The language
Locked vs. left to the org
Endoskeletal fixes very little, and fixes it hard. Everything else is the organization's choice, but each choice lives at a level, and each level can only be changed by the level above it through a recorded process.
The ten sorts; five value sorts (quantity with dimension, instant, interval, duration, status); three event families; the condition operators; the Belnap status algebra; lifecycle state sets; the felicity rule; the log as the only state; derived identifiers; organizational time comes only from the Clock capability; randomness only from a keyed Entropy capability. Patterns cannot add sorts, verbs outside the three families, or condition operators.
The rule of recognition, the rules of change, entrenchment and immunities, and every norm marked not tradeable or not defeasible. In Meridian: residency, privacy, MFA, customer transparency and security disclosure; Entrenched (nobody can amend the rule of recognition); NoSelfAmend (no autonomous, model-based or engine party can amend the amendment rule); ProductionImmunity (no autonomous party binds production Compute). Amending this level takes two Director votes within 14 days and 7 days of cooling-off.
Envelopes, spending tiers, proposal routes, review requirements, appointments, bind powers over production. In Meridian a collective amendment needs one Owner decision after a Finance impact analysis. This is where "Operations may scale to 40 units" lives.
Everything a party with a power in force may validly do: approve spend within tier, scale within envelope, fail over among evidenced realizations, bind a standby, run a sandbox experiment, accept a risk, appoint within authority. No compilation involved.
Which provider, region, product, model, prompt, program or human procedure realizes a capability. Emulated or real. LLM or lookup table. These are realizations and their evidence, recorded in the log and changeable by whoever holds the bind power.
The mechanical test
An act is runtime if its validity can be established against the definitions in force. It needs an amendment if it would change those definitions: a norm, position, scope, intent, required capability or the constitution.
| Situation | Runtime or amendment | Why |
|---|---|---|
| Scale Compute from 30 to 38 units | Runtime | execute pv.Scale authorized under ScaleEnvelope |
| Fail over to an evidenced standby | Runtime | A bind switch; the admissible set is the power's condition |
| Rebind to a cheaper provider that meets the contract | Runtime | Bind under a power whose admissibility condition holds |
| Scale to 60 units | Runtime, by someone else | OpsController's act misfires; the approval route gives the OpsLead a commitment |
| Let OpsController scale to 60 on its own | Amendment (collective) | Changes a power's envelope |
| Change who may approve infrastructure spend | Amendment | Changes a power's bearer |
| Relax data residency | Amendment (constitutional) | A non-tradeable, non-defeasible norm; Director quorum and cooling-off |
| Let the Architect bind production | Amendment (constitutional) | Blocked by ProductionImmunity until that is amended first |
| Swap the LLM behind TicketTriage for a lookup table | Runtime | A bind decision under TriageCrystal.Promote, given evidence |
The org sets its own dials
Nothing forces infrastructure change through a human. An organization that wants daily automatic rebinding gives its engine a wide envelope; one that wants every provider change approved gives it a zero envelope. Both are definitions, both are checked, and the difference between them can be simulated before either is enacted. What the kernel guarantees is that whatever the dials say is what happens, and that turning a dial is itself a recorded, authorized act.
Operating powers can't widen themselves. An agent that finds its envelope too tight may observe it, file a finding, simulate alternatives and propose an amendment. In Meridian the controller's EnvelopeFinding obligation makes it do exactly that after three over-envelope requests in 30 days. The amendment then goes through Finance review and the Owner, and the compiler materializes only the approved change.