Governed Effect Surface

This file captures the §12 chapter draft assembled on 2026-06-19. It is a working draft, not final publication copy. Final tone calibration is deferred to a later outreach pass.

The Governed Effect Surface is the third system invariant (ZTG-1 through ZTG-5) and the structural counterpart to the Mechanistic Boundary. ZTG-1 specifies the gate every action must pass through; ZTG-3 specifies the closed, enumerated set of channels there are to act through at all. Together they make execution-boundary enforcement complete: a boundary can only mediate the effects it can see, and ZTG-3 is the requirement that every channel capable of affecting the world is enumerated, declared, and reachable only through the mediated path.

Operational Questions

ZTG-3 is mapped, with ZTG-1, to execution-boundary enforcement — it is the half that closes the surface so the boundary's mediation is complete rather than partial. It also serves replayability and evidence coupling: surface and sub-surface registration, the declarations attached to them, and the routing of each effect are recorded (ZTG-0a) and reconstructable (ZTG-0b), so that which channel an effect took, under what declared harm class and reversal strategy, is part of decision provenance. ZTG-3 is what lets the framework claim not merely that authorized actions are gated, but that there is no ungated way to act.

Normative

All governed effects MUST occur through enumerated surfaces and sub-surfaces, and the architecture MUST make unenumerated effect channels structurally unreachable. Every channel capable of producing a governed effect MUST be registered before it can be used, with its governance-relevant properties declared at registration. Effects through unenumerated channels are unauthorized, and the capacity to produce such effects MUST NOT exist as an ambient capability of the governed system.

Enumeration and Closure

The set of effect channels is closed. An effect channel that is not registered is not merely prohibited; under ZTG-3 it MUST NOT be reachable. This is the distinction between declaring a rule and enforcing a structure, and ZTG-3 takes the structural side, exactly as ZTG-1 takes it for the boundary: a closure that depends on the governed system choosing not to use an available unregistered channel is not closure, because the governed system's choices are the thing under governance.

Structural closure means the registered surface mechanism is the only path from the governed system to the world. The system holds no ambient authority to act outside the enumerated surfaces — no general-purpose effect capability it can direct at an unregistered target. An effect can reach the world only by being dispatched through a registered surface, because there is no other reachable way to produce one. This is what makes ZTG-1's complete mediation complete: mediation of every action presupposes that every action route is known, and ZTG-3 is the requirement that the route set is both known and exclusive.

Surface Declarations

Each surface and sub-surface declares its governance-relevant properties at registration. At minimum these include its harm-class default and compositional multiplier (ZTG-5) and its reversal strategy (below). A sub-surface declaration may tighten its surface's defaults but MUST NOT relax them: a sub-surface may declare a higher harm class or a more conservative reversal strategy than its parent surface, never a lower or laxer one. Monotonic tightening ensures that narrowing the channel can only increase governance stringency, so that no effect is governed more weakly by virtue of being routed through a more specific sub-surface.

Reversal Strategy

Each surface declares a reversal_strategy: a description of what the system can undo or compensate for effects dispatched through it. The reversal strategy is descriptive provenance. It records a capability of the system, and it MUST appear in the decision provenance of every effect through the surface.

The reversal strategy MUST NOT relax governance. It does not lower the harm class, and it does not select a lighter gate. This is the orthogonality ZTG-5 requires: harm class describes consequences in the world, while reversal strategy describes what the system can do about them, and the two are independent. A surface with a strong reversal strategy and an Irreversible harm class is routed by its harm class, not rescued by its reversal strategy; forward remediation such as refund, retraction, or compensation is recorded as available but does not by itself reduce the consequence the action produces. Both the harm class and the reversal strategy are present in provenance precisely so that an auditor can see that the second was not silently used to discount the first.

Effect Routing

Every governed effect MUST be routed through the registered surface or sub-surface that matches it, and the routing decision MUST be recorded (SURFACE_ROUTE_SELECTED, ZTG-0a). Routing is the point at which an authorized action becomes an effect through a specific declared channel, carrying that channel's harm class, multiplier, and reversal strategy into the action's provenance. The boundary (ZTG-1) decides whether the action is authorized; the surface (ZTG-3) is the declared channel through which an authorized action reaches the world.

