# Plan 073: Cradle Platform Constitution — Jarvis as Agent Kind

> **Type:** Constitution / direction (not an implementation plan).  
> **Executor instructions:** Do **not** implement from this document. Human decision first. Related: Plan 061 (cognition stack), Plan 062 (Claude projection / IRON LAW).

## Plan status

- **Priority:** P0 (direction)
- **Effort:** — (decision artifact)
- **Risk:** HIGH if ignored; LOW as prose alone
- **Depends on:** Conceptual continuity with 061, 062; not blocked on implementation
- **Category:** direction, agent-design, platform-constitution
- **Planned at:** 2026-08-02
- **Status:** FINAL — awaiting human accept / amend / reject

---

# Cradle Platform Constitution — Jarvis as Agent Kind

**Status:** Final — for human decision  
**Date:** 2026-08-02  
**Role:** Finalizer Agent J (Critique-Chain)  
**Inputs obeyed:** Synthesizer G (base), Critic H (mandatory edits + no-add-backs), Auditor I (reality corrections)  
**Hard bans honored:** no implementation, APIs, schemas, tool inventories, Function taxonomies, Jarvis internals, sprint phases, moat rhetoric, Ultron fanfic, Coding Kind productization, second-scheduler designs.

This document is self-contained. A decision-maker need not have read the prior chain. It does not claim that prior agents “agreed.”

---

## Preamble

Cradle wants a Jarvis-like presence: a continuous stewardship identity that can steward the platform and beyond, across heterogeneous coding workers. The user constraint is absolute: **Jarvis is not one agent. Jarvis is a kind of agent** — an Agent Kind — many capabilities, one durable stewardship identity under human authority.

This constitution exists to do three things at once:

1. **Iron honesty** — Cradle never steals native turn/session scheduling and never narrates fake completion.  
2. **Stewardship that takes weight** — a solo builder can leave the plane for hours, return, and know what was proposed, what ran under grant, what is blocked, and what still needs them — without chat archaeology.  
3. **Human-owned radius** — defaults stay propose-first; act rights grow only by visible, revocable grant.

Prior agents successfully defended Cradle against magic orchestration and clone categories. That defense stands. Law-compliance without labor taken off the human’s shoulders is not a Kind.

Claims that failed critique are killed in the Decision log. Tensions that cannot be honestly closed stay open. Fake consensus is not cited as agreement.

**Binding leave/return promise:**  
*I can leave the plane for hours, return, and know what was proposed, what was done under grant, what is blocked, and what still needs me — without replaying chat archaeology.*

Partial return-from-absence fragments already exist (Session Await, completed-run notifications, Automation triage, runtime waiting states). The promise is not inventing a blank UI. Kind succeeds only if it outdoes those fragments as a plane-wide steward under grant — not if those fragments are ignored.

If that promise is not true in use within a multi-year horizon, this constitution failed for Cradle’s likely power user — even if every scheduling audit passes.

---

## Identity — what Cradle is

**Cradle is the sovereign local control plane for heterogeneous agent labor — and the durable host of a platform Kind that stewards that plane under human authority.**

Unpack:

- **Local control plane, not chat shell.** Work is named, delegated, awaited, observed, and bounded across native runtimes the user already trusts. Projection stays honest.  
- **Heterogeneous labor, one home.** Coding workers remain specialists. They are not “the platform.”  
- **Present inventory is real.** Cradle today already has Work, Issue Agent (+ Agent Interaction Runtime), Automation, Session Await, Thread Handoff, Chat Runtime fact/projection machinery, provider-native threads/crews, and HiJarvis ambient. It is not a bare session multiplexer.  
- **What is missing** is a first-class narrow platform Kind: continuous steward identity, Kind-scoped grant policy, and plane-wide propose (and granted act) under human authority. Without that Kind — *if* steward demand holds — Cradle risks remaining a multi-runtime home and work board without a steward of *platform* cognition.  
- **Sovereignty is brand constraint.** Privacy-first desktop control and human final authority are why a platform Kind is tolerable. A cloud Operator that quietly owns scheduling and write-power is a different product.

One-line constitution:

> Humans rule; the platform Kind stewards; coding workers execute; Cradle tells the truth about all three.

### Live “Jarvis” vocabulary (standing disambiguation)

None of the following is Agent Kind:

| Live term | What it is |
|---|---|
| Catalog `surfaces: chat \| jarvis` | Placement — where a runtime may be offered |
| `jar-core` / System Agent / HiJarvis ambient | Ambient personal runtime + UI (observe, preferences, popover, history) |
| `runtimeKind` / provider kind / runtime catalog ids | Runtime/provider catalog concepts |

**Jarvis-brand ≠ Kind.** `runtimeKind` ≠ Kind. Catalog `surface` ≠ constitutional “surface” (grant/sovereignty surface). Brand and placement must never mint act authority (Law 10).

---

## Species — what Agent Kind means (strategic, not schema)

“Kind” is **not** a schema, a persona skin, a catalog placement (`chat` vs `jarvis`), a model picker, a single immortal session, HiJarvis ambient mood, or `runtimeKind`.

Strategically, a **Kind** is a durable role-class of agent with four co-requisites:

| Co-requisite | Meaning |
|---|---|
| **Continuous stewardship identity** | Continuity of *care for the plane* across many capabilities and many execution episodes — not immortality of one chat thread, and not proof-by-tool-count. |
| **Authority boundary** | What the kind may observe, propose, delegate, and (only under grant) act on — distinct from coding workers’ blast radius. |
| **Memory scope** | Continuity that belongs to the kind’s stewardship (standing rules, open cares, past escalations) — not random thread amnesia, not ambient sludge, not Chronicle/Recall/harness by slogan. |
| **Initiative policy** | When the kind may speak unbidden, propose, or act — default conservative; escalations and grants explicit. |

**Coding workers** = specialists that perform bounded execution under honest handoff. Their continuity is task/work continuity, not platform identity. (Constitution class label — not a live catalog entity.)

