rights inside the operator’s single canon.

Merge is explicitly held for operator ratification; the diff does not include the governance-change markers (changelog bump, release note, epoch-10 appendix) the PR description lists as blocking.

^{Reviewed by Cursor Bugbot for commit b7da78a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Canon Quality — Frontmatter Schema ✅

All 49 file(s) in writings/ conform to klappy://canon/meta/frontmatter-schema.

_{Validator: scripts/validate-frontmatter.py · Canon: klappy://canon/constraints/frontmatter-validation-before-merge · Run: #304}

[github-actions]

Canon Quality — oddkit_audit ✅

No dead klappy:// references or legacy link patterns found in writings/. 51 files scanned.

_{Spec: klappy://docs/oddkit/specs/oddkit-audit · Workflow: .github/workflows/canon-quality.yml · Run: #304}

[github-actions]

Canon Quality — Homepage Surfacing ✅

49 essay(s) scanned. Soft report — never blocks; the hard field gate is the Frontmatter Schema job.

All published essays resolve to the homepage feed.

_{Report: scripts/surfacing-report.py · Canon: klappy://canon/constraints/frontmatter-validation-before-merge}

[github-actions]

Canon Quality — P0010 Retrieval-Readiness ⚠️

Soft report for klappy://canon/constraints/retrieval-disclosure-contract. 681 files scanned. Never blocks — informational until the corpus is ready to enforce.

• Blocking-class findings: 15 (structural fields the contract would filter on)
• Warnings: 0 (kind resolves to unknown)
• Informational: 13 (exempt templates/archive/drafts)

Kind distribution: {'essays': 51, 'canon': 230, 'apocrypha': 38, 'docs': 297, 'journals': 59, 'unknown': 6}
Kind source: {'path': 550, 'frontmatter': 125, 'none': 6} (frontmatter-primary, path-secondary)
Default-include visibility: 578 visible, 103 hidden (journals/apocrypha/unknown)

By rule: {'audience-invalid': 2, 'exposure-missing': 5, 'tier-missing': 5, 'tier-invalid': 7, 'fm-missing': 3, 'kind-unresolvable': 6}

These are not schema violations (see the Frontmatter Schema job for those on writings/). They are corpus-readiness signals for the retrieval contract: invalid/missing audience, exposure, tier, and docs whose kind cannot be resolved. Fix in a corpus-cleanup PR before the contract flips to enforcing. See the retrieval-readiness-findings artifact for the full list.

_{Validator: scripts/audit-retrieval-readiness.py · Constraint: klappy://canon/constraints/retrieval-disclosure-contract · Run: #304}