The engine that refuses to guess.
When an analyzer falls below its confidence floor it emits a gap, and a gap becomes a question rendered for whoever can actually answer it. This is the feature that makes the first principle enforceable rather than aspirational.
- Interaction
- Choosing beats typing. Free text is the escape, not the default
- Backlog
- Uncapped. Nothing is ever silently resolved by inference
- Concurrency
- No individual holds more than seven open questions at once
One gap, three vocabularies.
The same missing fact reaches an engineer as a branch and a trace count, a system expert as a policy history, and a business owner as a plain question about money. Nobody is asked to translate.
Options are synthesised from the evidence itself: competing readings of the code, values observed in production, precedent from similar answers, and the negative case. Every question also carries three fixed responses, and only one of them unblocks anything.
Branch at PremiumCalculator:218 fires in 0.4% of calls and was last hit six days ago. Live requirement or never-removed fallback?
trace:otel, 14d window, 47 executions · vcs:commit a4f2e91
Answering this unblocks 23 tasks and decides whether 2 test cases are treated as correct behaviour.
Policies written before January 2014 in New York get a different surcharge rate. Do you remember why that cutover exists?
Routing followed declared ownership, then commit history, then defect history.
Answering this confirms rule RATE-0042 and releases the surcharge work for the whole quarter.
Should a New York policy issued in 2013 still be charged the old surcharge rate when it renews today?
No code, no identifiers, no jargon. An underwriter can rule on this without opening a repository.
Your answer becomes a recorded rule. Every task and agent downstream inherits it as a constraint.
The same question arrives differently depending on what it is holding up.
A phase cannot complete while gaps above the threshold remain open in its scope. The programme sees the wall before it walks into it.
A persistent, strictly ordered backlog. This is the engineer's working surface, and it is the reason the backlog being uncapped does not matter.
Opening a task or dispatching it to an agent surfaces every open gap in its dependency closure, and refuses the action until they clear.
Question fatigue is the thing most likely to kill this.
So the queue is ordered rather than long, and gaps are clustered so that one answer retires many. Twelve hundred unreached files become roughly eleven questions, grouped by module and suspected cycle, against a target compression ratio above fifteen to one.
No individual holds more than seven open questions at a time. The excess stays queued, invisible to them, and visible on the programme register.
priority_score = 0.40 × blocked_task_count + 0.20 × decision_dependency + 0.15 × runtime_criticality + 0.15 × irreversibility + 0.10 × answerer_availability
Unreached files clustered into questions in the worked example, grouped by module and suspected cycle.
Maximum open questions held by any one person. The rest waits rather than arriving.
Size of the backlog itself. Capping it would mean resolving something by inference.
Routing, and what happens when routing fails.
Questions go to declared ownership first, then commit history, then defect history, then prior answer quality, then a role fallback. If that chain produces silence, the ladder runs.
Contradiction is data, not an error.
The answer is not accepted. The question is asked once more with the evidence displayed alongside it: you said this path is unused, it ran forty-seven times in fourteen days, most recently six days ago, which is true? People are usually right about intent and usually wrong about frequency, and the platform is designed around that asymmetry.
Both answers are retained as competing assertions and the gap moves to a conflicted state. The domain owner rules. Neither answer unblocks anything in the meantime, which is uncomfortable and correct. Silently picking the more senior person's answer is exactly the failure this product exists to prevent.
The assertion reopens and every artifact derived from it is flagged stale. Tests generated from that assertion, envelopes carrying it as a constraint, and decisions that cited it are all marked rather than silently rewritten. History is not edited to match the present.
When nobody knows, the answer is an observation, not a vote.
The platform proposes a designed experiment: an extended trace window, shadow execution, full-table data profiling, a canary probe, or a historical replay. Each one states its cost, its duration, its production risk, and precisely what it will and will not settle.
Experiments require explicit authorisation, and their results are written back to Core as evidence like any other source. This is the only unblock path that is not a guess.
A gap blocks its full downstream closure, and the block is never quiet.
Every block explains itself: which gap, who holds it, how long it has been open. It is traversable upward in one action. It appears on a programme register ranked by tasks blocked multiplied by days open. It never expires on its own.
Override exists, and it is deliberately uncomfortable.
It requires a named person and a written reason. What it produces is recorded as an assumption, not an assertion. Every artifact derived from it is marked assumption-derived, and it stays on the risk register permanently. The platform never overrides on its own initiative.
Every accepted answer produces at least one artifact: a confirmed rule, generated test cases, schema annotations, a removal task, a timing constraint, or a constraint injected into task envelopes. An answer that changes nothing is logged so the gap detector can be tuned to stop asking it.