Doctrine

Filtering runs in the browser. Without JavaScript every doctrine below is still listed.

• !advisory doctor · watch

  Knowledge graph integrity

  The graph the knowledge compiler builds from what the repository states has one node per identity, no edge with a missing end or without provenance, and no declared path or tracked source that no longer exists; a broken owned reference is a failure, a broken link an author wrote in prose is not.

  mj_validate_knowledge_graph
• ✕blocking check · doctor

  Knowledge integrity

  Every knowledge record is one evidenced, well-formed assertion. It is valid against its schema with no unknown key, its identity is unique and equals its file name, a verified record carries provenance, every reference it names resolves, a superseded record says what replaced it or why it was rejected, a candidate never claims to be verified, and no record carries a conversation.

  mj_validate_knowledge_integrity
• !advisory doctor

  Candidates are reviewed

  A review queue that grows without bound is not reviewed. More candidates than the policy cap, a candidate that has waited longer than the policy age, or a candidate the tree does not track, is reported, not stopped; both numbers are declared once in the policy.

  mj_validate_knowledge_accumulation
• ✕blocking doctor · watch

  AI layer integrity

  The repository's AI layer is real: the manifest declares a format this executable reads and every section it names exists, the checkout-local half is ignored by git and nothing under it is tracked, and no project data remains under the pre-.ai .majordomus/ path.

  mj_validate_ai_layout
• !advisory check · watch

  Checkpoint freshness

  A task whose last checkpoint is older than its profile's interval is reported, not stopped.

  mj_validate_checkpoint
• !advisory doctor

  Layout integrity

  The directories the durable commands write into are installed rather than created on first use.

  mj_validate_layout
• ✕blocking check · doctor · watch

  Ledger integrity

  Every line of the append-only ledger is a well-formed event; the one durable record nothing else can reconstruct stays readable.

  mj_validate_ledger
• ✕blocking doctor · watch

  Policy completeness

  Every policy value the code reads is declared in the skeleton policy, and no reader carries its own default for one.

  mj_validate_policy_defaults
• ✕blocking doctor · watch

  Bootstrap integrity

  The path from a human reader to the AI layer is unbroken — README.md names AGENTS.md, every generated instruction file points at .ai/README.md, and none of them carries a rule of its own.

  mj_validate_bootstrap
• ✕blocking doctor · watch

  Catalogue integrity

  Every use case and application describes the tool in terms the tool has — each command, doctrine and claim it names exists, and the two catalogues reference each other in both directions.

  mj_validate_catalogue
• ✕blocking doctor · watch

  Context integrity

  Every directory of the AI layer carries a context document, each one carries the contract, they compose into one deterministic chain for every path, and a tree that does not validate resolves nothing.

  mj_validate_context
• ✕blocking doctor · watch

  Policy integrity

  The policy and every profile parse, declare version 1, and carry no key the schema does not define.

  mj_validate_policy
• ✕blocking doctor · watch

  Architecture decision integrity

  Every architecture decision the repository holds parses against the decision contract, claims an identity nothing else claims, and every relation and reference it makes resolves.

  mj_validate_adr
• ✕blocking check · finish

  Blocker resolution

  No task can be completed while any question on this branch is unresolved; it can still be finished as blocked, partial, no_match or failed.

  mj_validate_blockers
• !advisory check · doctor · watch

  Decision records

  Every entry in decisions.md carries the task, the head and the reason, so a decision can be found by the worker who needs it.

  mj_validate_decisions
• ✕blocking doctor · watch

  Dependency graph integrity

  The issue dependency graph is acyclic, every edge names an issue that exists, and no issue is executing ahead of a dependency that is not done.

  mj_validate_dag
• ✕blocking doctor · watch

  The command surface is declared and reconciled

  Every command the binary dispatches is described by the shipped registry, every command the registry declares public is dispatched, and a command is public exactly when the usage text lists it.

