{"row":{"n":"0017","slug":"nep-0017-thin-laws-3b","file":"nep-0017-thin-laws-3b.md","headline":"The thin-laws (lot 3b): the pricing table in the pin · the end obligation · the third blame polarity · the named solo endorsement","title":"Four more small laws — the versioned pricing table rides the semantic pin, a failed run owes an attested quarantine, a normalization default is blamed on the contract that declares it, and a one-endorser action names its mode","status":"Draft","type":"Standards Track","created":"2026-07-29","author":"Thibaut Melen (SuperNovae Studio)","lede":"The second batch of laws too small for their own NEPs and too real to\nstay ambient — the continuation NEP-0014's Reference Implementation\nannounced.","sections":[{"title":"Abstract","anchor":"abstract"},{"title":"Motivation","anchor":"motivation"},{"title":"Specification","anchor":"specification"},{"title":"Rationale","anchor":"rationale"},{"title":"Backwards Compatibility","anchor":"backwards-compatibility"},{"title":"Reference Implementation","anchor":"reference-implementation"},{"title":"Copyright","anchor":"copyright"}],"words":996,"sha256":"1db2cf1f1f017ccbe6d2948a77de07441df515f4bbf451cf2d9a18faba3caae2"},"prev":{"n":"0016","slug":"nep-0016-provenance-tiers","file":"nep-0016-provenance-tiers.md","headline":"Provenance tiers: every registry artifact resolves with a measured tier, and the admission floor is operator data","title":"Provenance tiers — a closed ladder (`unprovenanced < provenanced < stage-clear < verified`) admitted by evidence only, an operator-owned admission floor, and the tier recorded at fetch and attested at the receipt","status":"Draft","type":"Standards Track","created":"2026-07-29","author":"Thibaut Melen (SuperNovae Studio)","lede":"Today the registry resolver proves two things — content integrity (the\npinned digest) and, for signed entries, origin (minisign under a\nTOFU-anchored publisher key) — but it speaks a bare boolean, lets no\noperator set an admission floor, and records nothing a receipt can\nattest.","sections":[{"title":"Abstract","anchor":"abstract"},{"title":"Motivation","anchor":"motivation"},{"title":"Specification","anchor":"specification"},{"title":"Rationale","anchor":"rationale"},{"title":"Backwards Compatibility","anchor":"backwards-compatibility"},{"title":"Reference Implementation","anchor":"reference-implementation"},{"title":"Deferred","anchor":"deferred"},{"title":"Rejected alternatives","anchor":"rejected-alternatives"},{"title":"Copyright","anchor":"copyright"}],"words":1236,"sha256":"70d585f99eb121dfbe64cb73de75a1986021f8cb7398865618a897002807bf17"},"next":{"n":"0018","slug":"nep-0018-energy-honesty","file":"nep-0018-energy-honesty.md","headline":"Energy honesty — the cost doctrine, transposed to watt-hours","title":"Extend cost honesty to energy: floors, ceilings, UNBOUNDED, and never a fabricated zero","status":"Draft","type":"Standards Track","created":"2026-07-29","author":"Thibaut Melen (SuperNovae Studio)","lede":"Give energy the exact doctrine cost already has: a static ENERGY reading\nbeside COST, speaking the same four words — floor · ceiling ·\nUNBOUNDED · unpriced — over the catalog's sourced watt-hour facts, with\nunknown stays unknown as the governing law (an energy Nika cannot prove\nis never rendered as 0 Wh, a local model is unpriced — your watts —\nnever « free »).","sections":[{"title":"Abstract","anchor":"abstract"},{"title":"Motivation","anchor":"motivation"},{"title":"Specification","anchor":"specification"},{"title":"Conformance test","anchor":"conformance-test"},{"title":"Compatibility impact","anchor":"compatibility-impact"},{"title":"Migration plan","anchor":"migration-plan"},{"title":"Rejected alternatives","anchor":"rejected-alternatives"}],"words":1414,"sha256":"06b456666c61922f8fb84284661e9567e54ecb33d42628666fddc953ae17edf3"},"total":18}

