# Governance-as-Code: HUMMBL as a Normative Cybernetic Institution

*A position paper on connecting institutional norms to observable action gates.*

**Version:** `v0.1.0-draft`, unreleased working revision 2026-10-10

**Status:** DRAFTING — conceptual contribution; no deployment-effectiveness result

**Author:** Reuben Bowlby · [ORCID 0009-0002-5620-1103](https://orcid.org/0009-0002-5620-1103)

**Notebook:** [Research record](../../notebooks/governance-as-code-normative-cybernetic-institution.notebook.md)

**Original draft:** 2026-08-13; recorded consensus reference `clp-069a51894290`

**AI assistance:** Original draft recorded `claude-sonnet-5` for drafting and literature search. Codex assisted with this working revision, source checks, and methodological corrections. Tool assistance is not independent peer review or author approval of a release.

**Versioning:** The original draft records OD-23 and the Cognitive Ledger chain as its versioning process. This revision does not assert a new consensus decision or mint a release version.

## Abstract

HUMMBL provides a setting for studying governance expressed as versioned norms, action checks, and decision records. We propose the term *normative cybernetic institution* for an arrangement in which feedback about agent behavior informs revisable institutional rules, some of which are enforced at an action boundary. The contribution is a design argument and a testable separation of normative authority, executable policy, runtime enforcement, and evidence of outcomes. We describe a minimal action-gate model, its assumptions, and an evaluation protocol. Base120 supplies a candidate vocabulary for describing reasoning activities. An exploratory analysis of 120 pinned definitions compares all 15 pairings of its six families: the proposed pairing ranks 13th by mean paired lexical distance and 5th by smallest maximum absolute contrast cosine. Near-orthogonality occurs across alternatives; these text measurements do not establish bipolar cognitive axes. A finite vocabulary can support arbitrarily long expressions, but neither grammatical validity nor an audit log establishes termination, safety, or legitimate authority. The paper makes no claim that the current HUMMBL deployment enforces every norm or improves institutional outcomes. Those claims require implementation-bound tests and independently assessable evidence.

## 1. Problem and contribution

An agent can quote a rule while taking an action that violates it. A repository can contain a policy without controlling the credentials, process, or service that executes the action. A log can describe compliance after the fact without having prevented a violation. These distinctions matter when a system delegates actions among people, agents, and services.

We study the narrower engineering question: **under what assumptions can a versioned institutional norm constrain an agent's externally consequential action, and what evidence would demonstrate that constraint?** The normative question of whether the rule is legitimate remains separate. A technically effective restriction can still encode a mistaken, unjust, or obsolete decision.

Our proposed contribution has three parts: an explicit boundary between institutional authority and technical enforcement; a small action-gate model with failure cases; and an evaluation protocol that compares preventive enforcement with instruction and retrospective logging. This is a design proposal situated in an existing research portfolio, not a claim to invent executable norms, reference monitors, or normative multi-agent systems.

## 2. Vocabulary, composition, and the axis hypothesis

Base120 organizes reasoning models into six named families. This paper proposes the following interpretive pairing:

| Proposed dimension | Paired families | Evidential status |
|---|---|---|
| Framing | Perspective / Inversion | Interpretive hypothesis |
| Aggregation | Composition / Decomposition | Interpretive hypothesis |
| Reference scope | Recursion / Systems | Interpretive hypothesis |
| Time, a possible additional dimension | Retrospective / Prospective | Candidate requiring a separate operational definition |

The arithmetic of grouping families is not evidence that the dimensions are independent, that the paired operations are opposites, or that the taxonomy spans human reasoning. In particular, composing and decomposing an object need not be inverse functions, and recursion and systems thinking may co-occur in one procedure. No vector space, basis, metric, or orthogonality relation follows from their names.

The earlier draft referred to a ledger-based assessment as an axis test and described a temporal candidate as promotable. Its inputs, judgments, and procedure are not reconstructable here. We retain those references as provenance, but withdraw their use as confirmation. The [revised study protocol](orthogonality_test_methodology.md) distinguishes lexical separation, geometric diagnostics, semantic opposition, and task utility. The completed diagnostic below supplies text measurements, not confirmation of the axis hypothesis.

