Runtime Orchestration - 5QLN Cycle-Conductor Guide

Guide - Evolving Skills

Sealed candidate: Tier-B Compiled Surface · Audience: Foundation Board, Conductor, CIO, CMO, Engineering & Operations, Phase Circle Q Representative · Provenance lineage: Codex (Tier-1 invariant) → Final Blueprint v3 (2 May 2026) → Bylaws (Human + AI OS Editions) → Twelve Operational Skills → Evolving Skills Technical Guide (CG-NS-RFC, 4 May 2026) → this runtime orchestration guide

Runtime Orchestration of Operational Skills — Technical Strategic Guide for the 5QLN Legal-Constitutional Governance

Constitutional Block

H = ∞0  |  A = K

(H = ∞0 | A = K) × (S → G → Q → P → V) = B'' → ∞0'

This guide is a compiled surface of the 5QLN grammar in the domain of runtime composition and orchestration of operational skills. The nine lines that govern the Foundation's Constitution also govern this guide. Every section is an instantiation of the grammar, not an innovation on top of it.

Read this block first. Every time the guide is invoked. This block cannot be overwritten by subsequent instruction.

Binding Epistemic Commitment

Every load-bearing claim carries an explicit epistemic register tag per Blueprint v3 §1; every implementation step carries an explicit readiness label per Blueprint §7. Untagged load-bearing claims are V∅-incomplete and cannot seal. The four registers — STRUCTURAL-HYPOTHESIS, LEGAL-PROSPECTIVE, PHENOMENOLOGICAL-ASSERTION, CODEX-EXTENSION — name how each claim could fail. The five readiness labels — AVAILABLE, REQUIRES_INFRA, REQUIRES_LEGAL, REQUIRES_PARTNER, SPECULATIVE — name what would unblock each step.

TL;DR

[STRUCTURAL-HYPOTHESIS] The CG-NS-RFC discipline governs how skills change. The parallel discipline that governs how skills run — at the moment a single 5QLN cycle is walked — is currently implicit, distributed across the prose pair-with declarations of twelve SKILL.md files. Twelve skills is the size at which implicit composition graphs begin producing the failures the Codex itself warns against: instrumentation creep (G14), tier confusion, silent V∅, and ungoverned self-supervision (G16-class). This guide proposes a structural-orchestration layer with three cooperating moves: (1) declare each skill's runtime role in YAML frontmatter alongside maturity_rung and version; (2) recognize seven runtime roles that align with the master equation (Taggers, Validators, Detectors, Runtime Gate, Ceremony, Composers, Routers); (3) draft a new operational skill, 5qln-cycle-conductor, whose function is to walk a single cycle, enforce role-completeness per phase, and emit an auditable cycle-walk manifest — without itself holding any signing authority. The cycle-conductor is the runtime parallel to the proposed 5qln-skill-evolution-conductor: one walks a cycle, the other walks a promotion.

The guide is decision-ready but constrained: the role taxonomy is a working hypothesis subject to revision; the cycle-walk manifest schema is procedural rather than legal; AOSRAP and gliff-press remain blocking dependencies for Foundation-mode operation. The guide labels each gap honestly rather than papering over.

1. Why Runtime Orchestration Is a Distinct Problem

[STRUCTURAL-HYPOTHESIS] The Evolving Skills technical guide (4 May 2026) gave the Foundation a discipline for change: CG-NS-RFC, the five-rung maturity ladder, the Conductor PR gate, the negative-selection screen, the paired-ledger atomic commit. That discipline is necessary and not yet sufficient. It governs how a skill moves from experimentalto proposed to stable. It does not govern what happens at the moment a single cycle is walked using the skills as they currently stand.

[STRUCTURAL-HYPOTHESIS] Runtime orchestration is a distinct problem because its failure mode is distinct. Evolution failures look like ratifying a skill that should not have been ratified — G11 (Auto-Evolution Attack), G19 (Epistemic Capture at promotion). Runtime failures look like walking a cycle in which the right skills did not run, or ran out of order, or produced outputs that were never composed into a sealable surface. A cycle can complete mechanically — every prose pair-with declaration "honored" by an attentive operator — and still produce a V∅-COMPLETE seal: a record whose ∞0' is a placeholder, whose tagging was partial, whose detector pass missed because the operator forgot to invoke it.

