2026-11-10 — Meta-rule change: a claim that a guard bites cites the named assertion (MR-21)

rank: decision outranks: []

2026-11-10 — Meta-rule change: a claim that a guard bites cites the named assertion (MR-21)

Date: 2026-11-10 Status: closed Countersigned by human:flight@arno.host on 2026-11-11 at jzero.run T1 — box ticked in commit 2a9b6daf, authored as flight@arno.host. FLIGHT confirmed the signature to the agent on 2026-11-11. Status flipped open→closed on 2026-11-11 by an agent as scribe (MR-7).

Supersedes: none Superseded-by: none — current MR-compliance: MR-4, MR-7, MR-8, MR-9

Context

On 2026-11-10 FLIGHT ruled in an arno-host session to promote arno-host’s mutation-evidence convention to a fleet meta-rule. The arno-host record is arno-host/arno-host:docs/decisions/2026-11-10-mutation-evidence-is-promoted-to-mr-21.md. It supersedes docs/decisions/2026-08-15-the-checkable-half-of-mutation-evidence-is-mechanised.md, which carried expires: 2026-11-15 and asked a human to “promote, or re-defer deliberately”. arno-host cannot finish the promotion itself. Its docs/META-RULES.md says changes are ratified upstream and re-deposited, so this doc is step 1 of the route that arno-host doc names.

The rule as practised in arno-host. CLAUDE.md § Conventions: “Mutation evidence cites the named assertion, never the exit code.” A guard is proven to bite only by recording three things: what was broken, the name of the test that failed, and that the file was restored. exit 1 is not that evidence.

The incident behind it. During arno-host’s Phase H verification round, a mutation went red on a YAMLParseError caused by its own bad edit. The guard never ran. If you check only the exit status, a red run for the wrong reason looks like proof that the guard works.

The checkable half is already mechanised. arno-host’s node scripts/probe.mjs mutation --file … --apply … --test … restores from git on every path. Its formatEvidence refuses three results: a mutation that survived, a red run that names no assertion, and a working file left dirty (docs/decisions/2026-08-15-the-checkable-half-of-mutation-evidence-is-mechanised.md). Whether the named assertion is the right one stays prose that a human reads.

The evidence base. arno-host’s promotion doc records its trigger as “a second lane applying the convention without being prompted”. The convention, or its runner, is cited in 36 arno-host docs across the Phase H, Phase O and Phase 5 lanes. No sibling repo applies it yet. That limit is stated here because MR-9’s reasoning applied to (c) in 2026-10-02-meta-rule-change-gate-evidence-rules.md: a fleet rule with one repo behind it needs a reason.

The reason here: the failure is not specific to arno-host’s stack. A “this guard catches X” claim backed only by a red exit appears wherever mutation probes are run. It also appears in any verify round that cites a red run as proof. This doc has not audited other repos for instances. The rule also completes the gate-evidence trio already ratified:

MR-19 asks whether you looked at the run.
MR-20 asks whether the run looked at anything.
MR-21 asks whether the red you saw is the guard’s red.

It also clears the bar arno-host set in 2026-08-15-a-rule-nobody-can-observe-being-broken-is-not-promoted.md. A violation is observable: an evidence block with no assertion name in it.

Decision

Proposed. Nothing here takes effect until a human countersigns. Agents may open a meta-rule change, but cannot ratify one (META-RULES “Updating these rules”, step 3).

Add MR-21 to META-RULES.md. The wording is arno-host’s proposal, unchanged:

MR-21 — A claim that a guard bites cites the named assertion. Evidence that a check catches a defect records the mutation, the name of the assertion that failed, and the revert. A red exit status is not that evidence: a run that fails before reaching any assertion reads exactly like one that caught the mutation.
Numbering. MR-21 is the next free number. Today the highest assigned is MR-20, in eva-hq/prompts/_shared/petrova/META-RULES.md (v1.4) and in this repo’s mirror core/playbook/META-RULES.md. MR-21 was named but never assigned: 2026-10-02-meta-rule-change-gate-evidence-rules.md Decision 3 held it for kahn’s rule (c), conditional on a fleet-wide ruling. The countersign kept (c) KAHN-local as KMR-5. The 1.4 changelog therefore says “MR-21 is unassigned”, and so does kahn’s shared/meta-rules.md:313. Assigning it now reuses no ratified ID (MR-8). After ratification, those two “unassigned” sentences become historical. The 1.4 changelog entry is left as written, and the 1.5 entry records the assignment.
Scope. The rule binds claims that a guard bites: mutation evidence, “this test catches X” statements in findings and decision docs, and gate verdicts that rest on a deliberately broken input. It does not require every repo to run mutation probes, and it does not mandate arno-host’s probe.mjs runner. The runner is one way to satisfy the rule, not the rule.