  mj_validate_command_surface
• ✕blocking doctor

  Doctrine wiring integrity

  Every doctrine in this registry resolves to a validator that exists, is reached from every command it names, propagates failure, is proved by a test, and is run by CI — and every validator in the source is declared here.

  mj_validate_doctrine_wiring
• ✕blocking doctor

  Enforcement wiring

  Every enforcement the policy declares is invoked by the hook it names, from a file the dispatcher will actually execute, without swallowing the exit code.

  mj_validate_wiring
• ✕blocking doctor · watch

  Every public command is exercised and refuted

  Every public command has a behavioural test and a negative test, computed from the registry and the coverage each case declares about itself rather than from a list someone maintains.

  mj_validate_command_coverage
• ✕blocking doctor · watch

  Handover integrity

  The resolver runs and reports either the record for this worktree and branch or its clean absence; a malformed record is never silently skipped, and a record describing a history this checkout no longer has is reported.

  mj_validate_resolver
• ✕blocking doctor · watch

  Lifecycle observation

  A store that can be read is not a store that is being written. While episodes go on opening, the records a future worker resumes from must go on advancing, every lifecycle event received must leave evidence it arrived, and an episode that outlives the staleness threshold must be named rather than left open.

  mj_validate_lifecycle
• ✕blocking doctor · watch

  Knowledge observation

  While episodes keep closing, the knowledge they produced must keep being derived. A closed episode no derivation followed, once it is older than the freshness threshold, is a stopped writer; a lifecycle whose close path never calls the deriver while the policy switch is on is a writer that was never started.

  mj_validate_knowledge_lifecycle
• ✕blocking finish

  Note integrity

  Every outcome needs a note carrying the sections that outcome requires, and no transcript.

  mj_validate_note
• ✕blocking finish

  Profile requirements

  A profile may demand more than the shared contract — a regression test, a decision record — and finish refuses without it.

  mj_validate_profile_requirements
• ✕blocking doctor · watch

  Project model integrity

  Every milestone and issue file parses, carries the id its filename claims, and contains no key nobody reads.

  mj_validate_project
• ✕blocking doctor · watch

  Projection integrity

  Every generated instruction file exists, matches the stamp it carries, and is never silently overwritten after a hand edit.

  mj_validate_projection
• ✕blocking doctor · watch

  Context budget

  The always-loaded projection stays within its line budget, every reference in it resolves, it states no count that will go stale, and the assembled context fits the builder's own budget.

  mj_validate_budget
• ✕blocking doctor · watch

  A deployment is described once, and every artifact built from it is generated from it

  A deployment of the executable is a canonical object of the layer against a closed contract; the container definition, its ignore file and the files of the provider it names are projections of it, never a second description.

  mj_validate_deployments
• ✕blocking doctor · watch

  Prompt capture is proven, or reported unavailable

  A repository that declares prompt capture has it wired below the model and proven by running it; the archive stays ignored and untracked, every prompt is present as both a record and a rendering, and neither carries anything the model said.

  mj_validate_prompt_capture
• ✕blocking doctor · watch

  A prompt record carries its own identity, is bounded, and is private

  Every captured prompt names the episode it belongs to or says why it cannot; the archive is readable by its owner alone, bounded by a declared retention policy, and never holds credential material verbatim.

  mj_validate_prompt_continuity
• ✕blocking doctor · watch

  Prompt integrity

  Every repository-local prompt asset renders, and every token in it is one the renderer knows.

  mj_validate_prompts
• ✕blocking doctor · watch

  Questions store integrity

  Every entry in open-questions.md parses, because a gate that cannot read an entry can be bypassed by mistyping one.

  mj_validate_questions_store
• ✕blocking doctor · watch

  Retention caps

  The ledger, the handovers, the checkpoints and the session records stay under the caps the policy sets, so durable state does not grow without bound.

  mj_validate_retention
• ✕blocking doctor · watch

  The roadmap is a projection, never a document

  No document is a second authority for the roadmap, and no milestone types its own version. While a hand-written roadmap table exists, it can neither list a release no milestone was released in nor hide one that carried a milestone; a milestone's release (released_in) is inferred from the release records, never typed.