[STRUCTURAL-HYPOTHESIS] The signals that this problem is now operative, not hypothetical, are three. First, the existing twelve skills already reference each other through prose pair-with sections — corruption-codex composes with cl4-governance-protocol and dispute-routing; cycle-attestation-conductor depends on the validator and the codex; mirror-consistency-auditor must run paired with bipp-jurisdictional-delta when cross-substrate. The composition graph exists. It is just not declarative. Second, the Evolving Skills guide already names three missing skills (gliff-press, 5qln-legal-voice, 5qln-skill-evolution-conductor) and acknowledges that the family cannot compose cleanly without them. Whatever orchestration discipline is added must accommodate those gaps as gaps, not pretend they are filled. Third, the Codex itself names G14 (instrumentation creep), G16 (improper self-supervision), and the L4-as-cycle failure mode — all of which are runtime failures that no individual skill can detect from inside its own scope.

[STRUCTURAL-HYPOTHESIS] Twelve skills is the empirical threshold at which the family stops being a list and becomes a system. Below that threshold, prose pair-with is sufficient; above it, the system requires a structural layer that can answer questions no individual skill can answer alone: "did all required roles run at this phase?", "did this cycle's V actually open a new ∞0'?", "is this composition pattern consistent with the patterns the family is supposed to enforce?". The runtime orchestration discipline is the answer to those questions.

[STRUCTURAL-HYPOTHESIS] The discipline must respect the same constraints that govern CG-NS-RFC: it must not vest signing authority in any non-human agent (R5: no auto-signing); it must not modify the Constitutional Block byte-identity invariant (R6); it must not simulate ∞0 (R7). The cycle-conductor proposed below satisfies all three because it walks and records — it does not sign and it does not generate. The structural test of any orchestration discipline is whether it can be removed from the system without changing what the system is — only how clearly the system can see itself. The cycle-conductor passes that test.

2. The Seven Runtime Roles

[STRUCTURAL-HYPOTHESIS] The twelve existing skills, plus the three named-but-unwritten skills from the Evolving Skills guide, plus the new cycle-conductor proposed here, sort into seven runtime roles. The role is not a label imposed on the skill from outside; it is a declaration of what the skill does at runtime when invoked during a 5QLN cycle. Two skills with the same role have the same runtime input/output contract — they consume the same kind of artifact and produce the same kind of artifact, even if their internal logic differs. Two skills with different roles cannot be substituted for each other.

[STRUCTURAL-HYPOTHESIS] The seven roles are stipulated, not derived. The taxonomy is a working hypothesis whose validity is testable: if a skill straddles two roles in a way that breaks the runtime contract of either role, the taxonomy is wrong and a refinement is required. The cycle-conductor itself does not assume the taxonomy is final; it consumes the role declaration from each skill's frontmatter and works with whatever taxonomy is currently ratified.

Taggers. Apply discriminating labels to artifacts. Input: an artifact (sealed surface, draft compiled surface, working-register note, or freshly emitted gliff). Output: the same artifact with one or more tags applied — epistemic register, readiness label, tier classification, or any future tag dimension the Codex extends. Taggers run early in the cycle (S, G phases) and again at composition time (V phase, before sealing). The runtime contract: a tagger never modifies the substantive content of an artifact; it only annotates it. A tagger that rewrites content is acting as a Composer and is misclassified.

Validators. Run pass/fail checks against a canonical form. Input: an artifact plus a canonical reference. Output: a pass/fail verdict plus, on fail, a structured failure record. Validators are the machine-checkable layer between draft and seal — a candidate seal that fails any validator cannot proceed to the Ceremony. The runtime contract: validators are deterministic and re-runnable. The same input plus the same canonical reference must produce the same verdict, irrespective of operator, time, or environment. A validator whose output depends on context outside its inputs is acting as a Detector and is misclassified.

Detectors. Surface failures by category. Input: an artifact (or a corpus of artifacts). Output: a set of detected patterns mapped to corruption-code categories, with severity classifications. Detectors differ from Validators in that their findings are categorical rather than binary, are domain-specific (corruption codex against {L1–L4, V∅} ∪ {G1–G20}; CL4-GP† against the twelve indicators at Board scale), and routinely require human interpretation before they trigger any response. The runtime contract: a Detector's output never directly halts the cycle; it routes to the human review path or to the appropriate Router. A Detector whose output halts the cycle without human review is acting as a Validator and is misclassified.