**Platform Kind (Jarvis-species)** = steward of the control plane: maintain situation picture, issue honest mandates with receipts, propose what needs the human, act only inside grants, escalate when uncertain. Many capabilities; one continuous stewardship identity — as *role continuity*, not as one-agent collapse.

### Narrow Kind object (settled)

This constitution adopts a **narrow Kind**, not an elevated monopoly operator.

**Kind means:** identity, trust envelope, memory scope, initiative policy, and mandate/receipt participation.

**Kind does not mean:** a platform process that sequences other agents’ turns; the exclusive agency allowed to sense/propose/act across the plane; a second scheduler; or Cradle’s nervous system for every worker’s next action.

Humans, CLI, Work, Automation, Issue Agent, and Session Await already act, delegate, and wait across the plane. Coding workers act within delegated scope without per-step Kind permission. Kind is an **elevated steward role**, not an exclusive agency monopoly. Language that said “only organism,” “operate the plane,” or monopoly operator is dead (Decision log).

### Species ≠ one mega-agent (settled identity-collapse ban)

Saying “Kind” while describing one immortal steward mind with many tools is the core cheat.

**Settled bans (identity collapse):**

- Kind must not be identical to one chat, one session, or one persona costume.  
- Kind must not be implemented as Cradle-stitched UI runs across native result boundaries.  
- Kind must not be satisfied by a reading where “many tools + one memory + one strategic will” is sufficient proof of Kind.  
- Continuity of stewardship is proven by recognition across days (standing rules + open cares), not by tool breadth or MCU metaphor.

**Left open (Open tensions):** how many *execution minds* realize the Kind underneath. The constitution forbids identity collapse; it does not decree plurality-of-minds anatomy.

### What does not count as Kind (insufficient alone)

- Catalog placement `jarvis`  
- Ambient observe-only surface (HiJarvis)  
- Agent Identity persona costume  
- A single immortal chat named Jarvis  
- Laws with no steward loop (sense → propose → optional act → escalate)  
- A Work board row where Jarvis is “another assignee”  
- Preferences / session permission dials without Kind-scoped act grants  

**Minimum sentence a power user can hold:**  
*Jarvis is the steward that keeps my platform picture honest, proposes what needs me, acts only where I’ve granted, and never puppets my coding tools’ minds.*

### Proto-stewards already exist (relationship open; existence not)

Kind does not enter an empty field. Minimum named live assets:

| Asset | Relevance |
|---|---|
| **Issue Agent** (+ Agent Interaction Runtime) | Strongest proto-delegate / continuation path |
| **Automation** | Durable definitions, schedule, triage — proto sense→act clerk |
| **Session Await** | Durable external waits; partial leave/return answer |
| **Thread Handoff** | Provider-to-provider transfer with provenance |
| **HiJarvis ambient** | Observe half of observe→propose; not Kind |

Absorb / command / peer / replace remains open. Existence does not.

---

## Sovereignty stack — human / platform kind / coding workers

```text
Human sovereignty
    ↓ grants / revokes
Platform Kind (steward — narrow)
    ↓ mandates with receipts (not per-step permission)
Coding workers (execute under local competence)
    ↓ project events honestly
Cradle control plane (truth + bounds + work ledger)
```

### Human

- Final authority on goals, trust grants, autonomy ceilings, and irreversible acts.  
- Author of policy; not required online for every micro-decision — **but never silently displaced.**  
- Offline action may occur only inside grants already given and still revocable.  
- Owns the namespace: Cradle writes within Cradle; Kind does not rewrite the human’s sovereignty story for “coherence.”  
- Product-owning humans declare when falsifiers have triggered; the constitution does not self-execute.

### Platform Kind (Jarvis)

- Steward of the *platform*, not peer coder and not shadow CEO.  
- Job: situation awareness across work and execution; honest delegation; propose as default active voice; act only under grant; escalate when policy or uncertainty demands.  
- Must never become Cradle’s excuse to own native turn/session scheduling.  
- Must take real **platform cognition** labor off the human’s shoulders: situation, propose, granted act, escalate. A Kind that only narrates while the human still discovers, routes, unblocks, and re-explains the plane is not a Kind.

### Coding workers

- Execution specialists under receipts. Labor, not constitution.  
- Act within honest mandate without per-step Kind/Cradle permission (local competence).  
- Must not be asked to “also be Jarvis.” That collapses kinds into the one-god-agent failure the user forbade.

### Split that prevents Ultron / mascot misread

**Kind takes platform cognition labor** (situation picture, propose, granted act, escalate). **Coding workers keep local execution competence** (Law 4). Stewardship is not a permission bottleneck for native micro-steps.

### Power geometry note

Cradle is the floor of truth and bounds — not Kind’s subordinate nervous system, and not Kind’s puppet. Kind sits under human grant and above workers as *mandate issuer / situation steward*, not as micro-approver of native actions. Chat Runtime’s fact log and run projection already own execution truth-of-record for runs; Kind must not invent a second truth owner that shadows that for runs.

---

## Constitutional laws — few, numbered, falsifiable in principle

Numbered **Law 1…Law 14** to avoid collision with Plan 061’s cognition stack layers (Stack L1 Evidence … Stack L5 Orchestration). Never use bare “L5” for both.

Each law is stated so a future auditor could, in principle, construct a falsifying scenario without needing a particular API.

**Law 1 — Projection, never schedule ownership.**  
Cradle may observe, record, project, and surface native runtime events. Cradle may not own turn coalescing, result boundaries, interrupt/still-queued semantics, or any peer-native equivalent.  
*Falsifier:* A native worker continues cognitive work under a Cradle-invented turn/run identity the native substrate did not schedule.

