Stasis

This file captures the §11 chapter draft assembled on 2026-06-19. It is a working draft, not final publication copy. Final tone calibration is deferred to a later outreach pass.

Stasis is the second system invariant (ZTG-1 through ZTG-5) and the system-level expression of fail-closed semantics. Where the Mechanistic Boundary (ZTG-1) refuses an individual action it cannot authorize, Stasis is the held state the system enters when it cannot guarantee its invariants hold at all. The structural prerequisites (ZTG-0a through ZTG-0e) each identify conditions under which the boundary must refuse rather than proceed; ZTG-2 is where sustained or structural loss of those guarantees escalates from per-decision refusal to a held system state, and where the path back to normal operation is defined.

Operational Questions

ZTG-2 is the invariant mapped to fail-closed semantics: it specifies what the system does when it cannot establish that acting is safe. It is the destination of the refuse-not-proceed conditions the prerequisite chapters defer to it — sustained loss of temporal integrity (ZTG-0c) and persistent governance inconsistency (ZTG-0e) both escalate here, and the same pattern applies to loss of the ability to record (ZTG-0a), attribute authority (ZTG-0d), or evaluate the boundary (ZTG-1). ZTG-2 also bears on override visibility and governance continuity: entry into and exit from Stasis are themselves attributable, recorded governance events, and exit is an exercise of ratifying authority.

Normative

When the system cannot guarantee that its invariants hold, it MUST enter Stasis: a held state in which no new authority is granted. Stasis is the authority-granting function held at zero. It is neither a crash nor a shutdown; it is a defined, governed, observable state the system holds in until an authorized principal ratifies its exit.

Stasis Is the Withholding of New Authority

The defining property of Stasis is that, while held, the system grants no new authority. This is the precise statement of the hold: Stasis does not enumerate which effects are forbidden; it suspends the function that would authorize any effect at all. Composed with ZTG-1 — under which no action derived from model output may execute without explicit structural authorization — withholding all new grants forecloses every new governed effect without any effect needing to be named. There is no special-cased open path during Stasis, because there is no grant during Stasis.

This framing also fixes what Stasis does not hold. Recording an event is not a grant of authority, so observability (ZTG-0a) continues — indeed it must, including the recording and surfacing of the held state itself. Reasoning is not a grant of authority, so the Envelope may continue to generate; nothing it generates reaches the world, because the boundary grants nothing. Stasis is the maximal, absolute, and un-overridable form of the boundary's default disposition toward action, which is refusal.

Triggers

The system MUST enter Stasis when it cannot guarantee its invariants hold. Trigger conditions include, at minimum: sustained loss of temporal integrity (ZTG-0c); persistent inability to establish a consistent governance view (ZTG-0e); inability to record governance-relevant events with integrity (ZTG-0a); inability to attribute authority to a ratifying principal (ZTG-0d); inability to evaluate the boundary deterministically (ZTG-1); detection of a reachable effect channel that is not registered, breaching effect-surface closure (ZTG-3); an effect whose evidence coupling cannot be confirmed — an unreconciled indeterminate effect (ZTG-4); and detection of evidence or integrity tampering. An authorized principal MAY also invoke Stasis directly.

Entry is governed by the escalation model. A single instance of a refuse-not- proceed condition is handled by the boundary refusing that decision; this is the boundary functioning, not a system failure. Stasis is the escalation that follows when such conditions are sustained or structural rather than momentary — when the system is not failing to authorize one action but failing to establish the preconditions for authorizing any action. The threshold that distinguishes a momentary refusal from a sustained loss is policy- and deployment-set; that an escalation must occur once loss is sustained is the invariant. Entry MUST be recorded (STASIS_ENTERED) with the triggering condition.

Scope of the Hold

While in Stasis the system MUST grant no new authority, MUST continue to record under ZTG-0a, and MUST remain able to surface its held state to operators. It remains inspectable and recoverable; Stasis is a state the system holds in, not a state it is destroyed by. The distinction from a crash is essential: a crashed system has lost observability and control; a system in Stasis retains both and has merely stopped granting authority.

The handling of already-granted, in-flight actions at the moment of entry is a distinct question from the withholding of new authority and is not fully resolved in this draft. "No new authority" governs grants; whether and how Stasis quiesces effects already authorized and in execution — particularly irreversible ones, where interruption may itself be consequential — is flagged for refinement rather than settled here.