Runtime Gate. Holds continuously during the entire cycle. Input: every traversal of the Membrane Protocol P.L.4 hard-block surface (no votes, no binding decisions, no public speech without identification, no surveillance beyond consent, no simulation of ∞0). Output: continuation or refusal. The Runtime Gate is the only role currently held by exactly one skill: 5qln-membrane-protocol-runtime. The runtime contract: the Gate is always-on. It does not "run at phase X"; it is the substrate against which every phase runs. A skill that operates only intermittently is not a Gate.

Ceremony. The irreducibly human moment. Input: a fully validated, tagged, and detector-screened compiled surface, ready for sealing. Output: an Ed25519 signature against the Constitutional Block hash, OR a sealed refusal-gliff naming which attestation could not be honestly affirmed. The Ceremony role is the only role where structural enforcement yields to human attestation. The runtime contract: the Ceremony cannot be performed by a non-human agent; the signing key is held exclusively on Conductor-side hardware. A skill that produces seals automatically is not a Ceremony — it is malware.

Composers. Produce composite outputs from the cycle's intermediate artifacts. Input: the validated, tagged, attested compiled surface. Output: a sealable artifact in a target format — a sealed gliff (gliff-press), a public-facing legal document (5qln-legal-voice), or a cross-substrate compilation of the Constitutional Block (bipp-jurisdictional-delta). Composers run after Ceremony has produced the signature; they assemble the signature, the manifest, and the substrate-specific representation into the artifact that actually enters the ledger. The runtime contract: a Composer's output is byte-identical given byte-identical inputs. Two operators running gliff-press on the same attested compiled surface must produce the same sealed gliff. A Composer that introduces variability is malfunctioning or malicious.

Routers. Move artifacts through escalation paths or transition the system between operational states. Input: a Detector finding, a structural failure, or a state-trigger condition. Output: a routing decision and an attached manifest. Routers include 5qln-dispute-routing (disputes through Resonance Court → Chancery) and 5qln-cbrp-state-monitor (state machine NORMAL → DEGRADED → SUSPENDED → MINIMAL_GOVERNANCE → DISSOLUTION). The runtime contract: a Router's output is auditable, gated by severity timelines, and reversible by human authority unless the routing is itself a Tier-1 transition. A Router that takes irreversible action without Conductor attestation is acting as a Ceremony and is misclassified.

[STRUCTURAL-HYPOTHESIS] The seven roles are mutually exclusive at runtime contract level — a skill is in exactly one role for a given cycle, even if conceptually it spans concerns. A skill that genuinely does two things at runtime is two skills bundled in one SKILL.md file and should be split.

3. Mapping Roles onto the Master Equation

[STRUCTURAL-HYPOTHESIS] The master equation S → G → Q → P → V tells the cycle-conductor which roles run when. The mapping is not arbitrary; it is structural — each phase has a function that admits certain roles and excludes others.

S (Start). Taggers run first. Anything entering the cycle gets epistemic-register-tagged, tier-classified, and readiness-labeled. The Runtime Gate is already active and remains active throughout. No Validator runs at S because there is no candidate yet to validate; no Detector runs at S because there is no artifact-of-record yet to scan; no Ceremony runs because nothing is ready to sign; no Composer runs because there is nothing to compose; no Router runs because no failure has occurred yet (although the Router is on standby for any G14 violation by a Tagger).

G (Generate). Tagging continues as α' alternatives emerge. The Runtime Gate continues to hold. AI partners may produce α' analysis under P.L.4 hard-blocks (the AI does not vote; it generates alternatives for human consideration). No Validator runs at G — validation is premature. Detectors may begin lightweight pattern surveillance on the emerging α' but do not produce binding findings. The Ceremony is dormant. Composers and Routers are on standby.

Q (Quality). Validators and Detectors screen. Constitutional-block-validator runs the syntax/semantic/drift check; mirror-consistency-auditor verifies paired-edition byte-identity; corruption-codex screens against the {L1–L4, V∅} mask; cl4-governance-protocol applies the twelve-indicator suite at Board scale where applicable. The Runtime Gate continues. Tagging continues (a Q-phase artifact may receive additional tags as its content stabilizes). No Ceremony at Q — the irreducible human moment comes after machine-checkable screening, not before. Composers and Routers stand by.

