invariant-extract

invariant-extract

Recover a Territory's □ resident invariants — the rules every Run under it must hold, distinct from a single Run's done_when (◊). This skill describes the world those invariants live in, the criteria that tell a real one from a fake, the primitives that make extraction mechanical where it can be, and the gates a candidate must clear before it lands. It does not prescribe a step order — the engine sequences the work; what follows are the gaps to fill and the gates that must hold, in any order.

The gap (why the engine can't just read them off the code)

A composite of three atoms: Judgment (what counts as a real □), Control (the propose-and-sign gate, role separation), Capability (the mechanical scan + the exit verifier). The Knowledge it needs (KAOS, Model Spec) it routes to, below.

The load-bearing reason this is not free:

A piece of code that correctly maintains an invariant, and one that merely hasn't violated it yet, look identical. Correct code is silent about its invariants — it just doesn't break them. So the most reliable signal that an invariant exists is a violation: the moment it actually broke.

Deletion test: remove this skill and ask the engine to "list this Territory's resident invariants" from the code — it will pattern-match guard clauses (deduction only) and miss every invariant that was learned from a failure, because that knowledge is not in the code, it is in failure.memory. The gap is real; it is the abductive channel.

The world

• □ vs ◊ (KAOS). □ = Maintain/Avoid, "always holds", every Run (□(P→Q), □(P→¬Q)). ◊ = Achieve, "this Run attains it" (P⇒◊Q) — that is done_when, not an invariant.
• Two channels, both real, never merged. Deduction scans code execution points → invariants the code already declares (cheap, high-precision). Abduction negates a failure → the invariant the code paid for (expensive, high-value; the moat). See references/abduction.md.
• Purpose is the lens, not an input. A bare failure does not self-interpret — what "counts as a failure" is defined relative to what this Territory maintains. Purpose (= Territory.name + Territory.kpi + dos.scope) projects a failure onto the aspect this block owns (correctness / latency / cost / safety / reversibility), and kpi is that aspect's direct carrier. Two axes, orthogonal: purpose picks the aspect (dimension), Occam picks the scope (width). See references/abduction.md.
• Altitude. Constitution (R00x, system-wide) ⊃ responsibility (this Territory's invariants, where this skill works) ⊃ task (done_when). A candidate that holds under every Territory's purpose is constitution, not territory-level (see cross-territory).
• Division of labor (no whole-card generator). dos-extract → ontology / boundary / system constitution. invariant-extract → the □ column (here). acceptance-spec → done_when. Binding / autonomy / ownership → human-set at 设立 (R002). There is no monolithic "territory-spec"; assembling the card is the engine's job, not a skill.