Part 2 of 7 · 6 min

A unit of change with a spine

A project plan is a document about intentions. An initiative here is an object with a state, and the state moves only through governed doors. Part 2 of the Change Series: phase machines, and the advance that cannot be talked forward.

Part 1 closed on a definitional question. Calling something a governed unit of change is easy, and every vendor's slide does. What does the unit actually consist of?

Start with what it is not. In most estates, the unit of change is a document. A project charter sits in a drive, a phase column sits in a tracker, and somebody edits a status before the steering call. The document describes the change. Nothing binds it to the change, so the two drift apart, and by month three the tracker says design while the team quietly builds.

Danubia's decommissioning is a different kind of thing. It is an object in the graph. It carries a type that cannot change after birth, a current phase, and a history of every phase it held. Its steering committee is a list whose approvals are weighed, never counted by show of hands. The type binds it to a phase machine, and the machine is the spine this part is named for.

States, not statuses

The difference between a status and a state sounds like pedantry until you try to fake one.

A status is a field somebody sets. A state is a position in a machine, and the machine defines which moves exist. Danubia's decommissioning can enter its first phase, advance cleanly to the next, complete after the last, or regress to an earlier one. Those are all the moves there are. There is no transition that skips a phase, none that parks an initiative in two phases at once, and none that edits the history.

Entering the machine is itself a designed move. The first phase requires no quorum and no criteria, because demanding a second human merely to begin would make starting impossible. Honesty starts at zero and tightens as the stakes rise, which is a design position: govern the exits, not the entrance.

The reverse move is designed with opposite severity. A regression re-opens an earlier phase and stamps every phase it rolls back through. It requires full quorum, offers no exception path, and refuses any actor who sits in the signer set. So the person who approved a phase cannot be the person who unwinds it. Going backward is legal and loud. That combination is rare, and it is the honest one: a machine where reverse is illegal produces estates where reverse happens anyway, undocumented.

The advance that cannot be talked forward

Now the center of the part. What actually happens when Danubia's team believes the dependency-migration phase is done?

Somebody asks to advance. The platform answers with a verdict, and the verdict is computed, not negotiated. A pure function reads the phase's exit criteria and the quorum arithmetic, with criteria checked first. It returns the whole picture: which criteria stand satisfied, which quorum fraction is reached, and the one blocker that names why an advance refuses. The same function serves the preview and the writer, so what the screen predicts and what the transaction enforces cannot diverge.

The rule with teeth sits underneath. When a gate's evidence can be recomputed, the server recomputes it at the moment of the attempt, from the stored record. A caller-supplied result is discarded. Where a caller's assertion may enter at all, it enters labeled with the caller's name. A fabricated passing record can never masquerade as gate output.

The meeting can decide anything it likes. The machine reads the record, and the record does not attend meetings.

Readers of our Proof Series met this posture at the buyer level: a phase advances on named facts, never on a percentage. This is the mechanism under that sentence, and the detail worth carrying is where the enforcement lives. The recompute is inherited by every caller path, current and future, because it happens at the one place the transition executes. Part 3 of our first series called that the difference between a rule and a property.

Built for two hands on the same door

One small mechanism says more about the design than the large ones.

Suppose two people click advance at the same moment, or one clicks twice on a slow connection. Most trackers resolve this with whoever wrote last, and the history shows one advance that happened twice, or two that half-happened. Here the transition is transactional and guarded: it matches the initiative only if the phase is still what the caller saw. One attempt wins. The other matches nothing, changes nothing, and returns a clean refusal rather than a duplicate phase.

The scenario is mundane, and that is the point. A governance machine that is honest only when operated carefully is not honest. The race is handled at the write, like everything else in this platform that matters.

The gate that read the graph

Back to Danubia, because the dependency-migration phase is where the spine earns its keep.

The exit criterion for that phase says the legacy system's dependents are migrated or dispositioned. In the status-report world, that criterion is a checkbox, and under deadline it gets checked. Here the criterion folds in the graph's own evidence. The platform holds edges from the two downstream reports to the legacy tables, and the gate reads them at the attempt. The team asserts done. The server finds a report still reading the legacy system, and the advance refuses with the blocker named.

What follows is the useful part. The refusal is a work item, not a scolding. The surviving report needs a rebuild against the new system, and that work routes through a door this series opens in part 4. The report gets rebuilt, the edge changes, and the next attempt passes on the same computed verdict that refused the last one. Nobody relitigated anything in a meeting. The record changed, so the verdict changed.

What the spine is for

Step back and the shape of the part is one sentence long. An initiative is an object whose movement a machine governs. Its gates read the record, and the people who want to pass the gates cannot write it.

That is what makes part 1's economic argument true. The second initiative is cheap because this machinery transfers whole. The decommissioning inherited the same spine the migration ran on, with a different ladder on top.

One question is still open, and it is the one every phase silently leans on. The gates know what must be true to leave a phase. Somewhere, something must say what the initiative is for, what it must not touch, and who stands behind it. That document has a bad reputation, earned over decades of write-once-read-never charters. The next part is about a charter nobody writes at all.

Part 3: The charter nobody authors. Seven live sources, a deterministic fold, and signatures that only count sealed.

← part 1What you own on Monday part 3 →The charter nobody authors

Model your first domain today.

You send five documents, we model them, and the first cut comes back in days.