Not decided here: any audit implementation, and the eva-hq prose edit (see Consequences). This PR is doc-only.

Alternatives considered

Leave it arno-host-local, under a repo prefix (e.g. AMR-1). Rejected. FLIGHT ruled to promote. The failure mode, “red for the wrong reason reads as proof”, is stack-independent. Every repo that cites a red run as proof of a guard can repeat it.
Fold it into MR-20 as a sub-clause. Rejected for the reason MR-18 was not folded into MR-10. MR-20 governs what a passing check must assert. MR-21 governs what a failing run must show before it counts as evidence. Merging them would lose the difference between a green that saw nothing and a red that caught nothing.
Wait for a second repo to adopt the convention first. Rejected at the ruling. arno-host’s predecessor clock expired on 2026-11-15, and FLIGHT chose to promote rather than re-defer. The thin cross-repo evidence base is recorded in Context rather than left out.

Consequences

For code (follow-up PRs after countersign, not in this PR):

Authoring home is eva-hq. The following land in eva-hq first:
- prompts/_shared/petrova/META-RULES.md: MR-21 section, “twenty” → “twenty-one”, version 1.4 → 1.5, 1.5 changelog entry.
- partials/mr-preamble.xml: one headline line.
- schemas/progress.schema.json: the petrova_invariants_violated pattern widens to exactly MR-1..MR-21.
- tests/test_petrova_playbook_mr.py: already pins all three to the same contiguous set and needs no edit.
This repo’s mirror (core/playbook/) then follows through .github/workflows/sync-playbook-from-eva.yml. cli/tests/progress-schema.test.ts enforces the same contiguity here, so the mirror PR must carry the META-RULES, preamble and schema changes together.
host/src/sources/audit.ts. No ALL_MRS entry and no /console/governance column until someone writes an audit. A possible heuristic, warn only and not committed to here: flag a finding or decision doc that claims a guard “bites” or “catches”, cites an exit status, and names no test.

For consumers (vendoring):

Consumers get MR-21 only when petrova_install_playbook re-deposits the playbook. MR-17 checks that the playbook is present, not that it is current. arno-host’s two copies are at 1.3, which is already behind 1.4. arno-host’s re-deposit is step 3 of its route and is held open by that doc’s expires: 2026-12-15.
eva.consumption.v1 is unchanged. It carries no MR identifiers.

For in-flight phases:

arno-host: none. Its CLAUDE.md convention binds unchanged until the re-deposit, then cites MR-21.
Other consumers: claims made before ratification are not retro-audited.

For invariants:

Adds MR-21. No MR is modified or repealed.

References

arno-host: docs/decisions/2026-11-10-mutation-evidence-is-promoted-to-mr-21.md (FLIGHT’s ruling, the proposed wording and the route)
arno-host: docs/decisions/2026-08-15-the-checkable-half-of-mutation-evidence-is-mechanised.md (the mechanised checker and its refusals)
arno-host: docs/decisions/2026-08-15-a-rule-nobody-can-observe-being-broken-is-not-promoted.md (the observability bar)
arno-host: CLAUDE.md § Conventions (the convention’s text and the YAMLParseError incident)
This repo: docs/decisions/2026-10-02-meta-rule-change-gate-evidence-rules.md (MR-18..MR-20, and the conditional MR-21 that was never assigned)
eva-hq: prompts/_shared/petrova/META-RULES.md v1.4 (changelog: “MR-21 is unassigned”); eva-hq#94 (d6d54ee, the 1.4 change, used as the shape for 1.5)
Shape precedent: docs/decisions/2026-05-13-meta-rules-mr16-mr17.md

Sign-off

Subagent: Claude Opus 5.5, 2026-11-10 (drafted; petrova state read at 29f2bed4, eva-hq at 2f5f2c6)
Human countersign — that MR-21 joins META-RULES.md as worded above, under the number MR-21, and that the eva-hq 1.5 change may land — flight@arno.host, 2026-11-11 (jzero.run T1)