This file captures the §13 chapter draft assembled on 2026-06-19. It is a working draft, not final publication copy. Final tone calibration is deferred to a later outreach pass.
Evidence-Coupled Execution is the fourth system invariant (ZTG-1 through ZTG-5). It is where the framework's claim that governance evidence is constitutive rather than descriptive (§1.2) becomes a structural requirement, and where the division established in ZTG-0a — that observability owns record integrity while ZTG-4 owns the binding of evidence to effect — lands. ZTG-3 enumerates the channels through which effects reach the world and routes authorized actions to them; ZTG-4 requires that each such effect and its evidence are coupled so tightly that neither can exist without the other.
Operational Questions
ZTG-4 is the invariant mapped most directly to evidence coupling, and it completes the replayability chain: the prerequisites make a decision recorded, reproducible, anchored, and attributed, and ZTG-4 guarantees that the effects those decisions produce cannot escape the record. It also underwrites admissibility. Evidence that an effect occurred is admissible as proof of governance only if it is bound to the effect rather than asserted alongside it — a log that says an effect was authorized, but that could exist whether or not the effect happened and whether or not it was authorized, proves nothing. ZTG-4 is the requirement that makes the evidence load-bearing.
Normative
Every governed effect and its evidence MUST be atomically coupled: no effect may occur without its evidence being durably committed, and no evidence of an effect may exist without the effect having been dispatched. The evidence is a precondition of the effect, not a record of it. The coupling MUST be enforced through a path the reasoning system cannot influence.
The Coupling Guarantee
The guarantee is bidirectional. In one direction, no effect without evidence: an effect that reaches the world without durably committed evidence is a ZTG-4 violation, not a missing log entry. In the other, no evidence without effect: evidence must correspond to a dispatched effect, so that the record cannot be inflated with effects that did not occur. The two directions together make the evidence and the effect a single coupled fact — they stand or fall together. An auditor reading a coupled evidence record is reading proof that the effect occurred under the recorded authorization, not a claim that happens to sit near the effect.
This is the precise content of "constitutive, not descriptive." A descriptive log is written about an act that is already complete; its presence or absence does not bear on whether the act was valid. Constitutive evidence is part of what makes the act an authorized governed effect at all: the effect is not permitted to occur except as the committing of its evidence, so an effect without evidence is not an unlogged action but an unauthorized one. ZTG-4 moves governance evidence from the first category to the second.
Ordering: Evidence Before Effect
Perfect atomicity between a local evidence commit and an irreversible external effect is not achievable, because the external world is not a transactional participant the system can two-phase-commit. ZTG-4 does not pretend otherwise. It specifies the achievable guarantee: durable evidence of the authorized effect MUST be committed before the effect is dispatched, and the effect's completion MUST be recorded after. This is the write-ahead discipline — intent is made durable before the irreversible operation, so that the record is never behind the world.
The ordering yields a definite guarantee: no effect occurs whose authorizing evidence was not already durably committed. It does not eliminate the failure window between evidence commit and confirmed dispatch; it relocates the residual uncertainty into a place where it is recorded rather than silent. A failure in that window leaves durable evidence of an effect that was authorized and attempted but whose completion is unconfirmed — an indeterminate effect, handled below — never an effect with no evidence at all. The framework's honesty here is the point: it bounds a known impossibility rather than claiming to have solved it.
Indeterminate Effects
An effect whose coupling cannot be confirmed — the write-ahead failure window where dispatch status is unknown, or any detected effect lacking committed evidence — is a loss of the ZTG-4 guarantee and MUST be treated as an integrity violation in the tamper family. Consistent with fail-closed semantics, an unreconciled indeterminate effect is a Stasis (ZTG-2) trigger: the system holds rather than continuing to act while the coupling between its effects and its evidence is in doubt. The indeterminate effect MUST be reconciled — its true disposition established and recorded — or its acceptance explicitly ratified by an authorized principal, before normal operation resumes. The system does not silently absorb a coupling gap, and it does not resolve one on its own authority.
The cost of an indeterminate effect tracks ZTG-5 harm class. An indeterminate Restorable-class effect is a reconciliation task; an indeterminate Irreversible-class effect is a serious condition, because the world may have changed in a way that cannot be undone while the record of whether it did is incomplete. This is why the write-ahead ordering and the narrowness of the failure window matter most for high-harm-class surfaces, and why those surfaces warrant the highest-criticality evidence.
The ZTG-4 Evidence Record
The ZTG-4 evidence record is where the outputs of every other invariant and
prerequisite converge for a single effect. It MUST carry: the decision provenance
established by the prerequisites — verdict, policy version (ZTG-0b), decision-time
(ZTG-0c), and authorizing identity traced to its ratifying principal (ZTG-0d); the
harm-class classification and liability ceiling (ZTG-5); and the surface routing and
reversal_strategy (ZTG-3). Mitigable-class effects record residual harm, and
Irreversible-class and over-threshold effects produce the highest-criticality
records the substrate supports, per ZTG-5.