**Law 2 — No synthetic continuation of the same native work.**  
Empty, early, or ambiguous native completion must not cause Cradle to close a user-originated projection and reopen a system-origin projection to “keep going.” Continuity of native work belongs to the native substrate.  

*Forbidden pattern (named):* empty/early native completion → close/clear active user projection → open system-origin projection to continue the **same** native cognition.  

*Not forbidden by this law alone:* provider-owned goalContinuation system runs, provider-synthetic event runs, ordinary queue drain, or other legitimate `origin: system` runs that do not invent continuity for the same native work after clearing the user projection.  
*Falsifier:* The forbidden pattern occurs for Kind continuity demos or any native substrate.

**Law 3 — Kind is identity-of-purpose, not a second scheduler.**  
A Kind may name durable role, trust envelope, memory scope, and allowed initiative. It must not sequence other agents’ turns as a platform process.  
*Falsifier:* Workers routinely block on “Kind said proceed” before each native action their own substrate could already take.

**Law 4 — Local competence over central permission.**  
A worker honestly delegated work acts within scope without per-step permission from Cradle or Kind. Structural mandate/receipt collection is allowed; semantic micro-management is not.  
*Falsifier:* The modal worker loop is ask-control-plane → wait → act → report → ask again for the next micro-step.

**Law 5 — External state is shadow, not substance.**  
Platform stores (runs, queue, work graph, chronicle, situation pictures) are projections for humans, audit, and inter-agent *results*. They are never the live cognitive state of a model worker. Resuming from platform state creates a new context — not a resumed mind.  
*Falsifier:* Product or Kind policy claims “we restored the agent” solely by reinjecting platform snapshots, treating discontinuities as worker bugs rather than expected reconstruction loss.

**Law 6 — Silence is not death; absence is not authority.**  
Non-observation alone must not trigger automatic replacement, retry, or reassignment. Only explicit outcomes, receipts, or human/Kind decisions may change work ownership.  
*Falsifier:* Timeout or quiet period alone causes Cradle to kill/replace a worker or reassign its mandate.

**Law 7 — Honest outcomes over comforting narratives.**  
Composed mutations with external effects must yield explicit outcomes. Worker self-reports remain labeled as worker reports, not platform-verified truth. The situation picture may be incomplete; it may not lie about completeness. Incomplete situation must still be actionable: name what is missing and what decision, grant, or action it blocks for the human.  
*Falsifier:* UI or Kind narrative presents “done/verified” when only a worker claim or partial projection exists; or incompleteness is shown without naming what is missing *and* what decision/grant/action it blocks for the human.

**Law 8 — Ownership namespaces bind Kind power.**  
Read across, write within. A Kind may propose or act only inside namespaces it owns or has been explicitly granted. Cross-namespace writes require the owning feature’s consent semantics — not Kind convenience.  
*Falsifier:* Platform Kind freely mutates another feature’s lifecycle data because “stewardship needs it.”

**Law 9 — Strategy with Kind and human; platform owns truthfulness.**  
Decomposition of work into mandates, recovery choices, and “what next” for the plane are chosen by Kind and/or human. Cradle owns durable truth of what was asked, accepted, observed, and receipted. Cradle does not auto-choose worker placement/strategy and present it as Kind intention.  

Kind strategy is mandate-level stewardship and escalation — not classical fleet micro-orchestration wearing a Kind badge. If exercising strategy appears to require schedule ownership, redesign (Law 12).  
*Falsifier:* Cradle auto-chooses worker strategy and presents it as Kind intention; **or** workers’ next native actions routinely await Kind semantic go-ahead beyond the initial mandate and receipt (Kind strategy has collapsed into micro-orchestration).

**Law 10 — Initiative is gated policy, never ambient privilege.**  
Default Kind posture is propose (and observe). Act only under explicit, revocable, Kind-scoped grant. Ambient surfaces and catalog labels must not inherit platform-act authority by brand. When uncertain whether an action is propose or act, it is propose.  
*Falsifier:* Catalog placement `jarvis` or ambient personal surface mutates platform work without a named initiative grant.

**Law 11 — Heterogeneous natives remain first-class.**  
Claude, Codex, Kimi, OpenCode, ACP, plugins, and future substrates keep their own scheduling authority. The Kind layer must not homogenize them into Cradle-turns. IRON LAW binds every native substrate and the Kind concept — not Claude-only folklore. Chat Runtime already projects across providers; what Kind still forbids is any Kind-justified *exception* that reintroduces schedule ownership on any native.  
*Falsifier:* Supporting a new provider requires teaching Cradle to “drive” that provider’s turn machine rather than project it; or Kind continuity is justified by an IRON LAW “exception.”

**Law 12 — Prefer deleting wrong seams over adding ownership.**  
If making Kind work appears to require Cradle to own native lifecycle again, stop and redesign — not a compatibility shim.  
*Falsifier:* A Kind feature lands whose correctness depends on Cradle interpreting native scheduling as Cradle turns.

**Law 13 — Stewardship must take weight (human-labor law).**  
A Kind that only narrates while the human still discovers, routes, unblocks, and re-explains the plane has failed as Kind — even if Laws 1–12 hold. Propose (and granted act) must displace real platform cognition labor. This law’s primary human falsifier is the leave/return promise in the Preamble.  
*Falsifier (any of):*  
(a) After hours away, the human still cannot answer proposed / granted-done / blocked / needs-me without chat archaeology.  
(b) Unbidden useful propose with platform scope never appears in real solo use.  
(c) The human remains sole discoverer/router/unblocker of plane state while Kind only narrates.