[{"k":"h","depth":1,"text":"NEP-0017 · The thin-laws (lot 3b): the pricing table in the pin · the end obligation · the third blame polarity · the named solo endorsement","id":"nep-0017--the-thin-laws-lot-3b-the-pricing-table-in-the-pin--the-end-obligation--the-third-blame-polarity--the-named-solo-endorsement"},{"k":"list","ordered":false,"items":[[{"k":"strong","text":"NEP"},{"k":"text","text":": 0017 (next free integer · 0001 reserved for the v1 surface · 0002 the trifecta gate · 0003 absent permits · 0004 the parameterization taint · 0005 the environment permit · 0006 the data-as-code sink · 0007 the trace and the equivalence oracle · 0008 the egress projection · 0009 the effective path identity · 0010 the run declaration · 0011 the run lifecycle · 0012 the receipt as untrusted input · 0013 the approval ticket · 0014 the thin-laws lot 3a · 0015 preview-commit · 0016 the provenance tiers)"}],[{"k":"strong","text":"Title"},{"k":"text","text":": Four more small laws — the versioned pricing table rides the semantic pin, a failed run owes an attested quarantine, a normalization default is blamed on the contract that declares it, and a one-endorser action names its mode"}],[{"k":"strong","text":"Author"},{"k":"text","text":": Thibaut Melen (SuperNovae Studio)"}],[{"k":"strong","text":"Status"},{"k":"text","text":": Draft"}],[{"k":"strong","text":"Type"},{"k":"text","text":": Standards Track"}],[{"k":"strong","text":"Created"},{"k":"text","text":": 2026-07-29"}]]},{"k":"h","depth":2,"text":"Abstract","id":"abstract"},{"k":"p","inline":[{"k":"text","text":"The second batch of laws too small for their own NEPs and too real to\nstay ambient — the continuation NEP-0014's Reference Implementation\nannounced. (1) The versioned pricing table that gives a cost its\nmeaning is part of the run's semantic pin. (2) A failed run owes an\nattested quarantine of its half-written outputs. (3) A default inserted\nby normalization that violates downstream is blamed on the contract\nthat declares it — a third blame polarity, « by the contract ».\n(4) An endorsement of exactly one endorser is a named mode with a fresh\nbound human authorization — never an implicit escape."}]},{"k":"h","depth":2,"text":"Motivation","id":"motivation"},{"k":"p","inline":[{"k":"text","text":"A cost verdict is only meaningful against the pricing table that\nproduced it: replay a run in 2031 against 2031 prices and the budget\nlaw speaks nonsense — the table must ride the pin or the replay is a\ndifferent run. A failed run leaves half-written outputs that today\nre-enter the next run's inputs silently: the teardown attestation\n(NEP-0011) proves the end "},{"k":"em","text":"happened"},{"k":"text","text":"; nothing yet says what the end\n"},{"k":"em","text":"owes"},{"k":"text","text":". A normalization default that violates a downstream rule is\nblamed on the caller who never wrote it: the blame vocabulary has\n« by the value » and « by the caller » and lacks the truthful third.\nAnd an endorsement gate that admits exactly one human is the approval\nsurface at its most fatigue-prone: the mode must be named, bound, and\nlogged — or it is a queue with one slot."}]},{"k":"h","depth":2,"text":"Specification","id":"specification"},{"k":"h","depth":3,"text":"Law 1 · The pricing table in the pin (F-P18)","id":"law-1--the-pricing-table-in-the-pin-f-p18"},{"k":"p","inline":[{"k":"text","text":"The versioned pricing table the cost bound (ρ) is computed against is\npart of the run's semantic pin. A replay reads cost against the PINNED\ntable — a run whose pin lacks the table, or names a table version the\nengine does not know, refuses the cost-meaning replay (the replay of\neffects is untouched; it is the "},{"k":"em","text":"budget verdict"},{"k":"text","text":" that requires the\ntable). A replay against the pinned table yields the identical budget\nverdict."