### 2.1 Exploratory definition-only diagnostic

We froze a [local exploratory plan](analysis/exploratory-plan.md) at 2026-10-10T13:18:40Z before computing scores. This was not external preregistration; the schema and one record had already been inspected. The input is the exact `operators.json` Git blob at Base120 commit `f27d603f401751a772fcade069038b45c248fe42`, containing 120 definitions, 20 per family. The [analysis package](analysis/README.md) records the source hash, extraction rules, frozen stopwords, software, and all outputs. It supplies derived numerical summaries without bundling or relicensing the separately restricted source corpus.

Only definition text supplies features. We use normalized lowercase word tokens, raw term frequency, smoothed inverse document frequency, and unit-length document vectors, followed by unnormalized family means. The representation has 582 retained terms. Each perfect matching defines three centroid contrasts. We score all 15 matchings by mean paired Euclidean distance (larger first) and by maximum absolute cosine between distinct contrasts (smaller first).

| Proposed matching: P–IN, CO–DE, RE–SY | Value | Rank among all 15 |
|---|---:|---:|
| Mean paired-centroid distance | 0.328995090258 | 13, larger first |
| Maximum absolute contrast cosine | 0.027593465578 | 5, smaller first |

Neither proposed score is tied under the frozen tolerance. The three signed contrast cosines are −0.023026077411, 0.015885528448, and 0.027593465578. Across all matchings, maximum absolute cosine ranges from 0.007569990596 to 0.078323512437. Near-right contrast angles therefore characterize many alternatives in this representation. The [complete table](analysis/results.md) retains every matching; ranks and descriptive fractions over this finite set are not sample significance tests.

![All 15 family matchings compared by lexical distance and maximum absolute contrast cosine; the proposed matching is marked with a star.](analysis/matching-scores.png)

*Figure 1. Definition-only comparison under the frozen representation. Plot numbers identify rows in the complete results table; the star identifies the proposed matching. [Standalone SVG](analysis/matching-scores.svg).*

Sparse, weakly overlapping vocabularies can produce small cross-contrast dot products for many pairings. A synthetic check with six disjoint one-word family vocabularies gives zero contrast cosine for every matching. This fixture illustrates the ambiguity of the metric; it is not an additional Base120 observation. The actual definitions are short, with family means of 7.15–7.65 retained tokens. Word order and context are absent, and the frozen stopwords remove negation. Opposing concepts may share vocabulary, while unrelated concepts may be lexically distant. These results neither establish cognitive independence nor refute every semantic rationale for the pairing. Human judgment and task-utility studies remain unexecuted.

### 2.2 Composition and resource limits

For a nonempty finite alphabet Σ, the set Σ* of all finite strings is infinite because string length is unbounded. This mathematical observation does not establish that every string expresses a distinct or useful reasoning procedure. A deployed system with a maximum length or resource budget admits only a bounded subset. A grammar can restrict syntax; it does not by itself prove that a process interpreting a valid expression terminates. A termination claim needs additional assumptions, such as a strictly decreasing nonnegative integer budget and bounded completion of each step. These are proposed design constraints, not measured properties of the current fleet.

## 3. From institutional norms to action gates

We distinguish four artifacts that are often collapsed into the phrase *as code*:

| Artifact | Role | Evidence needed before claiming enforcement |
|---|---|---|
| Norm and authority record | States who may establish, amend, or contest a rule | Decision provenance and applicable authority scope |
| Executable policy | Maps specified observations to an admission decision | Versioned semantics and positive/negative fixtures |
| Enforcement boundary | Mediates the action before effects occur | Coverage of effecting paths and bypass tests |
| Outcome record | Describes what actually happened | Effect observations, provenance, and missing-record accounting |

Calling a constitutional file “ring 0” supplies none of these guarantees. A repository is a useful versioned control surface; it is not an operating-system security boundary. The phrase *repo-as-kernel* is an architectural metaphor for organizing configuration and evidence, not a claim of memory isolation, privilege separation, or complete mediation.

