Development

• Every app ends with one ISA that is its spec and its test suite at once: atomic criteria, an eval per criterion, a spanning criterion per Feature.
• No code is written ahead of the criteria it satisfies.
• A Test report says, criterion by criterion, what holds today, and lists every surface the ISA doesn't mention.
• Nothing inferred passes as something the principal said, and nothing the code does passes as something it should do until the principal ratifies it.

Example 1: new app from a voice note

User: "Here's what I want the tracker to do…" (dictated)
→ Build: ISA scaffolded, interviewed until every criterion is atomic with an eval
→ granularity bar passes → the Algorithm builds against the ISA

Example 2: an old repo

User: "Catch the old dashboard up"
→ Migrate: inventory → seed or extend the ISA → dispositions → intent questions
→ observed criteria ratified, suspected defects listed → Test report

Example 3: a health check

User: "Is the site still matching its ISA?"
→ Test: sync report, ISAGate and Rate, bunker test through the deep tiers

• ISAGate's bundled-claim finding is not an atomicity check. It fires only on two conjunctions, two semicolons or "including", and it is advisory on purpose. Build uses IsaCheck.ts bar plus an independent reviewer instead; don't make ISAGate block to match (2026-09-24 review: three compound criteria passed ISAGate clean).
• Skill("ISA", "seed …") refuses when ISA.md already exists. Migrate on a repo with a thin ISA extends that ISA in place; it never deletes the file to make Seed run.
• Bunker runs Test Strategy commands from the ISA's folder unless the ISA's frontmatter says probe_cwd: config-root. Relative paths in probes resolve against that folder.
• The inventory sees Hono/Express-style routes (app.get("/x", …)), subcommands compared against a variable bound from argv (cmd === "x" chains and switch (cmd) blocks), package.json scripts and bins, CREATE TABLE, and *.test.*/*.spec.* files, with comments stripped first. Everything in the tool's uncovered list needs criteria found by hand. A case label in an unrelated switch used to be read as a command (2026-09-24: 12 fake commands on one real CLI, 0 of its 16 real ones).
• Sync counts a surface as covered when a criterion or probe names it: a route by method and path together, a test by its repo path, a script, command or table only inside a backtick span or a probe (names like build are English words). A named surface can still have a weak criterion; sync catches missing criteria, not weak ones.