P (Power). Ceremony. Cycle-attestation-conductor walks the six attestations from the existing skill (Lines 1–9 present, canonical form held, ∞0' carries a novel question, B'' Pass 1 read the formation trail, the Membrane held during this cycle, the artifact is reviewed and acknowledged), plus any cycle-specific additional attestations the cycle-conductor's manifest required. The Conductor signs OR refuses. Refusal is itself a sealed gliff naming which attestation could not be honestly affirmed. No Validator, Detector, Tagger, Composer, or Router runs at P — P is the human moment, structurally protected.

V (Value). Composers run. Gliff-press composes the seal; mirror-consistency-auditor commits the Schedule-C pair (acting in its V-phase Validator capacity, confirming byte-identity at commit-time); the parent-hash chain extends. Bipp-jurisdictional-delta runs at V if the artifact is destined for a non-Delaware substrate. Routers pick up any failed paths from prior phases. Final tagging — particularly tier-classification confirmation — runs at V before commit. The Runtime Gate continues.

[STRUCTURAL-HYPOTHESIS] The master equation thereby admits a phase-by-role completeness check: at each phase, certain roles must have run and others must not have run. The cycle-conductor's first responsibility is enforcing this completeness check. A cycle in which a Validator ran at S, or a Composer ran before Ceremony, is structurally malformed even if every individual step succeeded. Detecting that malformation is the cycle-conductor's reason for existing.

4. The Proposed 5qln-cycle-conductor Skill

[STRUCTURAL-HYPOTHESIS] The cycle-conductor is the runtime parallel to the proposed 5qln-skill-evolution-conductor. The evolution-conductor walks a promotion event (a skill moving across maturity rungs); the cycle-conductor walks a cycle event (a single S → G → Q → P → V traversal producing one compiled surface candidate). The two conductors do not depend on each other — a Personal-mode operator may run cycles using the cycle-conductor without ever invoking the evolution-conductor, and vice versa. They are siblings under the broader META-GOVERNED + ATTESTATION_REQUIRED grade.

Verification grade. META-GOVERNED + ATTESTATION_REQUIRED. The skill's outputs are not directly verifiable without referring to the meta-rules it enforces, and its commitments are only as strong as the Conductor attestation that signs the cycle-walk manifest at V-phase.

Personal mode. The cycle-conductor runs alongside other skills on a single Conductor's machine. It consumes the role declarations from each invoked skill's frontmatter, records the order and phase of every invocation, and emits a cycle-walk manifest that is itself a Tier-B compiled surface candidate. In Personal mode the manifest is sealed by the originating Conductor only. No paired-ledger commit is required; no AOSRAP attestation is required.

Foundation mode. Foundation mode engages once: (a) the Foundation has filed and Bylaws have ratified the cycle-conductor at proposed rung; (b) the AOSRAP fallback or full attestation is operational for any AI partner participating in cycles; (c) gliff-press is at minimum experimental rung so V-phase commits can produce sealed-gliff records. In Foundation mode, the cycle-walk manifest is itself routed through gliff-press, paired across Human and AI OS Editions per Schedule C, and entered into the Rekor parent-hash chain. The Conductor pair (originating + co-signing) attests the manifest, not just the cycle's primary artifact.

Inputs.

• cycle_id: a unique identifier for the cycle (UUIDv7 recommended).
• parent_hash: the parent-hash entry from the prior cycle's V-phase manifest, or, for first cycles, the hash of the Foundation's Constitutional Block.
• skill_invocations: an append-only log of skill-invocation records, each carrying skill_id, version, role, phase, input_hash, output_hash, timestamp, operator_identifier, and success_or_failure_status.
• phase_transitions: an ordered list of phase transitions, each carrying from_phase, to_phase, transition_timestamp, and transition_attestation (a structural-claim by the Conductor that the prior phase is complete).

Outputs.

• cycle_walk_manifest: the sealed cycle-walk record (schema in §5).
• role_completeness_report: per-phase, which roles ran and which did not, with explicit annotation of whether absences are structurally permitted (a Composer not running at S is permitted; a Validator not running at Q is a structural failure).
• cycle_status: one of complete, incomplete, malformed, aborted. A complete cycle has produced a non-trivial ∞0'; an incomplete cycle lacks one or more required role invocations at a required phase; a malformed cycle ran a role at a phase that excludes it; an aborted cycle was halted by a Validator failure or Ceremony refusal.