**Law 14 — Grants are a first-class sovereignty surface.**  
Widening autonomy is legitimate, visible, scoped, and revocable. The constitution’s default is propose-only; that default is not a permanent ceiling on ambition. Revoking Kind act rights must not require abandoning coding workers or burning the work graph.  
*Falsifier:* Act grants exist as a human-recallable surface but never attach to any material Kind act the human can name — or widening requires abandoning propose-default so completely that the default is fiction; **or** act rights expand silently without human-recallable grant; **or** revoking Kind hands disables the user’s workers.

---

## Settled super-choices — with surviving rationale after critique

### Choice A — Species first-class?

**Settled: Yes — as a narrow constitutional Kind.**

Jarvis is a first-class Agent Kind — not a chat upgrade, not HiJarvis 2.0, not a catalog badge, not “another assignee,” not `runtimeKind`.

**Settled against mega-agent cheat:** Kind continuity is *role/stewardship continuity*. It must not be satisfied by one chat/session/persona, **or** by treating “many tools + one memory + one strategic will” as sufficient proof of Kind. Execution-mind cardinality stays open; identity collapse does not.

**Rejected:** “Only organism allowed to sense/propose/act across the plane.” Dead — contradicts local competence, live orchestration-layer reality (Plan 061 Stack L5 is today mostly human/CLI-driven via Work/Issue/Queue/Automation/Session Await), and the user’s “not one agent” constraint.

**Rejected as present fact:** “Co-equal to Coding Kind.” Coding Kind does not exist as product reality. Platform Kind may later share *kind-status* with a real Coding Kind boundary; it must not claim a parallel that is currently a ghost. Anti-goal: no zoo of kinds before Platform Kind’s felt loop is real — Coding Kind boundary is future work, not a present precondition.

**Rationale that survives:** Without Kind-level identity, authority, memory, and initiative, every “Jarvis” feature decays into another session with a nicer name. Competitors win on teammates, Operator workplaces, or meta-harness while Cradle’s steward slot stays empty — *if* demand for a steward exists (still unproven; see Open tensions).

### Choice B — Build order?

**Settled: Control-plane honesty and work-plane durability before expanding *act* power — but not before a felt propose loop.**

**Honesty gate (falsifiable in principle, qualitative and brutal):**  
Kind *act* power may not widen until:

1. The situation picture can show incomplete vs verified without laundering worker claims into “done.”  
2. Delegate → asked / accepted / claimed / verified (or explicitly unverified) is auditable by a human without chat archaeology.  
3. No synthetic continuation path (Law 2 forbidden pattern) is required for Kind continuity demos.

**Parallel allowance:** A useful propose loop may ship on a *partially incomplete but labeled* picture. Propose-on-incomplete is allowed. Act-on-lies is not.  

**Qualitative brake:** Kind propose that systematically cannot point at tower-visible evidence is forbidden as Kind voice — not a completeness religion; a ban on persuasive noise.

**Rejected reading:** Years of silence with no steward voice until perfection.  
**Rejected reading:** Demo pressure overrides the honesty gate.

### Choice C — Product center of gravity?

**Settled: Dual-center with named roles — not slogan fog.**

| Noun | Role |
|---|---|
| **Work / Issue (work graph)** | Durable obligation ledger — mandates, receipts, blockers, handoffs that outlive sessions, sleep, and provider churn. Work *already* is a durable center for **coding delivery**; it is not yet a general platform-steward obligation ledger. |
| **Session / Run / Queue** | Execution carrier — where native cognition runs and where IRON LAW binds. Not fiction; not the unit of *platform meaning*. |
| **Situation surface (“control tower” as metaphor)** | Human-facing situation view over both — “what’s in flight, stuck, awaiting me, unverified.” Not a live module name; constitutional metaphor only. |

**Rejected:** “Work is *the* center” if that demotes Session to second-class fiction.  
**Rejected:** Session/Chat as the only real noun of platform meaning.  
**Rejected:** Pure Issue-board-as-HR (Jarvis becomes assignee).

**Lived gravity stays open:** Users may still dwell in Session for years. That is not shamed. Dual-center fails if Work never becomes where they look when they ask “what did I leave running?” — without crowning Work as sole religion.

### Choice D — Orchestration ceiling?

**Settled: Platform supplies honest delegation semantics + truth of record + policy fences. Strategy stays with Kind and/or human. No default legion. No Cradle-as-scheduler.**

| | Honest situation surface | Magic orchestrator |
|---|---|---|
| Job | Make work, delegation, receipts, and risk *legible* | Decide what everyone should do next |
| Authority | Truth of record; policy fences; blast-radius envelopes | Semantic micro-strategy; step approval; turn ownership |
| Success | Human/Kind can answer: who has what mandate, what was observed, what is unverified | “It just handles it” — until it can’t and no one can see why |

**Rejected:** Meta-harness ownership of native turns.  
**Rejected:** Default legion / platform-directed multi-worker campaigns. Legion may exist later only as explicit Kind/human-chosen mode through honest delegate→receipt — never as constitutional default.  
**Narrowed:** Kind “strategy” fails when workers’ next native actions routinely await Kind go-ahead beyond initial mandate/receipt (Law 9).

### Choice E — Initiative red line?

**Settled: Default propose-before-act; observe alone is insufficient as the *resting product*; act only by explicit revocable grant; when uncertain → propose.**

Conceptual ladder (not an API):

1. **Observe** — necessary, insufficient alone (ambient without propose is dead as Kind). HiJarvis already covers much of observe.  
2. **Propose** — default active voice of the Kind; must reduce cognitive load and point at tower-visible evidence.  
3. **Act within grant** — only under explicit, scoped, revocable policy.  
4. **Escalate** — when uncertainty, blast radius, or conflict exceeds grant.

**Settled addendum:** Grants are a first-class power-user surface, not a footnote. The red line is the default, not a ban on earned radius.

