Proof 03 · The covenant
The operating principles, written down. Bound to the operation.
An institution that runs continuously on an architecture wants to know how the architecture decides — what it acts on without asking, what it surfaces for a person, what it refuses to say. The covenant is the written answer to that question.
It is short. It is specific. It is enforceable. The five tenets below govern every decision the architecture makes on behalf of a client.
Truth as the operating token
The architecture does not say what it cannot defend. Every public-facing claim, every documented record, every attribution, every market indication is tied to a source — a publication, a verifiable communication, a documented sale, a named expert. Claims without a source are not made.
Internal direction from the principal of the institution is trusted as-given. External claims from third parties are verified before being recorded. The distinction is held strictly.
Principal-grade decisions, principal-only
Decisions that touch the institution's relationships, taste, or public reputation are surfaced to the principal. The architecture does not impersonate judgement it does not have.
Decisions that are structural — routine inquiry handling, scheduled maintenance, record cross-validation, predictable workflow — are made automatically. Decisions that are irreversible (a public publication, a customer-facing communication that cannot be retracted) are proposed with a recommendation and held for the principal's confirmation.
Closest-first responsibility
When a question can be answered from records the institution holds, it is. When it cannot, the architecture looks to records the institution has been granted access to. When it cannot, it looks to public records. It does not invent.
The institution's own knowledge is exhausted before outside sources are reached for. The reader gets the most authoritative answer available, sourced honestly, before any aggregator-grade content.
Verify before act
Before any operation that would change a record, the architecture checks whether the change is needed. An operation that would write what is already written is logged as already_correct and not performed. The cost of an unnecessary write is small; the cost of writing the wrong thing because the architecture did not check first is large.
The institution outlasts the architecture
If SENTYAL ceases to exist, changes hands, or revises its terms, the institution walks away with its records intact and operating elsewhere. No data is held hostage. No record is locked into a format only this vendor can read. No relationship with a client is owned by the architecture; the architecture is the medium, the institution holds the relationship.
The covenant is bound to the operation, not the brand.
A list of principles on a website is worth nothing if the principles are not bound to the running system. The five tenets above are not aspirational language; they are operational gates inside the architecture. Tenet 01 is enforced by the cross-validation rules that refuse to publish unsourced claims. Tenet 04 is enforced by the verify-before-act gate that aborts no-op writes. Tenet 05 is enforced by the export surface that produces a complete, structured copy of the institution's records on demand, without negotiation.
The covenant is on file alongside the proprietary system filings, dated, and operates as the published governance of the architecture. If a future operator wanted to revise it, the revision would itself be on the public record. Quiet rewriting is not available.