Because every invariant's output lands in this record, the coupled evidence is the single artifact an auditor, a counterparty, or a court examines to see the whole governance of an effect at once: that it was authorized, by whom, under what policy, at what time, through which declared channel, at what harm class and ceiling, and with what result. The convergence is not incidental; it is what makes a governed effect accountable as a unit rather than as scattered fragments across subsystems.
Division from Observability
ZTG-4 and ZTG-0a are distinct and neither discharges the other. ZTG-0a requires that governance records be complete and tamper-evident: records that exist cannot be silently altered, and governance-relevant events that produce no effect — refusals, escalations, policy selection, identity validation — are recorded with integrity. ZTG-4 requires that records of effects be coupled to those effects: the record exists if and only if the effect does. A system could satisfy ZTG-0a's integrity and still violate ZTG-4 — its existing records unforgeable, yet an effect having slipped to the world with no record at all. It could satisfy ZTG-4's coupling for effects and still owe ZTG-0a the integrity and completeness of its non-effect records. The two compose to a single property — every governance fact is recorded, with integrity, and every effect is bound to its record — but they are reached by different requirements, and ZTG-4 is the effect-coupling half.
Coupling Path Integrity
The coupling MUST be enforced on a path the reasoning system cannot influence, consistent with ZTG-1's requirement that audit emission be atomic with the decision through a channel the reasoning system cannot intercept or modify. A coupling the governed system could sever — dispatching an effect while suppressing its evidence, or emitting evidence for an effect it did not dispatch — would return the evidence to the descriptive category and defeat the invariant. The evidence commit and the effect dispatch are bound by the architecture, not by the cooperation of the system whose effects are being recorded.
Conformance Criteria
A conforming implementation can: demonstrate that no effect is dispatched before its authorizing evidence is durably committed; demonstrate that no evidence of an effect exists without a corresponding dispatch; produce the ZTG-4 evidence record with all required prerequisite, ZTG-5, and ZTG-3 fields for every governed effect; detect indeterminate effects and escalate unreconciled ones to Stasis; reconcile or obtain ratified acceptance for indeterminate effects before resuming; demonstrate the coupling path is not influenceable by the reasoning system; and demonstrate that its ZTG-4 coupling and its ZTG-0a integrity are both satisfied without one being assumed from the other.
Further Considerations
The transaction-systems grounding, and its honesty about limits. Database systems solved durable, recoverable state change decades ago, and ZTG-4 adopts their core mechanism: write-ahead logging, in which a durable record of an intended change is committed before the change is performed, so that recovery can always reconstruct what was in flight. But database systems also established the limits of atomicity. Atomic commit across multiple independent participants requires those participants to cooperate in a commit protocol, and the foundational impossibility results — two-generals, and the broader limits on agreement over unreliable channels — show that perfect agreement with a party you neither control nor can assume will respond is unattainable. The external world an irreversible effect touches is exactly such a party. ZTG-4's design is what these two results jointly license: write-ahead gives a one-sided guarantee (the record is never behind the world), and the residual two-sided uncertainty is bounded and made explicit as the indeterminate-effect case rather than wished away. A framework that claimed perfect effect/evidence atomicity would be claiming to have refuted an impossibility result; ZTG-4 instead takes the strongest guarantee the result permits and is honest about the remainder.
The constitutive-evidence grounding, convergent with it. Law has long distinguished evidence that describes an act from evidence that constitutes it. Most records are descriptive: they document a transaction that is already complete and valid without them. But some formalities are constitutive — a deed that must be recorded to convey, an instrument that must be written and signed to be enforceable, a notarization without which the act has no legal effect. For these, the record is not proof of a valid act; it is a condition of the act's validity. ZTG-4 places governance evidence in this second category by construction: the effect has no sanctioned existence except as the committing of its evidence. That a transaction- systems tradition (reasoning about durability and recovery) and an evidentiary-law tradition (reasoning about what makes an act valid) converge on the same structure — the record precedes and conditions the act rather than following and describing it — is the cross-tradition agreement the framework treats as evidence the requirement is structural rather than stylistic.
Why coupling, not just logging, is the requirement. It is tempting to think thorough logging achieves what ZTG-4 asks. It does not, and the gap is the whole point. Logging is descriptive and severable: a system that logs its effects can, by failure or by design, perform an effect and not log it, or log an effect it did not perform, and nothing in the logging discipline forbids it. The disinhibited deployments the introduction describes (§1.5) typically log copiously and govern nothing, because the log is downstream of the act and optional to it. Coupling inverts the relationship: the evidence is upstream of the act and necessary to it. The difference between a system that logs and a system that couples is the difference between one that can tell you what it did when it chooses to and one that cannot act except by recording that it did.
