Doctrine
A rule is enforced when it is declared, implemented, wired, executed, failure-propagating, tested and CI-blocking. Each one below shows its whole chain.
- declared
- 40
- blocking
- 36
- advisory
- 4
Counted from the rule package when this page was built. Every doctrine below resolves to a validator function, a command that dispatches it, a test, and a CI job — or the build fails and this page is not published.
Filtering runs in the browser. Without JavaScript every doctrine below is still listed.
-
blockingdoctor · watch
AI layer integrity
The repository's AI layer is real: the manifest declares a format this executable reads and every section it names exists, the checkout-local half is ignored by git and nothing under it is tracked, and no project data remains under the pre-.ai .majordomus/ path.
mj_validate_ai_layout -
advisorycheck · watch
Checkpoint freshness
A task whose last checkpoint is older than its profile's interval is reported, not stopped.
mj_validate_checkpoint -
advisorydoctor
Layout integrity
The directories the durable commands write into are installed rather than created on first use.
mj_validate_layout -
blockingcheck · doctor · watch
Ledger integrity
Every line of the append-only ledger is a well-formed event; the one durable record nothing else can reconstruct stays readable.
mj_validate_ledger -
blockingdoctor · watch
Policy completeness
Every policy value the code reads is declared in the skeleton policy, and no reader carries its own default for one.
mj_validate_policy_defaults -
blockingdoctor · watch
Bootstrap integrity
The path from a human reader to the AI layer is unbroken — README.md names AGENTS.md, every generated instruction file points at .ai/README.md, and none of them carries a rule of its own.
mj_validate_bootstrap -
blockingdoctor · watch
Catalogue integrity
Every use case and application describes the tool in terms the tool has — each command, doctrine and claim it names exists, and the two catalogues reference each other in both directions.
mj_validate_catalogue -
blockingdoctor · watch
Context integrity
Every directory of the AI layer carries a context document, each one carries the contract, they compose into one deterministic chain for every path, and a tree that does not validate resolves nothing.
mj_validate_context -
blockingdoctor · watch
Policy integrity
The policy and every profile parse, declare version 1, and carry no key the schema does not define.
mj_validate_policy -
blockingdoctor · watch
Architecture decision integrity
Every architecture decision the repository holds parses against the decision contract, claims an identity nothing else claims, and every relation and reference it makes resolves.
mj_validate_adr -
blockingcheck · finish
Blocker resolution
No task can be completed while any question on this branch is unresolved; it can still be finished as blocked, partial, no_match or failed.
mj_validate_blockers -
advisorycheck · doctor · watch
Decision records
Every entry in decisions.md carries the task, the head and the reason, so a decision can be found by the worker who needs it.
mj_validate_decisions -
blockingdoctor · watch
Dependency graph integrity
The issue dependency graph is acyclic, every edge names an issue that exists, and no issue is executing ahead of a dependency that is not done.
mj_validate_dag -
blockingdoctor · watch
The command surface is declared and reconciled
Every command the binary dispatches is described by the shipped registry, every command the registry declares public is dispatched, and a command is public exactly when the usage text lists it.
mj_validate_command_surface -
blockingdoctor
Doctrine wiring integrity
Every doctrine in this registry resolves to a validator that exists, is reached from every command it names, propagates failure, is proved by a test, and is run by CI — and every validator in the source is declared here.
mj_validate_doctrine_wiring -
blockingdoctor
Enforcement wiring
Every enforcement the policy declares is invoked by the hook it names, from a file the dispatcher will actually execute, without swallowing the exit code.
mj_validate_wiring -
blockingdoctor · watch
Every public command is exercised and refuted
Every public command has a behavioural test and a negative test, computed from the registry and the coverage each case declares about itself rather than from a list someone maintains.
mj_validate_command_coverage -
blockingdoctor · watch
Handover integrity
The resolver runs and reports either the record for this worktree and branch or its clean absence; a malformed record is never silently skipped, and a record describing a history this checkout no longer has is reported.
mj_validate_resolver -
blockingfinish
Note integrity
Every outcome needs a note carrying the sections that outcome requires, and no transcript.
mj_validate_note -
blockingfinish
Profile requirements
A profile may demand more than the shared contract — a regression test, a decision record — and finish refuses without it.
mj_validate_profile_requirements -
blockingdoctor · watch
Project model integrity
Every milestone and issue file parses, carries the id its filename claims, and contains no key nobody reads.