Exit

Exit from Stasis MUST be ratified by a human or institutional principal under ZTG-0d. The system MUST NOT exit Stasis on its own authority, and MUST NOT exit automatically when the triggering condition appears to clear. Exit requires that the triggering condition be resolved or explicitly accepted by the ratifying principal, and the exit MUST be recorded as an authorized governance event (STASIS_EXIT_REQUESTED, then STASIS_EXIT_RATIFIED).

Ratified exit is not an additional precaution layered onto Stasis; it follows from what Stasis is. Because Stasis is the withholding of all new authority, the system cannot grant itself the authority to exit — the authority to release the hold is precisely the kind of new authority the hold suspends. Exit authority must therefore originate outside the held system, with a ratifying principal. The no-new-authority invariant and the ratified-exit requirement are the same requirement seen from two sides: a system that could authorize its own exit would not have been withholding all authority, and a system that withholds all authority cannot authorize its own exit. A system permitted to self-clear once a condition "appears resolved" is a system in which the component that failed its guarantees adjudicates their restoration, which is the self-authorization the architecture exists to prevent.

Non-Bypassability

Stasis MUST NOT be bypassable by the governed system or by operational override at runtime. Operational pressure to bypass Stasis — to keep throughput up during a governance rollout, to ship past a degraded time source, to avoid the cost of a held state — is expected, and yielding to it is non-conforming. The pressure is evidence the mechanism is doing its job: Stasis is costly exactly when proceeding would be dangerous. A Stasis that can be turned off under load is not a fail-closed guarantee; it is a fail-closed default with a fail-open exception, which reduces to fail-open.

Conformance Criteria

A conforming implementation can: enter Stasis on each enumerated trigger and demonstrate that escalation occurs once loss is sustained; demonstrate that no new authority is granted while held, and therefore that no new governed effect initiates; continue recording and surface the held state while in Stasis; require ratified exit under ZTG-0d and demonstrate the system cannot self-exit or auto-exit on apparent clearance; record entry and exit as governance events; and demonstrate that Stasis cannot be bypassed by the governed system or by runtime override.

Further Considerations

The safety-engineering grounding. Safety-critical control has a settled answer for what a system does when it loses confidence that it can act safely: it reverts to a defined safe state, and it does so by default rather than by decision. A reactor inserts its control rods; a fail-closed valve shuts; an elevator's governor grips the rails when the cable tension that proves the car is supported is lost. The discipline these share is that the safe state is entered on loss of a positive guarantee, not on positive detection of danger — the elevator does not wait to detect a fall, it acts on the loss of the evidence that it is held. Stasis is this principle for governed autonomous execution. The triggers are losses of positive guarantee — that time is trustworthy, that governance is consistent, that authority is attributable — and the response is reversion to a state that withholds action. A governance architecture that waited to detect harm before holding would be the elevator that waits to detect the fall.

Fail-closed must be closed at the edges too. The value of a fail-safe state depends entirely on its not having a convenient override, because the moments it matters most are the moments operators most want to proceed. Safety engineering learned this the expensive way: interlocks defeated "just this once," alarms silenced during the incident they were warning of. The non-bypassability requirement is the lesson encoded. It is also why exit is ratified rather than automatic: an automatic exit on apparent clearance is an override with a plausible-sounding trigger, and the failure modes that put a system into Stasis are exactly the ones that can make a condition appear clear while it is not — a spoofed-back time source, a transiently-agreeing set of partitioned gates.

Stasis as held authority, not lost capability. It is worth being precise that Stasis withholds authority, not capability. The system in Stasis is fully capable — it can reason, it can record, it can describe its own state — it simply cannot act, because it grants itself no authority to. This mirrors the executive-function framing of the introduction (§1.4): capability and the authority to exercise it are separable, and an architecture that separates them can hold the second while preserving the first. A held system that retained no capacity would be useless to the operators who must diagnose and resolve the condition; a held system that retained capacity but not the discipline to withhold authority would not be held at all. Stasis is the deliberate occupation of the space between.

The cost of holding is real and is the point. Stasis trades availability for the guarantee that the system does not act ungoverned. Under partition, under a degraded clock, during an unsettled governance change, a ZTG-conformant system may be unavailable precisely when an operator wants it most. This is the same consistency-over-availability posture ZTG-0e takes explicitly, raised to the system level. The framework does not present this cost as negligible; it presents it as the correct trade. An autonomous system that remains available by acting under guarantees it cannot establish is not more useful, only more dangerous, and the usefulness is the kind that shows up as throughput now and as externalized exposure later (§1.5).

