{
  "uid": "cogitave.learn.apply-the-agents-floor.how-the-floor-is-enforced",
  "kind": "moduleUnit",
  "href": "/modules/apply-the-agents-floor/how-the-floor-is-enforced/",
  "title": "How the floor is enforced",
  "summary": "",
  "type": null,
  "products": [],
  "roles": [],
  "levels": [],
  "subjects": [],
  "headings": [
    "The enforcement map",
    "Blocking versus advisory",
    "Why enforcement is designed in, not bolted on"
  ],
  "source": "A rule that depends on everyone remembering it is not a floor. What makes the\nseven rules load-bearing is that most of them are **enforced by construction** -\na hook, a CI gate, an org ruleset, or policy-as-code refuses the violation, so the\nrule holds whether the author was a person or an agent.\n\n## The enforcement map\n\n| # | Rule | What enforces it |\n| --- | --- | --- |\n| 1 | English only | The floor rule itself; upheld through code review and the auditable-evidence posture (every diff is read by a reviewer or auditor). |\n| 2 | Conventional Commits | **commitlint** (`@commitlint/config-conventional`) in the `commit-msg` hook (lefthook) **and** in CI on PR commits and title. |\n| 3 | Signed commits | The **org ruleset** rejects unsigned commits; a non-`Verified` commit does not land. |\n| 4 | Docs-as-code | The CI **`docs-required` gate**: code changed but `docs/`/`*.md`/`CHANGELOG` did not fails the PR (escape: a `docs-exempt` label). |\n| 5 | Least privilege | Default-deny **capability grants**, **org rulesets** (`~ALL` repos), and **CODEOWNERS** review; policy-as-code blocks a violation rather than reviewing it. |\n| 6 | Autonomy within the rails | The seven rails: policy-as-code, capability grants, the eval/red-team gate, typed schema validation, reversibility and blast-radius caps, drift detection, and tracing to WORM evidence. |\n| 7 | The human gate | The runtime's trace-to-gate stage fires a human only on an escalation trigger or a member of the always-human set. |\n\nEvery claim above traces to the floor and its owning standard: commit rules to\n[commits-versioning](../../../../standards/docs/standards/commits-versioning.md),\nthe docs gate to\n[documentation](../../../../standards/docs/standards/documentation.md), grants and\nrulesets to\n[authorization](../../../../standards/docs/standards/authorization.md), and the\nrails and gate to\n[autonomy-and-oversight](../../../../standards/docs/standards/autonomy-and-oversight.md).\n\n## Blocking versus advisory\n\nNotice the difference between a **blocking** enforcer and an advisory one. The\n`commit-msg` hook, the org ruleset, and the `docs-required` gate all **stop the\nchange** - a bad commit message never lands, an unsigned commit is rejected, a\ndocs-less code PR fails. Rule 1's English-only expectation, by contrast, is\ncarried by review rather than by a dedicated bot in these documents; do not\nassume a linter enforces it, and do not treat the softer enforcement as a softer\nrule.\n\n## Why enforcement is designed in, not bolted on\n\nCogitave's operating doctrine is **autonomy by default, human on exception**. That\nonly works if correctness is enforced by the environment: default-deny grants, a\nschema that rejects malformed effects, an eval gate that blocks unsafe behavior,\nand reversibility as the default effect. The rails - not a standing human over\nevery action - carry correctness.\n\n> [!TIP]\n> When you hit a failing check, the floor's answer is always the same: **fix the\n> change, never widen the rule**. Broadening a grant, disabling signing, or\n> adding a `docs-exempt` label to dodge the docs gate all violate the floor even\n> when they turn a red check green.\n",
  "partOf": "cogitave.learn.apply-the-agents-floor",
  "durationInMinutes": 7,
  "quiz": null
}