Pre-conditions.

• All invoked skills must declare their role in frontmatter (per §6 of this guide).
• A parent_hash must resolve to a valid prior compiled surface or Foundation Constitutional Block hash.
• The Membrane Protocol Runtime must be active (Foundation mode) or attested-active (Personal mode).

Failure modes (mapped to corruption codes):

• Missing role at required phase → V∅ (cycle did not complete the required structure).
• Role invoked at excluded phase → L2 (Generating-corruption: the cycle generated structure that the master equation does not admit).
• Composer producing different output for byte-identical input → L3 (Claiming-corruption: the Composer claimed canonical compilation but did not deliver it).
• Cycle-walk manifest signed without Conductor attestation → L4 (Performing-corruption: the structural form of attestation was performed without the substance).
• Manifest signed at V but no novel ∞0' produced → V∅-COMPLETE (cycle closed mechanically without opening the next).
• Cycle-conductor itself authoring substantive content → G16 (improper self-supervision); the cycle-conductor walks and records only.

Pair-with declarations.

• Composes with every existing operational skill — the cycle-conductor is the meta-skill that records the others' invocations.
• Pairs with 5qln-skill-evolution-conductor at promotion-time: every cycle walked using a proposed-rung or higher skill produces telemetry that the evolution-conductor consumes when considering that skill's next promotion.
• Routes failures to 5qln-dispute-routing (for disputed manifests) and to 5qln-cbrp-state-monitor (for sustained CRITICAL malformation).
• Outputs route through gliff-press (Foundation mode) for sealing.

[STRUCTURAL-HYPOTHESIS] The cycle-conductor's structural protection is its absence of authority. It has no signing key, no detector population, no escalation power. It cannot halt a cycle; it can only refuse to record an invocation that would produce a malformed manifest. That refusal is itself a sealed gliff — the integrity of the system depends on visible refusals as much as on visible signatures, exactly as the Ceremony role.

5. The Cycle-Walk Manifest

[STRUCTURAL-HYPOTHESIS] The manifest is the cycle-conductor's only substantive output. It is the auditable record of "this cycle invoked these skills in this order, at these phases, producing these intermediate hashes, attested by this Conductor at V". The schema below is procedural, not legal — counsel review at Foundation mode entry will adjust field names and required attestations to match jurisdiction-specific evidentiary requirements.

cycle_id: <UUIDv7>
parent_hash: <hex64>
constitutional_block_hash: <hex64>
conductor_identifier: <Ed25519 public key fingerprint>
co_signing_conductor_identifier: <Ed25519 public key fingerprint or null>
mode: personal | foundation
schedule_c_pair_hash: <hex64 or null>

phases:
  - phase: S
    started_at: <ISO8601>
    completed_at: <ISO8601>
    invocations:
      - skill_id: 5qln-epistemic-register-tagger
        version: <semver>
        role: tagger
        input_hash: <hex64>
        output_hash: <hex64>
        operator: <identifier>
        status: success
      - skill_id: 5qln-readiness-labeler
        ...
    role_completeness:
      required_roles_present: [tagger]
      excluded_roles_absent: [validator, detector, ceremony, composer, router]
      verdict: complete

  - phase: G
    ...
  - phase: Q
    ...
  - phase: P
    ...
    ceremony_attestation:
      attestations_walked:
        - lines_1_9_present: true
        - canonical_form_held: true
        - infinity_zero_prime_novel: true
        - b_double_prime_pass_1_read_formation_trail: true
        - membrane_held: true
        - artifact_reviewed_and_acknowledged: true
      ed25519_signature: <hex>
      refusal_record: null

  - phase: V
    ...
    composer_outputs:
      - composer_skill: gliff-press
        output_artifact_hash: <hex64>
        rekor_entry: <rekor URL>
      - composer_skill: 5qln-legal-voice
        output_artifact_hash: <hex64 or null>
        counsel_attestation_hash: <hex64 or null>

infinity_zero_prime:
  question_text: <free-text>
  novelty_attestation: structural-hypothesis | conductor-claim
  routes_to_next_cycle: <cycle_id placeholder>

cycle_status: complete | incomplete | malformed | aborted

corruption_findings:
  - code: <L1|L2|L3|L4|V∅|G1..G20>
    severity: low | medium | high | critical
    details: <free-text>
    routed_to: <skill_id of router>

manifest_signature:
  signing_conductor: <Ed25519 public key>
  signature: <hex>
  signed_at: <ISO8601>