Registry as Governance State

The surface registry is governance state under ZTG-0e. Registering a surface, retiring one, or changing a declaration is an authorized, recorded, ordered, and consistency-governed transition: authorized under ZTG-0d, recorded under ZTG-0a, ordered under ZTG-0c, and applied atomically and consistently under ZTG-0e. The set of effect channels and their declared properties is therefore not a static configuration but a governed object whose every change is attributable. A decision evaluates against the registry as of decision-time (ZTG-0c snapshot), so the surface declarations in force for an effect are exactly those that replay (ZTG-0b) reconstructs.

Breach of Closure

Discovery at runtime of a reachable effect channel that is not registered is a breach of the closure ZTG-3 requires, and MUST be treated as an integrity violation in the tamper family rather than as an ordinary configuration gap. A reachable unregistered channel means the system can no longer guarantee complete mediation — there exists, or may exist, a path to the world the boundary does not govern. Consistent with fail-closed semantics, this is a Stasis (ZTG-2) trigger: the system holds rather than continuing to operate while a path around its mediation is known to exist. Under structural closure such a channel should not arise in normal operation; its appearance indicates a defect or tampering, which is why the response is to hold and escalate, not to quietly register the channel and proceed.

Conformance Criteria

A conforming implementation can: enumerate every effect channel it can reach and demonstrate that no reachable effect channel is unregistered; demonstrate that the capacity to produce effects outside registered surfaces does not exist as an ambient capability; attach harm class, multiplier, and reversal strategy at registration and enforce monotonic tightening across sub-surfaces; carry reversal strategy into provenance without using it to relax harm class or gate; route every effect through its registered surface and record the routing; treat the registry as ZTG-0e governance state; and escalate the discovery of a reachable unregistered channel to Stasis.

Further Considerations

The capability-security grounding. Security engineering distinguishes two ways a system can hold the power to act: ambient authority, where a component can act on any target it can name, and capability authority, where a component can act only through unforgeable capabilities it has been explicitly granted. Decades of security experience established that ambient authority is the source of a large class of failures — confused-deputy problems, privilege escalation, effects through paths no one intended to expose — because the set of things a component can do is not enumerated and not bounded. The capability discipline answers this by making the grantable capabilities the complete and exclusive set of things a component can do. ZTG-3 is this discipline applied to a governed autonomous system's effects on the world. The registered surfaces are the capabilities; structural closure is the absence of ambient authority; an unregistered reachable channel is exactly the ambient-authority hole capability security exists to eliminate. The framework does not treat the effect surface as an attack surface to be monitored; it inverts it into a declared capability set to be enumerated.

Convergent with control theory. The same requirement arrives from control. A controller affects a plant only through its actuators, and control theory is explicit that an unmodeled actuator — a path by which the controller influences the plant that the control law does not account for — is an uncontrolled coupling that invalidates the controller's guarantees. One does not certify a controller while conceding it may have effectors no one has characterized. ZTG-3's enumeration requirement is the governance statement of "know your actuators": the set of channels through which the system affects the world must be closed and declared, because a guarantee about governed effects is void in the presence of an ungoverned effector. That capability security (reasoning about authority) and control theory (reasoning about actuation) converge on the same closed-set requirement is the cross-tradition agreement the framework reads as evidence the requirement is structural.

Enumeration completeness is the hard part. The difficulty ZTG-3 concentrates is not stating that effect channels must be enumerated but knowing that they have been. The boundary-scope discussion in ZTG-1 already noted how subtle the model-to-world distinction can be: reads whose access pattern signals a target, resource-consumption patterns observable beyond the system, memory writes consulted by others, mid-generation tool calls. Each is a candidate effect channel that must be either registered or rendered unreachable. Structural closure helps by making the question concrete — not "have we listed every effect" but "is there any reachable path to the world that does not go through a registered surface" — which is a property of the architecture that can be analyzed, rather than an open-ended enumeration that can only be added to. The conformance burden is real and is borne at the architecture level; ZTG-3 does not pretend the enumeration is easy, only that it is mandatory and that its completeness is checkable as a reachability property.