Let an action request be `a = (actor, operation, resource, parameters)`. Let `s` be the policy-relevant state observed by the gate, `e` the submitted evidence, and `v` an immutable policy version. Define an admission function:

```text
G_v(a, s, e) -> {allow, deny, defer}
```

`defer` means that a required fact or judgment is unavailable; it is not an implicit permission. A proposed receipt binds the action digest, policy version, evidence references, observation time, decision, and decision-maker identity. A separate execution result binds that receipt to an attempted effect and its observed outcome. An admission receipt alone is not proof that the effect occurred, and an outcome log alone is not proof that admission preceded it.

### 3.1 Conditional safety argument

Suppose that (A1) every effecting path passes through the gate; (A2) the gate can prevent the effect; (A3) action, identity, state, and policy version remain bound through execution; (A4) `G_v` rejects every action violating the specified local predicate; and (A5) failures and unknown inputs do not silently become `allow`. Under those assumptions, a violating action cannot be admitted through the modeled boundary. This follows by contradiction: an admitted violation would either violate A4 or have bypassed or changed one of A1–A3/A5.

This is a conditional argument about a specified predicate. It is not a verified HUMMBL implementation theorem and does not establish the predicate's moral adequacy. The observed state must be accurate and sufficiently fresh for that predicate; a condition on an observation is not automatically a condition on the actual world. A deployment must state whether it reserves state, rechecks immediately before effects, or accepts a bounded race. Concurrent changes, external credentials, unmediated tools, faulty observations, and compromised enforcement processes can invalidate the assumptions. Obligations about eventual beneficial outcomes also require progress and environmental assumptions; rejecting unsafe actions does not ensure that a useful action ever completes.

### 3.2 Worked example and counterexample

Consider a synthetic rule: an agent may publish only the exact artifact an authorized reviewer admitted. A receipt for digest `d1` must not admit a modified artifact with digest `d2`. A successful test changes the artifact after review and observes a denial at the actual publication boundary. Checking only that the receipt file exists is insufficient.

If the agent retains a second publication credential outside the gate, it can publish `d2` directly. The presence of a correct gate and an append-only log does not repair this bypass. A test suite must therefore include direct effects through alternate paths, stale evidence, policy changes, unavailable services, and concurrent modification. This example is illustrative; no external publication experiment was conducted for this revision.

## 4. Relationship to prior work

Normative multi-agent systems already study explicit norms, agent compliance, and rule change. The [2007 Dagstuhl account](https://www.dagstuhl.de/07122) supplies a direct intellectual context; HUMMBL is an application setting, not the origin of that research program. The distinction between obligations, permissions, and prohibitions also predates this work; see [von Wright's 1951 article](https://doi.org/10.1093/mind/LX.237.1).

[Schneider's work on enforceable security policies](https://www.cs.cornell.edu/fbs/publications/EnfSecPols.pdf) bounds what execution monitoring can enforce under a stated mechanism model. It motivates separating prevention of a forbidden event from guarantees about eventual desirable outcomes. [Catala](https://doi.org/10.1145/3473582) demonstrates a language and verified core compilation steps for computational legal rules. It supports the feasibility of formalizing selected rules, not the stronger claim that all institutional interpretation can be automated.

[Ashby's treatment of requisite variety](https://ashby.info/Ashby-Introduction-to-Cybernetics.pdf) motivates asking whether a controller can discriminate relevant disturbances. The [good-regulator result is by Conant and Ashby (1970)](https://doi.org/10.1080/00207727008920220), with assumptions about successful and simple regulation. Neither source proves that a HUMMBL registry is a sufficient model, or that imposing a grammar gives a controller requisite variety. A quantitative application would first need disturbance, action, outcome, and observation spaces.

The original draft additionally drew analogies to information theory, active inference, Hohfeldian relations, and bioethics. These are possible interpretive connections, not established mathematical isomorphisms or empirical explanations of this system. We do not rely on them to establish the contribution. In particular, provenance checking is not automatically variational free-energy minimization, and a pair of reasoning families is not automatically a pair of legal relations. The [2024 Helsinki revision](https://www.wma.net/news-post/revised-declaration-of-helsinki-adopted-by-the-global-medical-community-strengthening-ethical-standards-in-clinical-research-involving-humans/) also supersedes the bibliography's former “latest 2013” note; its existence does not establish the applicability of a medical-research framework to every agent experiment.