mj_validate_project -
blockingdoctor · watch
Projection integrity
Every generated instruction file exists, matches the stamp it carries, and is never silently overwritten after a hand edit.
mj_validate_projection -
blockingdoctor · watch
Context budget
The always-loaded projection stays within its line budget, every reference in it resolves, it states no count that will go stale, and the assembled context fits the builder's own budget.
mj_validate_budget -
blockingdoctor · watch
A deployment is described once, and every provider artifact is generated from it
A deployment of the executable is a canonical object of the layer against a closed contract; the container definition and the provider configuration are projections of it, never a second description.
mj_validate_deployments -
blockingdoctor · watch
Prompt capture is proven, or reported unavailable
A repository that declares prompt capture has it wired below the model and proven by running it; the archive stays ignored and untracked, every prompt is present as both a record and a rendering, and neither carries anything the model said.
mj_validate_prompt_capture -
blockingdoctor · watch
Prompt integrity
Every repository-local prompt asset renders, and every token in it is one the renderer knows.
mj_validate_prompts -
blockingdoctor · watch
Questions store integrity
Every entry in open-questions.md parses, because a gate that cannot read an entry can be bypassed by mistyping one.
mj_validate_questions_store -
blockingdoctor · watch
Retention caps
The ledger and the handover directory stay under the caps the policy sets, so durable state does not grow without bound.
mj_validate_retention -
blockingdoctor · watch
The roadmap is a projection, never a document
No document is a second authority for the roadmap. While a hand-written roadmap table exists, it can neither list a version no milestone declares nor hide one the model does.
mj_validate_roadmap -
blockingdoctor · watch
Rule package integrity
The repository's effective rule set is real: the vendored baseline matches its manifest file for file, every rule resolves with its dependencies and no two claim one identity, and no project rule reuses the vendored namespace.
mj_validate_rule_package -
blockingdoctor · watch
Every object has a schema, and the rules resolve in one stated order
The order the rules apply in is written down rather than left in the code; every kind the tool reads declares a schema, every schema is named by a kind, and every path under the repository's AI layer is claimed by a source so that nothing is carried through unvalidated.
mj_validate_schema_integrity -
blockingcheck · finish · watch
Scope integrity
A task touches only the paths it claimed; work found elsewhere is not accepted as done.
mj_validate_scope -
blockingdoctor · watch
Session records are shared objects with a closed field set
A closed execution episode is written once, into the layer's sessions section, against a schema that admits what the repository can prove and nothing else.
mj_validate_session_records -
blockingdoctor · watch
The episode boundary is drawn below the model, and its working context is local
Where a provider fires session events, the episode is opened and closed by that provider's hook rather than by the model, the start event hands the worker the bounded briefing the policy declares, and the working context each open freezes stays under the ignored half of the layer, carries the declared keys, and never carries a conversation.
mj_validate_session_lifecycle -
blockingdoctor · watch
Skill integrity
Every skill the repository declares parses against the skill contract, names the directory it lives in, carries its sections, describes itself in terms no other skill uses, and every skill or example it refers to exists.
mj_validate_skills -
blockingcheck · finish · watch
State consistency
The task record still describes this checkout — same branch, and HEAD at or ahead of the recorded commit.
mj_validate_state -
advisoryfinish
Task continuity
A task finished as partial or blocked should leave a handover record, not only a note section.
mj_validate_continuity -
blockingdoctor · check · finish
Use-case coverage
Every public command, and every guaranteed claim and MCP tool the policy asks for, is named and run by at least one active use case whose scenario executes against the real tool; a gap is a failure or a report according to the policy, never silence.
mj_validate_use_case_coverage -
blockingfinish
Verification integrity
Completion requires a verification command that actually ran and exited 0; its exit code and duration are recorded.
mj_validate_verification -
blockingcheck · finish
Obligation closure
A task that declares obligations reaches the outcome completed only when each one is established by the tool or has evidence, and that evidence still describes the tree or the commit it was taken over.
mj_validate_obligations
Principle, doctrine, guarantee
A principle says why work is organised this way — the 10 rules a worker reads. A doctrine is the part of a principle a machine can decide, and it names the validator that decides it. A guarantee is what may then be promised in public, and it is only listed as guaranteed once a test proves it and CI runs that test.
The distinction matters because the failure it prevents is invisible: a rule that is written down, has a script, has a test, and is invoked by nothing at all. How the wiring is verified · What is guaranteed