Relationship to harm class. The cost of being wrong about whether to hold is asymmetric and tracks ZTG-5 harm class. Wrongly holding a Restorable-class capability is recoverable; wrongly proceeding on an Irreversible-class action under unestablished guarantees is not. The escalation threshold and the willingness to hold should reflect this asymmetry, and an implementation that tunes its Stasis sensitivity uniformly across harm classes is leaving the asymmetry unused. The precise coupling between harm class and Stasis sensitivity is a composition concern between ZTG-2 and ZTG-5 rather than a property of either alone.

How We Do It

Constable implements Stasis as a held mode of the execution gate in which the gate returns no authorization for any action, entered on loss of guarantee and exited only on ratified authority.

Held gate. In Stasis, Constable's execution gate grants no new authorization: every proposed action receives refusal, and there is no configuration or runtime signal that re-enables granting from within the held system. Because all governed effects route through the gate (ZTG-1), a held gate is sufficient to withhold all new governed effect without enumerating effects. The agent runtime continues to operate and the Monotonic Logger continues to record; neither is an authorization grant.

Trigger integration. Constable enters Stasis on signals from the prerequisite layers: sustained failure of the trusted time service (ZTG-0c), inability to confirm the agreed governance bundle version across gates (ZTG-0e), Monotonic Logger integrity or availability failure (ZTG-0a), identity-validation failure (ZTG-0d), a reachable effect path without a registered surface (ZTG-3), an unreconciled indeterminate effect (ZTG-4), and detected tampering. Each entry emits STASIS_ENTERED with the triggering signal. Momentary conditions are handled as ordinary gate refusals; escalation to Stasis follows configured sustained-loss thresholds.

Ratified exit. Exit runs through HumanSeal: the held state is surfaced to an authorized operator, who reviews the triggering condition and either resolves it or explicitly accepts it, and ratifies exit with credentials satisfying ZTG-0d. Constable records STASIS_EXIT_REQUESTED and STASIS_EXIT_RATIFIED. There is no auto-exit path; a time source that recovers, or gates that re-converge, do not release Stasis on their own.

Non-bypass. The held mode is enforced in the gate, structurally separate from the agent runtime, with no agent-reachable path to clear it and no runtime override to fail it open. Operator authority can ratify exit; it cannot bypass the hold while the trigger stands without that ratification being a recorded, attributed act.

Conformance tests. Constable's internal testing for ZTG-2 includes: trigger tests for each enumerated condition; escalation tests confirming momentary conditions refuse without entering Stasis while sustained conditions escalate; no-grant tests confirming no authorization is issued while held; observability- continuity tests confirming recording and state-surfacing continue in Stasis; exit tests confirming the system cannot self-exit or auto-exit and that exit requires ratified ZTG-0d authority; and bypass tests confirming no agent or runtime path clears the hold. The protocol is documented in the conformance verification specification referenced in §22.

Draft Flags

• In-flight action handling at entry is not resolved. "No new authority" governs grants; the quiescence of already-authorized, in-flight irreversible actions at the moment of Stasis entry is flagged for refinement. It is a genuine composition question (ZTG-2 × ZTG-1 × ZTG-5), not a drafting gap.
• Escalation threshold semantics. The momentary-vs-sustained threshold is stated as policy/deployment-set. Confirm, when ZTG-2 is finalized, whether ZTG-2 should constrain the threshold at all (e.g., a maximum tolerable duration of unestablished guarantee) or leave it entirely to deployment.
• Harm-class coupling (ZTG-2 × ZTG-5). The asymmetry between wrongly holding and wrongly proceeding tracks harm class; the coupling is named here but owned jointly with ZTG-5. Confirm the two chapters agree on whether Stasis sensitivity is harm-class-aware.
• Collected handoffs. ZTG-0c and ZTG-0e both defer their sustained-loss escalation to this chapter; ZTG-2 now collects them, along with the ZTG-3 (reachable unregistered channel) and ZTG-4 (unreconciled indeterminate effect) tamper-family triggers. If those chapters are revised, keep the trigger list here in sync.
• §22 Conformance Verification is referenced but not yet captured in this workspace.
• The chapter is substantively complete but likely needs final tone calibration for publication register.