On 2026-10-07 `ontoref adr validate` found two of the spine's Hard constraints red after deliveries whose own contracts had not run them (adr-002's walk, broken by a JSON shape change; adr-003's grep, matching a read). The rule that every change keeps them green lived in one SOW's contract and in the agent's memory — the drift the global governance rule names: a rule that must hold goes as a constraint and a validator in the mechanism that executes the action, never in an agent's memory. The same day ontoref changed the SOW and ratification schemas SpecDossier copies (RefutationRow, BiopRow, `compose`, `Floor`) without anyone telling SpecDossier; a reader copy that drifts from ontoref's format lets through a SOW ontoref refuses (measured: ontoref's Sow is a closed record).
ontoref's adr-127 gives the mechanism: a SOW's validity says whether it is in force — 'Value 'True keeps it standing after delivery — and each contract says when it is paid (`pay_at`, 'Commit among them); `ontoref form due-sow <paths> --at Commit` answers which contracts of live SOWs cover what is staged. DD-eca already pays them with a pre-commit gate (scripts/sow-gate.nu).
The principal had two standing SOWs signed and delivered — sow-the-spine-adr-constraints-hold-at-every-commit (the gate, and the spine's Hard constraints) and sow-the-reader-is-ontorefs-format (the copies) — and installed the hook in code/. The adr? of both asked for this record.
WHAT MUST KEEP HOLDING IS A STANDING SOW. A rule of this workspace that must hold after the work that set it is delivered is a contract of a SOW whose validity is 'Value 'True, with `pay_at` naming 'Commit, in code/.governance/. It stays in force until a ratified successor supersedes it; it is never an agent's note, nor a line in one delivery's contracts only.
EVERY COMMIT PAYS WHAT LIVE SOWs OWE AT 'COMMIT. code/scripts/sow-gate.nu, declared as a pre-commit hook in code/.pre-commit-config.yaml (always run), asks ontoref `form due-sow <staged paths> --at Commit`, runs each due contract's check where its level stands, and refuses the commit when one is red, or when a validity reads unknown and its SOW says Stop. Which SOW is live and which contract covers which path is ontoref's answer; the gate decides nothing of it.
ITS FIRST TWO CASES. (1) The spine's gateable Hard constraints pass with code/ as it stands (`ontoref adr validate` at the spine), at every commit touching the code, the walks, the format or the scripts. (2) SpecDossier's copies of ontoref's formats — sow.ncl, ratification.ncl, authority-profile.ncl — carry ontoref's installed code line for line, comments aside (`tests/protocol.nu copies`), at every commit touching them: a change on ontoref's side shows red at the next such commit, whoever was or was not told.
INSTALLING THE HOOK IS THE OPERATOR'S ACT. The gate runs only where `pre-commit install` was run, in a repository the principal also commits to; until then the contracts due at 'Commit are paid at receipts only. A commit with `--no-verify` skips it; nothing here forbids that.
WHAT THIS AMENDS: adr-001 gains, once this is accepted, the Soft constraint `the-copies-carry-ontorefs-code` — «SpecDossier's copies of ontoref's formats carry ontoref's installed code line for line, comments aside» — settled by sow-the-reader-is-ontorefs-format and paid at every commit; its `no-format-of-anothers-claimed` is unchanged.
WHAT THIS DOES NOT DECIDE: a mechanism on ontoref's side naming who copies a schema (raised by ontoref with the principal); gates for the spine or other members, which have no hook.
code/ declares the commit gate as an always-run pre-commit hook that asks ontoref `form due-sow … --at Commit` and refuses a commit when a due contract is red or an unknown validity says Stop
Keep the rule in the agent's memory or session notes
Rejected: The global governance rule: memory binds no one and is not verifiable; it is how the two Hard constraints went red.
Add `ontoref adr validate` to every SOW's contracts
Rejected: Depends on whoever drafts the next SOW remembering it; paid at receipts, not at the commit that breaks it.
A gate that reads SOWs itself, without ontoref
Rejected: A second reading of validity and coverage beside ontoref's (adr-127); it could disagree.