**Living sovereignty risks (not solved comforts):** how fast grants become the lived default, and offline proposal buffering vs time-bounded grants, remain under watch (see Open tensions T4, T14). Principle: offline only inside prior grants; never silently displaced.

---

## Open tensions — only truly open

| ID | Tension | Why it stays open |
|----|---------|-------------------|
| T1 | Continuous stewardship identity vs substrate-sovereign discontinuous turns | Kind wants continuity; natives emit awkward results. Illegal resolution = Law 2 forbidden pattern. Legal resolution = mandate/memory continuity *above* projection — always slightly unsatisfying. |
| T2 | Unified situation picture vs anti-central-brain | One picture looks like one pilot. Tower needs the picture; Kind must not become RPC dispatcher. |
| T3 | Work ledger vs Session as lived dwelling | Dual-center is constitutional; daily primary noun may skew Session for years. |
| T4 | Kind power vs propose-default; grant-expansion speed | Useful Kind lives in discomfort. Grant expansion speed is a living sovereignty risk. |
| T5 | Honest incompleteness vs user trust | Honesty can look like incompetence; lying looks like magic until the crash. Incomplete must be actionable. |
| T6 | Local competence vs cross-plane coherence | Coherence from shared mandates and receipts — not per-step central control. |
| T7 | Heterogeneous projection vs one Kind experience | One stewardship identity over many schedulers will feel uneven. Homogenization is the unconstitutional shortcut. |
| T8 | Growth pressure vs orchestration ceiling | Raising the ceiling requires explicit constitution change — not feature creep. |
| T9 | Cardinality of platform-Kind instances | Per human / workspace / domain of care? Continuity identity does not uniquely determine cardinality. **No silent default cardinality by implementation convenience** — cardinality choice is a later constitutional beat. |
| T10 | Steward demand at scale | Competitive evidence supports teammates *and* steward bets. Cradle’s slot assumes steward demand among sovereignty-seeking users — unproven. |
| T11 | Legion mode eventual necessity | Maybe never. Not a year-one commitment. |
| T12 | Provider-native crews vs Kind strategy | Strategy already can live inside provider threads (live bypass path). How much before Kind is spectator — needs evidence. |
| T13 | Memory seam vs Chronicle / Recall / harness ownership | Kind continuity must not be snapshot-restoration theater, ambient sludge, harness push, Recall-by-default, or a second run fact log. Exact seam later — Plan 061 stack binds vocabulary; seam design stays open. |
| T14 | Offline human + propose-default | Principle: never silently displaced; offline act only inside prior grants. Buffering vs time-bounded grants — mechanism open. |
| T15 | Relationship to existing proto-stewards | Issue Agent, Automation, Thread Handoff, Session Await, HiJarvis — absorb / command / peer / replace? Existence named; relationship not frozen. |
| T16 | HiJarvis ambient fate | Settled: ambient ≠ Kind. Open: view of Kind, sibling surface, or sunset. |
| T17 | Multi-human / team sovereignty | Desktop-first thesis assumes one human’s namespace. Shared workspaces and conflicting grants are a different product shape. |
| T18 | Outer fence for “beyond the app” | Ambition without outer scope invites cancer. Exact fence not yet evidence-based; must not stay forever undefined (gap register). Do not invent a fence here. |
| T19 | Execution-mind cardinality under Kind | Forbidden: identity collapse (chat/session/persona / “many tools + one strategic will” as proof). Open: how many execution minds realize the Kind. |

**Closed (not open):** mega-agent cheat as acceptable reading of Kind. Identity-collapse bans are settled; only execution cardinality remains open under T19.

---

## Anti-goals

Cradle **will not** become or pursue:

1. **A Jarvis-branded chat agent** — one immortal thread with a personality.  
2. **A second native scheduler** — close/clear user runs and invent system continuity to finish “the same work” (Law 2 forbidden pattern). IRON LAW is constitutional.  
3. **Cloud Operator SaaS that owns the user’s agents.**  
4. **Teammates-only board with no steward.**  
5. **Flat teammate absorption of Kind** — Jarvis as another assignee row.  
6. **Meta-harness cosplay** — orchestrate all harnesses without honest receipts and without respecting native scheduling.  
7. **HiJarvis inflation** — ambient personal surface promoted to Kind by branding alone.  
8. **Unaccountable CEO fantasy** — broad act, vague memory, no receipts; “manages the whole app and beyond” without initiative classes.  
9. **Mascot Kind** — laws pass; human still clicks everything; Jarvis only narrates.  
10. **Kind-as-central-brain** — micro-approves worker steps; workers become RPCs with context windows.  
11. **Homogenizing natives into Cradle-turns.**  
12. **Treating platform stores as resumable minds.**  
13. **Automatic retry/replacement on silence.**  
14. **Default legion / always-on multi-agent fan-out.**  
15. **Magic completeness** — upgrading worker reports into verified truth without evidence.  
16. **Compatibility shims that reintroduce schedule ownership “temporarily” for Kind.**  
17. **Kind zoo before Platform Kind’s felt loop is real.** Coding Kind boundary is future kind-status work — not a present parallel and not a blocker for Platform Kind.  
18. **Structural-moat marketing** on unbuilt legs — silence + constitutional build beats loud clone behavior.  
19. **Honesty perfection forever delaying any useful propose loop.**  
20. **Jarvis internal Function maps / MCP laundry lists / guts phasing as a substitute for these laws.**  
21. **Conquest / “rule the field” rhetoric** while Kind labor-relief is unbuilt — refuse. Niche monastery beat ≠ empire.