  mj_validate_roadmap
• ✕blocking doctor · watch

  Rule package integrity

  The repository's effective rule set is real: the vendored baseline matches its manifest file for file, every rule resolves with its dependencies and no two claim one identity, and no project rule reuses the vendored namespace.

  mj_validate_rule_package
• ✕blocking doctor · watch

  Every object has a schema, and the rules resolve in one stated order

  The order the rules apply in is written down rather than left in the code; every kind the tool reads declares a schema, every schema is named by a kind, and every path under the repository's AI layer is claimed by a source so that nothing is carried through unvalidated.

  mj_validate_schema_integrity
• ✕blocking check · finish · watch

  Scope integrity

  A task touches only the paths it claimed; work found elsewhere is not accepted as done.

  mj_validate_scope
• ✕blocking doctor · watch

  Session records are shared objects with a closed field set

  A closed execution episode is written once, into the layer's sessions section, against a schema that admits what the repository can prove and nothing else.

  mj_validate_session_records
• !advisory doctor

  A record's changed_files names the work, not the tool's exhaust

  The changed_files block of a checkpoint, a handover or a closed session names what the episode produced. Paths a declaration already calls generated, projected or local are classified out, and the classification reads those declarations rather than a list of its own.

  mj_validate_record_changed_files
• ✕blocking doctor · watch

  The episode boundary is drawn below the model, and its working context is local

  Where a provider fires session events, the episode is opened and closed by that provider's hook rather than by the model, the start event hands the worker the bounded briefing the policy declares, and the working context each open freezes stays under the ignored half of the layer, carries the declared keys, and never carries a conversation.

  mj_validate_session_lifecycle
• ✕blocking doctor · watch

  Skill integrity

  Every skill the repository declares parses against the skill contract, names the directory it lives in, carries its sections, describes itself in terms no other skill uses, and every skill or example it refers to exists.

  mj_validate_skills
• ✕blocking check · finish · watch

  State consistency

  The task record still describes this checkout — same branch, and HEAD at or ahead of the recorded commit.

  mj_validate_state
• !advisory finish

  Task continuity

  A task finished as partial or blocked should leave a handover record, not only a note section.

  mj_validate_continuity
• ✕blocking check · finish

  A task on a repository whose mesh is enabled works on the mesh

  When the repository declares its mesh enabled, an active task's scope is claimed on the mesh — `start` brings the checkout's shared server up and claims it, `check` and `finish` claim it again when a server answers — and a task completed without that claim is refused.

  mj_validate_task_on_the_mesh
• ✕blocking doctor · check · finish

  Use-case coverage

  Every public command, and every guaranteed claim and MCP tool the policy asks for, is named and run by at least one active use case whose scenario executes against the real tool; a gap is a failure or a report according to the policy, never silence.

  mj_validate_use_case_coverage
• ✕blocking finish

  Verification integrity

  Completion requires a verification command that actually ran and exited 0 over a tree that did not change under it; its exit code, duration and tree are recorded.

  mj_validate_verification
• ✕blocking check · finish

  Obligation closure

  A task that declares obligations reaches the outcome completed only when each one is established by the tool or has evidence, and that evidence still describes the tree or the commit it was taken over.

  mj_validate_obligations
• ✕blocking check · finish

  Completion is gated

  A task reaches the outcome completed only when no validation gate its own change set selects is known to be failing, and a gate's verdict discharges nothing once the files that select it have changed since the run.

  mj_validate_completion_gates
• ✕blocking finish

  A session does not finish behind its own published site

  A repository that publishes has a second tree — the one the public is being served — and no commit-level gate can measure it, because no change to any file can make it right or wrong. A session that lands work and leaves the publication owed has finished nothing the public can see, and every check stays green while that is true. The gates that measure a deployment are declared as such in the CI model, and finish asks them.

  mj_validate_publication_currency