Principles
These sit under the six. They are how the product behaves when a tool returns nothing, when a key asks for more than its owner has, and when a call fails.
An agent's MCP call and a person's click run the same service code. There is one write path, so the two do not need reconciling. The shape of it.
Unknown, unmeasured, stale, and never-reported are drawn as themselves. A missing scan is not clean. A stale result is not clean. Where the suites sit.
Signing in, minting a key, publishing memory, and adopting a rule are a person's acts. A key never outranks the person who minted it. The boundary.
Activity holds one row per accepted change, attributed to a key or a person. The ledger.
Failures carry a typed code — not_found, validation, conflict, unauthorized, internal — and a hint that names the fix. The tool surface.