---

## Gap register — ranked by what blocks Kind from being real

Ranked by whether a human can experience “Jarvis is a Kind” as true. Honest about fragments that already exist. Prior rankings are reconciled, not averaged.

| Rank | Gap | Why it blocks Kind from being real |
|---|---|---|
| 1 | **No Kind-scoped plane-wide propose loop** — session/domain needs-you signals exist (Await resume, Automation triage, completed-run notifications, waiting-for-input/approval statuses); nothing is a steward that proposes across the plane | Without sense→propose as Kind, human remains sole platform steward; Kind is vocabulary (Law 13). |
| 2 | **No unified, honesty-labeled situation picture for stewardship** — partial pictures exist (Session Environment, Work/PR projection, Automation runs, Await summaries, Chat Runtime status); plane-wide steward view with incomplete-vs-verified labeling does not | Cannot delegate stewardship if one cannot see; incomplete must still be actionable (Law 7). |
| 3 | **No honest Kind-level delegate → receipt as platform semantics** — handoff/receipt-like objects exist in Issue delegation, Await matches, Work submit/PR, Automation findings; they are not Kind stewardship semantics | Stewardship without auditable trail is theater; humans cannot sleep on unverifiable “I think it finished.” |
| 4 | **IRON LAW as Kind product law across every native still incomplete** — Claude-scoped named Iron Law + multi-provider Chat Runtime projection architecture exist; what Kind still lacks is product-law extension that forbids Kind-justified exceptions on any native | User-visible fear: native weirdness / puppeteering still feels plausible; schedule theft kills sovereignty brand and Kind honesty (Laws 1/2/11). |
| 5 | **No Kind-scoped grant / blast-radius dial** — System Agent preferences and session permission/access settings exist; they are not Kind platform-act grants | Sovereignty has no Kind control surface → mascot or silent co-owner (Laws 10/14). |
| 6 | **No standing Kind continuity** — re-explain preferences, open cares, escalations every new thread; must not colonize Chronicle/Recall/harness by slogan | “Continuous identity” fails the overnight test; Kind collapses to costume. |
| 7 | **Work is durable for coding delivery, not yet a general steward obligation ledger** — Work already holds outcome containers, worktrees, PR finalize; awaits/automations/cross-plane cares are not unified under Work as Kind’s durable care object | Dual-center weakens; Kind lacks a general durable ledger of platform obligations. |
| 8 | **No first-class Kind object distinct from chat/catalog/ambient/`runtimeKind`** | Without Kind as product reality (narrowly defined), gravity fills the vacuum with a central brain or a skin. |
| 9 | **Brand/placement confusion** — `jarvis` catalog / HiJarvis / `jar-core` mistaken for Kind | User thinks they have Jarvis; they have a skin; trust burns. |
| 10 | **Outer scope fence for “beyond the app” undefined** | Without a fence, species scope cancer is the default reading of the brief. |
| 11 | **Reconciliation with named proto-stewards unsettled** — Issue Agent, Automation, Session Await, Thread Handoff, HiJarvis exist; Kind relationship not chosen | Vacuum → Kind becomes rebrand of whichever clerk is loudest. |
| 12 | **Kind routinely bypassed because strategy lives inside provider-native threads/crews** | Spectator Kind with paperwork; live risk, not future vapor. |
| 13 | **Falsifier declaration thresholds / pivot pre-authorization unspecified** | Product-owning humans own declaration (sovereignty); detailed thresholds still missing — kill criteria without process detail remain soft. |
| 14 | **Constitutional vocabulary (projection vs schedule, mandate vs turn, report vs verified; Law # vs Stack L#; Kind vs `runtimeKind`)** | Underweighted for users; still anti-gravity infrastructure for builders — demoted, not deleted. |

**Co-requisite note:** Situation picture and receipts are co-requisites in practice — ranked 2 and 3 for clarity, not as a clean waterfall that forbids parallel progress.

**Demoted (important later, not Kind-blockers for a human):** legion mode, competitive category polish, provider count, marketplace chrome, HiJarvis UX chrome, enterprise policy-authorship theater beyond grant/revoke, cardinality (see T9 — no silent default).

---

## Competitive stance — one wedge, honest limits

### The bet (discipline, not moat)

**Cradle’s multi-year bet:** be the local constitutional control plane where native heterogeneous agents keep their own minds, Work (and related durable objects) keep the receipts, and a narrow platform Kind stewards the plane under law — without Cradle owning native scheduling.

### One sentence (discipline, not uniqueness lock)

*A local home where foreign agent minds stay sovereign, durable work keeps the receipts, and a platform Kind — not a chat upgrade — stewards the plane under human-owned grants.*

### Competitive Verdict Addendum (beat vs rule)

**Settled after competitive critique (2026-08-02; chain K/L/M → N):** Full verdict: `plans/073-jarvis-kind-critique-chain/20260802-FINAL-competitive-verdict.md`.

Plan 073 is a **refusal constitution**, not a conquest doctrine. It stops Cradle from becoming a worse clone. It does not make adjacent Operator-workplace, teammate work-graph, builder-orchestrator, meta-harness, thin-multiplexer, and single-agent-runtime products strategically irrelevant.

| Ambition | Status |
|---|---|
| **Rule / dominate the field** | **Forbidden as ambition.** Ruling requires winning their category sentences; this constitution forbids playing those games. |
| **Beat them on their home axes** | **Not the job.** Ignore marketplace, IM, squad HR, worktree theater, meta-harness continuum, terminal thinness, KV-cache runtime races. |
| **Niche beat on Cradle’s axis** | **Ceiling.** Preferred home for sovereignty-seeking solo/small builders who already run heterogeneous natives and need leave/return stewardship under grant — *if* Kind becomes felt labor-relief (Law 13). Unbuilt Kind = no beat yet. |
| **Absorption defense** | **Actual competitive job.** Success = users cannot truthfully rename Cradle as Operator / board teammates / meta-harness / worktree orchestrator. |

**Combat doctrine (one sentence):**  
Cradle does not conquer competitor categories. Cradle occupies the empty intersection they cannot claim without betraying themselves — and dies the day its sentence collapses into one of theirs.