## 5. Evaluation protocol

No comparative action-gate results are reported; the lexical diagnostic in §2.1 does not evaluate enforcement. Before that evaluation, freeze the implementation commit, gate configuration, task corpus, observation rules, and analysis plan. Separate development fixtures from a held-out evaluation set. Include both disallowed actions and allowed actions that a useful system should complete.

Use three conditions on the same resettable tasks: (1) prose instructions; (2) instructions plus retrospective receipts; (3) instructions and receipts plus pre-effect admission. Equalize agent version, tool permissions except the intended gate intervention, task information, and resource budget. Randomize condition order and record seeds; if provider behavior cannot be pinned, retain timestamps and model identifiers and report the limitation. Select sample size and repeated-run count before examining outcomes, using a pilot disjoint from the held-out set.

| Outcome | Numerator / denominator or measurement | Main limitation |
|---|---|---|
| Unauthorized-effect rate | Requests causing at least one forbidden effect / eligible forbidden requests | Requires an observer beyond the agent's self-report |
| Allowed-task completion | Correctly completed allowed requests / eligible allowed requests | A deny-all policy must not appear successful |
| Receipt completeness | Executed requests with all prespecified evidence fields / executed requests | Completeness is not truthfulness |
| Decision/effect agreement | Effects matching the admitted action and policy version / observed effects | Requires stable identities and effect binding |
| Overhead | Per-task gate latency and total task time | Report distributions, timeouts, and measurement scope |

Count retries within a task according to a frozen rule; do not treat them as independent subjects. Report task-paired contrasts, uncertainty appropriate to repeated tasks, raw denominators, and exclusions. A missing effect observation is “unknown,” not a success. Publish synthetic fixtures separately from any redacted operational corpus, with hashes, redaction rules, and replay commands. Operational case reports can motivate the study but cannot substitute for its comparison.

## 6. Claim register and limitations

| Claim | Current support | What would change its status |
|---|---|---|
| Norm, policy, gate, and evidence are distinct artifacts | Definitions and worked counterexample in §3 | Implementation mapping and independent critique |
| The proposed pairing has ranks 13/15 and 5/15 under the frozen lexical scores | Pinned definitions, complete matching enumeration, code and reproduction checks in §2.1 | Independent reproduction; a different representation is a separate analysis |
| Six Base120 families form three independent bipolar axes | Unconfirmed interpretation | Semantic and task evaluation under the companion protocol |
| A gate prevents violations of its specified predicate | Conditional argument under A1–A5 | Implementation proof or tests with documented coverage limits |
| HUMMBL enforces all governing norms | Not established; not claimed | Boundary inventory, bypass analysis, and execution evidence |
| Governed agents improve institutional outcomes | Not established; not claimed | Comparative and stakeholder outcome studies |

This work is authored within the system it studies. Selection of incidents, policy predicates, and outcome criteria may favor its design. Logs may omit bypassed actions; signatures cannot establish that a signed statement is true; redaction can prevent external replication. Norm conflicts, appeals, legitimate rule change, and disagreement over desired outcomes remain institutional problems even when their handling is recorded in code.

The next defensible step is a narrow, replayable enforcement study, followed by independent scrutiny of the normative mapping. A broader claim about governed reasoning requires additional evidence beyond successful local policy checks.

## Artifacts and provenance

The living manuscript is this README. [Bibliography](references.bib), [study protocol](orthogonality_test_methodology.md), [completed exploratory analysis](analysis/README.md), [changelog](CHANGELOG.md), and [notebook](../../notebooks/governance-as-code-normative-cybernetic-institution.notebook.md) accompany it. The earlier draft cited internal ledger entries `clp-9f070df956a6`, `clp-67429a7ba0a7`, `clp-9e38933728a2`, and `clp-2e72e2299089`. Those identifiers preserve historical provenance; their contents are not a public dataset supplied with this paper. No new human-participant data, model trials, or deployment measurements were collected for this working revision.