}]},{"k":"h","depth":3,"text":"Law 2 · The end obligation (F-P14)","id":"law-2--the-end-obligation-f-p14"},{"k":"p","inline":[{"k":"text","text":"A run that fails after producing partially-written outputs owes an\n"},{"k":"strong","text":"attested quarantine"},{"k":"text","text":": the teardown seal (NEP-0011) names the\nhalf-written artifacts and marks them quarantined — a quarantined\nartifact re-entering as the input of a later run is a finding. The\ndistributed saga (compensation actions across services) is declared P2\nand out of v1: v1 owes the "},{"k":"em","text":"naming and the containment"},{"k":"text","text":", not the\nundoing."}]},{"k":"h","depth":3,"text":"Law 3 · The third blame polarity (F-P22)","id":"law-3--the-third-blame-polarity-f-p22"},{"k":"p","inline":[{"k":"text","text":"A default value inserted by normalization (the canon's declared\ndefaults) that participates in a downstream violation is imputed to\nthe contract that DECLARES the default — « by the contract » — naming\nthe declaring rule; neither « by the value » nor « by the caller »\nmay absorb it. The receipt and the check diagnostic speak the polarity."}]},{"k":"h","depth":3,"text":"Law 4 · The named solo endorsement (F-P23)","id":"law-4--the-named-solo-endorsement-f-p23"},{"k":"p","inline":[{"k":"text","text":"An endorsement surface admitting exactly one endorser is lawful only\nas the NAMED mode "},{"k":"code","text":"endorsement: solo"},{"k":"text","text":": one endorser, a fresh human\nauthorization BOUND to the action (the NEP-0013 ticket chain), logged\nas solo. One endorser without the declared mode is a refusal — F-F5\napplies with zero implicit escape: a quorum of one is a decision,\nnever a default."}]},{"k":"h","depth":2,"text":"Rationale","id":"rationale"},{"k":"list","ordered":false,"items":[[{"k":"strong","text":"Meaning rides the pin."},{"k":"text","text":" A digest of the plan without the table\nthat prices it is half an identity — the pin binds what the verdict\nwas computed AGAINST, not only what was computed."}],[{"k":"strong","text":"The end owes, not just happens."},{"k":"text","text":" NEP-0011 attested the teardown;\nthis law gives the teardown its first debt. Quarantine over undo:\nthe honest v1 debt is that the mess is named, contained, and never\nsilently re-consumed."}],[{"k":"strong","text":"Blame the declarer."},{"k":"text","text":" A mis-attributed default teaches the wrong\nrepair: the caller is told to fix a value they never wrote. The\nthird polarity makes the receipt teach the truth."}],[{"k":"strong","text":"A mode named over a mode slipped into."},{"k":"text","text":" The solo case is the\ndangerous case (NEP-0013's fatigue class); naming it binds it to the\nticket chain instead of letting it pass as the absence of a quorum."}]]},{"k":"h","depth":2,"text":"Backwards Compatibility","id":"backwards-compatibility"},{"k":"p","inline":[{"k":"text","text":"Law 1 refuses only cost-meaning replays of runs pinned before the\ntable existed — they replay their effects and lose the budget verdict,\nstated plainly. Law 2 adds findings where half-written outputs were\nsilently re-consumed (always a bug). Law 3 changes diagnostics, never\nverdicts. Law 4 refuses the undeclared solo surface — no green\nworkflow carried one (the endorsement surface ships with this law)."}]},{"k":"h","depth":2,"text":"Reference Implementation","id":"reference-implementation"},{"k":"list","ordered":false,"items":[[{"k":"text","text":"The engine lane ("},{"k":"code","text":"feat/lot3b-thin-laws"},{"k":"text","text":"): the pricing-table pin and\nits replay gate · the quarantine section of the teardown seal and\nthe re-entry finding · the blame polarity in the check diagnostic and\nthe receipt · the "},{"k":"code","text":"endorsement: solo"},{"k":"text","text":" mode with its bound ticket —\neach with its fixture pair."}]]},{"k":"h","depth":2,"text":"Copyright","id":"copyright"},{"k":"p","inline":[{"k":"text","text":"This document is placed in the public domain under CC0-1.0, as every NEP."}]}]