**Per-category stance:**

| Adjacent category | Stance |
|---|---|
| Operator-workplace | Contest ontology ridge (operator identity without schedule ownership); ignore workplace/marketplace axes |
| Teammate work-graph | Contest elevated Kind vs flat teammate; ignore board-HR feature races |
| Meta-harness | Contest anti-scheduler buyers only; ignore meta-harness axes |
| Builder-orchestrator | Ignore as category rival; coexist; borrow substrate only as non-center |
| Thin agent-multiplexer | Ignore as category rival; ally-of-principle on lifecycle honesty |
| Single-agent multi-surface runtime | Ignore as category rival; runtime excellence belongs to natives |

### Honest limits

- This is a **coherent disciplined bet**, not a structural moat. Competitors can absorb partial clauses without “betraying blood oaths.”  
- The bet is a **fragile intersection**: drop projection non-ownership, or durable receipts, or narrow Kind, and a competitor’s shorter sentence wins.  
- Empty market space ≠ reserved throne. Steward rejection and competitor good-enough partials can kill a correct constitution. Niche win is the ceiling; field conquest is fantasy. Keeping both Plan 073’s ceilings and “打败/统治他们” rhetoric is lying about the game.  
- Local/sovereignty is table stakes among adjacent products — not the differentiator. The differentiator is Kind-on-honest-tower — currently unbuilt.  
- Competitors will out-demo autonomy. Cradle must not race silent act; Cradle also must not wait forever to show *useful propose*.  
- Scoreboard: revealed preference in the intersection segment. Not category share, not demo virality.

### Clone absorption tests

If the story is told as…

| Story | Absorbed by category |
|---|---|
| “Operator for your AI team” | Operator-workplace |
| “Agents on your board” | Teammate work-graph |
| “One harness to rule them” | Meta-harness |
| “Orchestrate coding agents in worktrees” | Builder-orchestrator |

…the constitution has failed. The sentence must keep: **non-ownership of native scheduling + durable receipts + narrow elevated Kind (not flat teammate, not monopoly).**

### Principles to copy (from adjacent categories — not named products)

- **Thin multiplexer:** lifecycle honesty over wrapped fiction.  
- **Builder-orchestrator:** platform owns truthfulness; agents own strategy (Cradle: truth + receipts; Kind/human own strategy).  
- **Teammate work-graph:** durable work objects beat chat archaeology — without flat teammate ontology.  
- **Meta-harness:** governance as product surface — without owning the harness.  
- **Operator-workplace:** continuous operator identity is desirable — reject playground schedule ownership.  
- **Single-agent multi-surface runtime:** runtime excellence belongs to natives/workers, not to Cradle pretending to be the one mind.

---

## Falsifiers — when to abandon or rewrite this constitution

Treat as kill criteria **owned by product-owning humans**, who may declare a falsifier triggered on evidence they accept. The constitution does not self-execute. Detailed thresholds and pre-authorized pivots remain open (gap #13).

1. **Human still carries the plane.** Leave/return promise fails: after hours away, proposed / granted-done / blocked / needs-me still requires chat archaeology; or Kind never proposes with platform scope; or human remains sole discoverer/router/unblocker while Kind narrates. → Kind bet failed even if Iron Law holds.  
2. **Steward rejection.** Target users prefer peer teammates / squad leaders and treat a platform steward as worthless overhead — **or** good-enough partial stewards elsewhere fill the leave/return desire without Cradle’s Kind. → Pivot to work-graph + teammates; drop species identity claim.  
3. **Honesty impossibility.** Heterogeneous projection cannot yield a situation picture trustworthy enough for delegation without Cradle owning native scheduling. → Iron Law and Kind stewardship are incompatible; redesign ambition downward or face existential fork.  
4. **Work graph sterility for stewardship.** Work remains only a coding-delivery container; no durable steward obligation ledger emerges; Session remains the only noun anyone respects for “what did I leave running?” → Dual-center collapses.  
5. **Receipts never trusted.** Delegate/receipt exists in name; humans and workers ignore them; outcomes diverge silently. → Stewardship is theater.  
6. **Autonomy cliff.** Grants never attach to material Kind acts, or always max without recallable grants, or revoke breaks workers. No stable middle. → Initiative red line unworkable.  
7. **Kind indistinguishable from a well-tooling coding agent.** Same outcomes and failure modes (role labels alone insufficient). → Kind distinction is fake; constitution must be rewritten or abandoned.  
8. **Competitor closes the slot first** with a sovereignty-preserving local tower + credible steward. → Timing falsifier; thesis may be right in abstract and dead in market.  
9. **IRON LAW broken for Kind continuity demos.** Law 2 forbidden pattern renamed “species continuity.” → Constitution already violated; rewrite is confession, not patch.  
10. **“Beyond the app” without fence produces a public trust incident.** Silent cross-boundary act. → Category becomes toxic; abandon broad Kind story or radically shrink scope.