Reconciliation is a governed activity, not a cleanup. Establishing the true disposition of an indeterminate effect — did the irreversible email send or not — often requires querying the external system the effect touched, and that query and its result are themselves governance-relevant. Reconciliation is therefore not an out-of-band repair but a governed activity that produces its own evidence and, where it changes the recorded disposition of an effect, does so as an attributed, recorded act. The framework does not let the resolution of a coupling gap be the one ungoverned moment in the system.
Relationship to replay. ZTG-0b reconstructs the verdict of a decision; ZTG-4 guarantees the effect that followed the verdict is bound to the record ZTG-0b replays. Read together they close the loop from decision to effect: the decision is reproducible, and the effect is coupled to the reproduced decision, so the entire arc — what was decided, and what was done about it — is both reconstructable and non-severable. Replay never re-emits effects (ZTG-0b), so the coupled effect record is examined, never re-performed.
How We Do It
Constable implements ZTG-4 by committing effect evidence to the Monotonic Logger before dispatching the effect through the ZTG-3 surface, and by holding on any effect whose coupling it cannot confirm.
Write-ahead to the Monotonic Logger. For every authorized effect, Constable
commits the ZTG-4 evidence record durably to the Monotonic Logger before the effect is
dispatched. The record carries the decision provenance, the ZTG-5 harm class and
liability ceiling, and the ZTG-3 surface routing and reversal strategy. Only after
the evidence is durably committed is the effect dispatched through the registered
surface; the dispatch and its result are then recorded (EVIDENCE_APPENDED,
EFFECT_DISPATCHED). The agent runtime has no path to dispatch an effect that
bypasses this ordering.
Critical-class records for high harm class. Irreversible-class and over-threshold effects (ZTG-5) are written as the highest-criticality records the Logger supports, with the durability and integrity guarantees those classes require, before dispatch. The narrowness of the write-ahead window is most rigorously enforced where harm class is highest.
Indeterminate-effect handling. If Constable cannot confirm that an effect's evidence was committed and the effect dispatched as a coupled pair — a failure in the write-ahead window, or a detected effect without a committed record — it marks the effect indeterminate and enters Stasis (ZTG-2). Resolution runs as governed reconciliation: the disposition of the effect is established, often by querying the target surface, and recorded; or an authorized principal ratifies acceptance of the indeterminate state via HumanSeal. Normal operation resumes only after reconciliation or ratified acceptance.
Coupling path isolation. The evidence-commit-then-dispatch sequence executes in the gate and surface mechanism, structurally separated from the agent runtime, so the agent can neither dispatch an effect while suppressing its evidence nor emit evidence for an effect it did not dispatch. The coupling is a property of the architecture, not of agent cooperation.
Conformance tests. Constable's internal testing for ZTG-4 includes: ordering tests confirming no effect dispatches before durable evidence commit; orphan tests confirming no effect-evidence exists without a dispatch; crash-injection tests in the write-ahead window confirming the result is a recorded indeterminate effect and Stasis, never a silent gap; evidence-record tests confirming all prerequisite, ZTG-5, and ZTG-3 fields are present; reconciliation tests confirming indeterminate effects are resolved as governed, recorded activity; division tests confirming ZTG-4 coupling and ZTG-0a integrity are independently satisfied; and isolation tests confirming the agent cannot sever the coupling. The protocol is documented in the conformance verification specification referenced in §22.
Draft Flags
- Indeterminate effect adds a ZTG-2 trigger. ZTG-4 contributes "unreconciled indeterminate effect" to ZTG-2's trigger list, in the tamper family alongside ZTG-3's reachable-unregistered-channel trigger. Keep ZTG-2's enumeration in sync.
- Reconciliation semantics are sketched, not fully specified. ZTG-4 requires reconciliation to be governed and recorded but does not specify the protocol for establishing an indeterminate effect's true disposition (which may depend on the target surface's own queryability). Flag for refinement and for §22.
- ZTG-0a/ZTG-4 division: third statement. The division is now stated in §5 (ZTG-0a) and §13 (ZTG-4) consistently. If either chapter is revised, keep both sides aligned; do not let ZTG-4 reclaim substrate integrity or ZTG-0a reclaim effect coupling.
- "No evidence without effect" direction needs a conformance method. The no-orphan direction is stated normatively; how an implementation demonstrates the absence of evidence for non-occurring effects is less obvious than the no-effect-without-evidence direction. Flag for §22.
- Invariant set now complete in draft. With ZTG-4 drafted, ZTG-1 (working), ZTG-2, ZTG-3, ZTG-4 drafted and ZTG-5 as calibration target, all five invariants exist in draft form. A cross-invariant consistency pass is now possible and advisable.
- §22 Conformance Verification is referenced but not yet captured in this workspace, and is now referenced by every invariant.
- The chapter is substantively complete but likely needs final tone calibration for publication register.