# Locked vs. left to the org

> Endoskeletal fixes very little, and fixes it hard. Everything else is the organization's choice, but each choice lives at a level, and each level can only be changed by the level above it through a recorded process.

Canonical: https://endoskeletal.com/locked/
Last updated: 2026-09-28

- **Kernel** (changes only with a new kernel major): The ten sorts; five value sorts (quantity with dimension, instant, interval, duration, status); three event families; the condition operators; the Belnap status algebra; lifecycle state sets; the felicity rule; the log as the only state; derived identifiers; organizational time comes only from the Clock capability; randomness only from a keyed Entropy capability. Patterns cannot add sorts, verbs outside the three families, or condition operators.
- **Constitution** (org-authored · hardest to change): The rule of recognition, the rules of change, entrenchment and immunities, and every norm marked `not tradeable` or `not defeasible`. In Meridian: residency, privacy, MFA, customer transparency and security disclosure; `Entrenched` (nobody can amend the rule of recognition); `NoSelfAmend` (no autonomous, model-based or engine party can amend the amendment rule); `ProductionImmunity` (no autonomous party binds production Compute). Amending this level takes two Director votes within 14 days and 7 days of cooling-off.
- **Collective** (org-authored · who decides what): Envelopes, spending tiers, proposal routes, review requirements, appointments, bind powers over production. In Meridian a collective amendment needs one Owner decision after a Finance impact analysis. This is where "Operations may scale to 40 units" lives.
- **Operational / runtime** (decided while running): Everything a party with a power in force may validly do: approve spend within tier, scale within envelope, fail over among evidenced realizations, bind a standby, run a sandbox experiment, accept a risk, appoint within authority. No compilation involved.
- **Below the boundary** (not in the language at all): Which provider, region, product, model, prompt, program or human procedure realizes a capability. Emulated or real. LLM or lookup table. These are realizations and their evidence, recorded in the log and changeable by whoever holds the bind power.

## The mechanical test

An act is runtime if its validity can be established against the definitions in force. It needs an amendment if it would change those definitions: a norm, position, scope, intent, required capability or the constitution.

| Situation | Runtime or amendment | Why |
| --- | --- | --- |
| Scale Compute from 30 to 38 units | Runtime | `execute pv.Scale` authorized under `ScaleEnvelope` |
| Fail over to an evidenced standby | Runtime | A bind switch; the admissible set is the power's condition |
| Rebind to a cheaper provider that meets the contract | Runtime | Bind under a power whose admissibility condition holds |
| Scale to 60 units | Runtime, by someone else | OpsController's act misfires; the approval route gives the OpsLead a commitment |
| Let OpsController scale to 60 on its own | Amendment (collective) | Changes a power's envelope |
| Change who may approve infrastructure spend | Amendment | Changes a power's bearer |
| Relax data residency | Amendment (constitutional) | A non-tradeable, non-defeasible norm; Director quorum and cooling-off |
| Let the Architect bind production | Amendment (constitutional) | Blocked by `ProductionImmunity` until that is amended first |
| Swap the LLM behind TicketTriage for a lookup table | Runtime | A bind decision under `TriageCrystal.Promote`, given evidence |

## The org sets its own dials

Nothing forces infrastructure change through a human. An organization that wants daily automatic rebinding gives its engine a wide envelope; one that wants every provider change approved gives it a zero envelope. Both are definitions, both are checked, and the difference between them can be simulated before either is enacted. What the kernel guarantees is that whatever the dials say is what happens, and that turning a dial is itself a recorded, authorized act.

> **No self-promotion.**
>
> Operating powers can't widen themselves. An agent that finds its envelope too tight may observe it, file a finding, simulate alternatives and propose an amendment. In Meridian the controller's `EnvelopeFinding` obligation makes it do exactly that after three over-envelope requests in 30 days. The amendment then goes through Finance review and the Owner, and the compiler materializes only the approved change.