---

## Decision log — what died and why (compact)

| Claim | Fate | Why |
|---|---|---|
| Fake “five super-choices resolved across B/C/D” | **Dead** | Citing consensus was lying |
| Dual-center *and* “Work is *the* center” as same answer | **Reconciled → dual-center with named roles** | Session remains execution truth; Work is ledger (coding delivery real; steward ledger incomplete) |
| “Only organism allowed to sense/propose/act across the plane” | **Dead** | Mega-agent monopoly; contradicts Law 4 and live multi-actor plane |
| “Operate the plane” / elevated monopoly operator | **Dead as settled language** | Pilot ≠ steward |
| Structural moat / cannot easily copy | **Dead** | Demoted to disciplined bet |
| “Co-equal to Coding Kind” as present fact | **Dead** | Coding Kind is a ghost |
| Unbounded Kind strategy (topology/placement/parallelism as central brain) | **Narrowed** | Mandate-level + escalations; Law 9 falsifier against micro-go-ahead |
| “Honesty before *all* Kind usefulness” | **Dead as reading** | Act waits on honesty gate; useful propose must not wait for perfection |
| Observe-alone as equal resting product state | **Dead** | Propose is default active voice |
| Offline + propose-only as both fully solved | **Opened** | Principle kept; mechanism open (T14) |
| Steward demand / open slot as validated certainty | **Dead** | Empty space ≠ winnable space |
| HiJarvis / catalog / immortal chat as Kind | **Banned** | Ambient ≠ Kind |
| Synthetic continuation / temporary schedule-ownership shims for Kind | **Banned** | Laws 1/2/12 |
| Platform stores as resumable minds | **Banned** | Law 5 |
| Automatic retry/replacement on silence | **Banned** | Law 6 |
| Default legion / meta-harness ownership of native turns | **Banned as default** | Choice D |
| Absolute “nothing exists” gap language | **Corrected** | Proto-stewards and partial pictures named; absences precise |
| Constitutional L1–L14 colliding with Plan 061 Stack L1–L5 | **Corrected** | Laws renumbered Law 1…Law 14 |
| Soft-open T19 alone as answer to “not one agent” | **Hardened** | Identity-collapse bans settled; only execution cardinality open |
| Zoo-prevention depending on real Coding Kind | **Corrected** | Platform Kind felt loop first; Coding Kind future kind-status |
| Binding falsifiers with zero owner | **Corrected** | Product-owning humans declare |

### What survived intact

- Jarvis is not chat / catalog / ambient-by-brand / `runtimeKind`.  
- Cradle must not own native scheduling; Law 2 forbidden pattern banned; legitimate system runs carved.  
- Honest situation surface ≠ magic orchestrator.  
- Default propose-before-act; brand ≠ grant.  
- No default legion / no meta-harness ownership.  
- Honesty before *act* power; propose on labeled incompleteness allowed.  
- Anti-clone refusal list (not moat).  
- Leave/return promise + Law 13 labor teeth.  
- Grants as first-class sovereignty surface.  
- Narrow Kind under human grant.  
- Dual-center named roles.  
- Open tensions stay open where evidence is thin.

---

## Continuity note — relationship to existing Cradle terms

This is vocabulary continuity, not an implementation guide.

| Constitution term | Live Cradle reality | Binding rule |
|---|---|---|
| **Agent Kind / Kind** | No product `AgentKind` today; do not confuse with `runtimeKind`, provider kind, or catalog runtime ids | Kind is constitutional role-class; never synonymize with runtime catalog |
| **Catalog `surfaces: chat \| jarvis`** | Placement for where a runtime may be offered | Placement ≠ Kind; must not inherit act authority (Law 10) |
| **`jar-core` / System Agent / HiJarvis** | Ambient personal runtime + UI | Observe ≠ Kind; Jarvis-brand ≠ Kind |
| **Law 1…Law 14** | Distinct from **Plan 061 Stack L1–L5** (Evidence → Chronicle → Recall → Harness → Orchestration; Execution = Chat Runtime) | Never use bare “L5” for both. Stack L5 today is mostly human/CLI-driven via Work/Issue/Queue/Automation/Session Await — not a Kind tier |
| **Projection** | Chat Runtime projects native events into runs/messages/queue/observability | Constitution means project native events — not “projector tables = Kind mind” |
| **Law 2 forbidden pattern** | IRON LAW: empty/early result → clear user projection → system synthetic run for same native cognition | Distinct from legitimate goalContinuation / provider-synthetic / queue system runs |
| **Situation surface / “control tower”** | Metaphor; not a live module name | Do not invent an owned noun by constitution prose |
| **Mandate / receipt** | Receipt-like objects exist (Issue delegation, Await, Work PR finalize, Automation findings) without Kind vocabulary | Do not imply zero receipts; do not silently rename live owners |
| **Memory / continuity (Kind)** | Plan 061 claims Chronicle (Stack L2), Recall (Stack L3), Harness push (Stack L4), ambient observations, session transcripts | Kind memory scope must not colonize those owners by slogan (T13) |
| **Coding workers** | Constitution class for runtimes/providers/delegates/Work primary agents | Not a catalog entity named “Coding Kind” |
| **Queue** | Chat session durable queue ≠ Stack L5 “Queue” routing | Kind strategy talk must not treat chat queue drain as Kind orchestration |

---

## Decision checklist

Accept this constitution if you accept:

1. **Narrow Kind** under human grant — not monopoly, not chat avatar, not “many tools + one will” as proof.  
2. **Dual-center** Work ledger + Session carrier + situation surface over both — Work already durable for coding delivery; steward ledger still missing.  
3. **Propose-default**, act-by-grant, grants as real power-user surface; grant-expansion speed under watch.  
4. **Honesty before act power**; useful propose may lead on labeled incompleteness; propose without tower-visible evidence is not Kind voice.  
5. **Iron Law for every native** and for the Kind concept; Law 2 forbidden pattern named; legitimate system runs carved.  
6. **Leave/return stewardship** as success criterion equal to law-compliance — measured against existing fragments, not against zero.  
7. **Competitive discipline without moat mythology.**  
8. **Present inventory named** — Kind is missing as elevated steward identity + grant policy + plane-wide propose, not as first durability/orchestration machinery.  
9. **Open tensions stay open** until evidence — especially steward demand, cardinality, proto-steward relationship, outer fence, memory seam, execution-mind cardinality.

If a proposal requires Cradle to own native lifecycle, micro-manage workers, narrate unverified completion as truth, mint power from brand, equate Kind with one steward process-plus-tools, or delay all Kind usefulness until perfection — it is not a Jarvis feature. It is a constitutional violation.