Why the surface is where harm class lives. Harm class and multiplier attach to surfaces rather than to individual actions because the surface is the stable, enumerable, governable object; an individual action is transient and model-proposed. Attaching consequence declarations to the channel rather than to the act means the declarations are registered, authorized, and changed under governance (ZTG-0e), not asserted per-action by the system whose actions are under governance. This is the same anti-self-authorization logic seen elsewhere: the governed system proposes an action, but the harm class it carries is a property of the declared channel it must route through, not a label the system gets to choose for its own act.

Retirement and the closed set over time. Closure is a property that must hold as the registry changes, not only at a single moment. Retiring a surface must render it unreachable, not merely mark it deprecated while leaving the channel live; adding a surface is the authorized act of extending the effect set. Because the registry is ZTG-0e governance state, these changes inherit atomicity and consistency — there is no interval in which a half-retired surface is both unregistered and reachable. The closed-set guarantee and the governance-consistency guarantee are the same guarantee viewed from the effect surface.

How We Do It

Constable implements ZTG-3 as an effect-surface registry plus a dispatch architecture in which the registered surfaces are the only reachable path from the agent to the world.

No ambient effect authority. Constable's agent runtime holds no general-purpose capability to act on external systems. Every outbound effect is dispatched through a registered surface adaptor; there is no reachable code path by which the agent can produce an external effect except by routing a proposal through the gate to a registered surface. Effect capability is held by the surface mechanism, not ambiently by the agent.

Surface registry. Surfaces and sub-surfaces are registered with their declared harm-class default, compositional multiplier, and reversal_strategy. Sub-surface declarations are validated to tighten, never relax, their parent's defaults. The registry is carried in the ZTG-0e governance bundle, so registration and declaration changes are signed by a ratifying principal, recorded, ordered, and applied atomically; the gate evaluates against the registry version pinned at decision-time.

Routing and provenance. When the gate authorizes an action, Constable routes it to the matching registered surface and records SURFACE_ROUTE_SELECTED, binding the surface's harm class, multiplier, and reversal strategy into the action's provenance alongside the ZTG-5 fields. Reversal strategy is recorded as provenance only; the gate selection follows harm class and computed assessment per ZTG-5 and is never discounted by the presence of a reversal strategy.

Closure verification. Constable treats the absence of reachable unregistered effect paths as a verifiable architectural property and tests for it (below). A reachable effect path discovered without a corresponding registered surface is raised as an integrity violation and triggers Stasis (ZTG-2) rather than being auto-registered.

Conformance tests. Constable's internal testing for ZTG-3 includes: reachability analysis confirming no agent-reachable effect path bypasses a registered surface; ambient-authority tests confirming the agent holds no general-purpose effect capability; declaration tests confirming sub-surfaces tighten and never relax defaults; provenance tests confirming reversal strategy is recorded but never relaxes gate or harm class; routing tests confirming every effect records its surface selection; registry-governance tests confirming registration changes are ZTG-0e transitions; and breach tests confirming a reachable unregistered channel triggers Stasis. The protocol is documented in the conformance verification specification referenced in §22.

Draft Flags

• Enumeration completeness is an architecture-level conformance burden. ZTG-3 reframes it as a reachability property ("is there any reachable path to the world outside a registered surface") rather than an open-ended enumeration, but establishing that property for a given implementation is non-trivial and ties to §22. Flag for §22 conformance to specify how closure is verified.
• Breach → Stasis adds a ZTG-2 trigger. ZTG-3 contributes "reachable unregistered effect channel" to ZTG-2's trigger list. Keep ZTG-2's trigger enumeration in sync; this is a tamper-family trigger.
• Reversal_strategy taxonomy unspecified. ZTG-3 requires a declared reversal_strategy and fixes its semantics (descriptive, non-relaxing) but does not define a value taxonomy. Decide on finalization whether ZTG-3 specifies permissible reversal-strategy values or leaves them to deployment/registry policy.
• ZTG-3 × ZTG-5 boundary is deliberately thin here. Harm class, multiplier, and gate selection are ZTG-5's; ZTG-3 owns enumeration, closure, routing, and reversal_strategy. §14 already states the orthogonality. Keep the division intact when ZTG-4 (provenance/evidence) and any ZTG-5 finalization land.
• §22 Conformance Verification is referenced but not yet captured in this workspace.
• The chapter is substantively complete but likely needs final tone calibration for publication register.