NEP-0017

The thin-laws (lot 3b): the pricing table in the pin · the end obligation · the third blame polarity · the named solo endorsement

Draft · Standards Track · opened 2026-07-29 · 996 words

NEP-0017 · The thin-laws (lot 3b): the pricing table in the pin · the end obligation · the third blame polarity · the named solo endorsement #

NEP: 0017 (next free integer · 0001 reserved for the v1 surface · 0002 the trifecta gate · 0003 absent permits · 0004 the parameterization taint · 0005 the environment permit · 0006 the data-as-code sink · 0007 the trace and the equivalence oracle · 0008 the egress projection · 0009 the effective path identity · 0010 the run declaration · 0011 the run lifecycle · 0012 the receipt as untrusted input · 0013 the approval ticket · 0014 the thin-laws lot 3a · 0015 preview-commit · 0016 the provenance tiers)
Title: Four more small laws — the versioned pricing table rides the semantic pin, a failed run owes an attested quarantine, a normalization default is blamed on the contract that declares it, and a one-endorser action names its mode
Author: Thibaut Melen (SuperNovae Studio)
Status: Draft
Type: Standards Track
Created: 2026-07-29

Abstract #

The second batch of laws too small for their own NEPs and too real to stay ambient — the continuation NEP-0014's Reference Implementation announced. (1) The versioned pricing table that gives a cost its meaning is part of the run's semantic pin. (2) A failed run owes an attested quarantine of its half-written outputs. (3) A default inserted by normalization that violates downstream is blamed on the contract that declares it — a third blame polarity, « by the contract ». (4) An endorsement of exactly one endorser is a named mode with a fresh bound human authorization — never an implicit escape.

Motivation #

A cost verdict is only meaningful against the pricing table that produced it: replay a run in 2031 against 2031 prices and the budget law speaks nonsense — the table must ride the pin or the replay is a different run. A failed run leaves half-written outputs that today re-enter the next run's inputs silently: the teardown attestation (NEP-0011) proves the end happened; nothing yet says what the end owes. A normalization default that violates a downstream rule is blamed on the caller who never wrote it: the blame vocabulary has « by the value » and « by the caller » and lacks the truthful third. And an endorsement gate that admits exactly one human is the approval surface at its most fatigue-prone: the mode must be named, bound, and logged — or it is a queue with one slot.

Specification #

Law 1 · The pricing table in the pin (F-P18) #

The versioned pricing table the cost bound (ρ) is computed against is part of the run's semantic pin. A replay reads cost against the PINNED table — a run whose pin lacks the table, or names a table version the engine does not know, refuses the cost-meaning replay (the replay of effects is untouched; it is the budget verdict that requires the table). A replay against the pinned table yields the identical budget verdict.

Law 2 · The end obligation (F-P14) #

A run that fails after producing partially-written outputs owes an attested quarantine: the teardown seal (NEP-0011) names the half-written artifacts and marks them quarantined — a quarantined artifact re-entering as the input of a later run is a finding. The distributed saga (compensation actions across services) is declared P2 and out of v1: v1 owes the naming and the containment, not the undoing.

Law 3 · The third blame polarity (F-P22) #

A default value inserted by normalization (the canon's declared defaults) that participates in a downstream violation is imputed to the contract that DECLARES the default — « by the contract » — naming the declaring rule; neither « by the value » nor « by the caller » may absorb it. The receipt and the check diagnostic speak the polarity.

Law 4 · The named solo endorsement (F-P23) #

An endorsement surface admitting exactly one endorser is lawful only as the NAMED mode endorsement: solo: one endorser, a fresh human authorization BOUND to the action (the NEP-0013 ticket chain), logged as solo. One endorser without the declared mode is a refusal — F-F5 applies with zero implicit escape: a quorum of one is a decision, never a default.

Rationale #

Meaning rides the pin. A digest of the plan without the table that prices it is half an identity — the pin binds what the verdict was computed AGAINST, not only what was computed.
The end owes, not just happens. NEP-0011 attested the teardown; this law gives the teardown its first debt. Quarantine over undo: the honest v1 debt is that the mess is named, contained, and never silently re-consumed.
Blame the declarer. A mis-attributed default teaches the wrong repair: the caller is told to fix a value they never wrote. The third polarity makes the receipt teach the truth.
A mode named over a mode slipped into. The solo case is the dangerous case (NEP-0013's fatigue class); naming it binds it to the ticket chain instead of letting it pass as the absence of a quorum.

Backwards Compatibility #

Law 1 refuses only cost-meaning replays of runs pinned before the table existed — they replay their effects and lose the budget verdict, stated plainly. Law 2 adds findings where half-written outputs were silently re-consumed (always a bug). Law 3 changes diagnostics, never verdicts. Law 4 refuses the undeclared solo surface — no green workflow carried one (the endorsement surface ships with this law).

Reference Implementation #

The engine lane (feat/lot3b-thin-laws): the pricing-table pin and its replay gate · the quarantine section of the teardown seal and the re-entry finding · the blame polarity in the check diagnostic and the receipt · the endorsement: solo mode with its bound ticket — each with its fixture pair.

Copyright #

This document is placed in the public domain under CC0-1.0, as every NEP.

This proposal in the spec repo The specification it amends