Home / Projects / Orchestrata Ultimate / Decisions / ADR index / ADR-0013
ADR-0013: Anchors are constitution-tier and human-only; anchor edits are loosening
| field | value |
|---|---|
| Status | Accepted |
| Date | 2026-07-24 |
| Register | factory (docs/adr, 4-digit ids) |
| Source | docs/adr/0013-anchors-are-constitution-tier.md — permalink at bdafa201a (unchanged on master since that commit) |
| Wiki register entry | ADR-0013 (wiki status: Accepted) |
The record
- Status: Accepted
- Date: 2026-07-24
- Spec: SPEC-033 §2, §3
Context
Semantic anchors (ADR-0012) are the only artefact that pins intent. Everything the exoskeleton claims about semantic correctness is downstream of them.
They currently sit in no integrity tier. §1 governs rules; §3 protects gate assets (.pl,
hooks, config). Anchors are in neither, and — unlike tests, which have a red-first ledger precisely to
catch a test weakened to pass — nothing detects an anchor weakened to pass.
The failure is not hypothetical and needs no adversary:
- An implementation fails anchor
AC-7-ex3. - Triage classifies it as a design gap (a legitimate-looking call).
- Fable amends the anchor's expected output to what the code produces.
- Quorum ratifies — it even looks like a tightening, since the anchor set is now more specific.
The factory has now certified its own misreading with maximum confidence and minimum human attention, and every downstream gate agrees. The anchor stops being the pin on intent and becomes the mechanism by which a misinterpretation is laundered.
Decision
- Anchors are constitution-tier: human-authored/ratified only, stored with the gate assets under the OS trust boundary (ADR-0018), never writable from a worktree.
- Any edit to an existing anchor is a loosening by definition — human ratification required, regardless of whether the edited set looks more specific.
- An "anchor-weakened-to-pass" ledger mirrors the red-first ledger: anchor value changes are recorded with the failing run that preceded them, so laundering is visible after the fact.
Alternatives rejected
- Anchors as ordinary spec content — the status quo; the laundering path above.
- Quorum-ratified anchor edits — both voters are models working from the same reading; quorum adds no independence for exactly this decision.
- Detect bad anchor edits heuristically — asks a model to police the artefact that defines its success criterion.
Consequences
- Increases human load at exactly the point where independence is irreplaceable — accepted, and it is the same load ADR-0016 prices.
- A genuine design change that should alter an anchor now requires a human ratification round; this is intended friction, but it is friction on a real and not-rare path.
- Requires the OS trust boundary to exist first (ADR-0018); until then this is policy, not enforcement.
Provenance
Round-3 Opus, ranked its most dangerous finding and named as the single most dangerous remaining assumption ("that the anchors are a trustworthy record of human intent"). Not raised in rounds 1–2 — it only became reachable once anchors were introduced in v0.3.0.
Related ADRs
Rulings cited
None.