Home / Projects / Orchestrata Ultimate / Decisions / ADR index / ADR-0011
ADR-0011: Detect incompleteness rather than prove completeness
| field | value |
|---|---|
| Status | Accepted |
| Date | 2026-07-23 |
| Register | factory (docs/adr, 4-digit ids) |
| Source | docs/adr/0011-detect-incompleteness-not-prove-completeness.md — permalink at bdafa201a (unchanged on master since that commit) |
| Wiki register entry | ADR-0011 (wiki status: Accepted) |
The record
- Status: Accepted
- Date: 2026-07-23
- Spec: SPEC-033 §6
Context
The build is only autonomous if the design has no open decisions. The obvious gate — "certify the design is decision-complete" — is undecidable in general, and the first attempt at it (a Definition-of-Ready that checked boxes were filled: every requirement has a node, a test, an ADR) was vacuous: it verified the presence of artefacts, never the sufficiency of the decisions behind them.
The useful asymmetry: completeness cannot be proven, but incompleteness can very often be detected — the same relationship testing has to correctness. Independent BDD/requirements research confirms the field has no completeness metric analogous to branch coverage; every practical heuristic is a necessary condition, and the stopping rule ("until the group is satisfied the scope is clear") is irreducibly a human residual-risk judgement.
Decision
Replace the completeness proof with a battery of incompleteness detectors, run at design time rather than discovered mid-build. Definition of Ready = no detector fires (plus a positive human floor, ADR-0015).
The battery spans four kinds:
- Assumption ledger + discrimination check — the mechanised form of "I noticed I was about to guess".
- Interpretation mutation — mutate the meaning, not the code.
- Lexical/structural detectors — vagueness lint, undefined terms, orphan/unmapped graph checks.
- Logical detectors — design-time contradiction (unsatisfiability) and under-constraint.
Alternatives rejected
- Certify completeness — undecidable; and a false certificate is worse than none.
- Box-checking DoR — verifies artefact presence, not decision sufficiency; the original failure.
- Discover incompleteness during the build — this is the status quo (escalation catches it), but it fires at the most expensive moment, mid-execution.
Consequences
- Detector silence is not a verdict. Each detector is sound when it fires and uninformative when silent; DoR must therefore be explicitly necessary-and-not-sufficient (ADR-0015), or the design commits the very error it diagnoses — assembling a completeness judgement out of one-sided tests.
- Known unknowns must be first-class and blocking. Example Mapping's "red card" is the proven pattern: an unresolved question is an artefact that blocks readiness. Without it, the gate silently rewards omitting a known unknown — worse than no gate.
- Detectors add a design-phase blocking surface, which must be bounded (ADR-0015) or they trade a semantic hole for a throughput hole.
- The battery is extensible: each escaped defect should become a new detector or a new checklist axis.
Provenance
Round-2 Opus and Sonnet both showed decision-completeness is undecidable and that DoR's structural checks cannot see semantic under-specification. Framing refined in round 3 after Opus identified the "silence as verdict" contradiction. Independently corroborated by BDD/Specification-by-Example research (Adzic; Wynne's Example Mapping; Oliveira et al.).
Related ADRs
- Also mentioned: ADR-0015
Rulings cited
None.