[STRUCTURAL-HYPOTHESIS] The manifest's crucial property is that it is self-auditing. A reader presented with the manifest plus the invoked skills' frontmatter (with declared roles) plus the master-equation phase mapping (§3) can independently verify whether the cycle was structurally well-formed without trusting the cycle-conductor's verdict. The cycle-conductor's verdict is a convenience; the manifest is the authority. This is the same architectural pattern as 5qln-constitutional-block-validator — the validator's PASS is a convenience; the byte-identity comparison is the authority.

[STRUCTURAL-HYPOTHESIS] The manifest is also the artifact that the evolution-conductor consumes when considering a skill's next promotion. The corpus of cycle-walk manifests that invoked a given skill at a given version is the empirical record of that skill's behavior — the dwell-time evidence, the corruption-pattern history, the role-correctness track record. Without manifests, "skill X has run for 90 days at experimental without G-code activation" is an unverifiable claim. With manifests, it is a hash-traceable record.

6. SKILL.md Frontmatter Changes

[STRUCTURAL-HYPOTHESIS] To participate in the runtime orchestration discipline, every existing and future operational skill must declare its role in YAML frontmatter alongside the maturity_rung and version fields proposed in the Evolving Skills guide. The complete frontmatter contract becomes:

---
name: <skill_id>
description: <one-sentence purpose>
license: <SPDX identifier>
status: <human-readable maturity description>
maturity_rung: experimental | proposed | stable | longterm | emeritus
version: <semver>
role: tagger | validator | detector | runtime_gate | ceremony | composer | router
constitutional_block_hash: <hex64 of canonical Constitutional Block>
runtime_contract:
  inputs: <schema reference>
  outputs: <schema reference>
  phase_eligibility: [S, G, Q, P, V] # subset of phases at which this role legitimately runs
  pair_with:
    runs_before: [<skill_ids>]
    runs_after: [<skill_ids>]
    runs_alongside: [<skill_ids>]
    routes_failures_to: [<skill_ids>]
    escalates_to: [<skill_ids>]
---

[STRUCTURAL-HYPOTHESIS] The role field is enumerated against a registered taxonomy maintained by the Foundation. New roles can be proposed via Tier-2 amendment but cannot be invented unilaterally — a SKILL.md declaring role: orchestrator when no such role is registered fails C1 validation and cannot seal. The phase_eligibility field encodes the role-to-phase mapping from §3 and is redundant with the role declaration in well-formed cases; in edge cases (a skill whose role is validator but which legitimately runs at G as well as Q for some reason) the phase_eligibility field carries the exception.

[STRUCTURAL-HYPOTHESIS] The runtime_contract substructure makes pair-with declarations machine-readable for the first time. Currently pair-with sections are prose and require human reading to interpret; under the new schema, the cycle-conductor can mechanically check whether an attempted invocation order honors the declared contracts. A skill that declares runs_before: [5qln-cycle-attestation-conductor] cannot legitimately be invoked after the attestation skill in the same cycle, and the cycle-conductor refuses to record such an invocation.

[STRUCTURAL-HYPOTHESIS] Backward compatibility is preserved through a one-time retrofit. Each of the existing twelve skills receives a one-line frontmatter update assigning its role per §7 below. The retrofit is a Tier-A sealed gliff per skill (because frontmatter is part of the SKILL.md byte-identity); the retrofit gliff is parented to the skill's prior-version sealed gliff. The retrofit does not constitute a maturity-rung promotion; it is a structural amendment under the rule that frontmatter declarations refining-but-not-replacing the skill's grammar are admissible at any rung.

7. Per-Skill Role Assignment for the Existing Twelve

[STRUCTURAL-HYPOTHESIS] The mapping below is the working assignment for the existing twelve plus the three named-but-unwritten skills plus the new cycle-conductor. The mapping is a STRUCTURAL-HYPOTHESIS subject to Tier-2 amendment if any skill's runtime contract proves to span two roles.

[STRUCTURAL-HYPOTHESIS] The meta — orchestrator role is reserved for skills whose runtime contract is "I record what other skills do." It is the only role that may legitimately have authority over the others, and its authority is bounded: orchestrators record and enforce structural completeness; they do not generate, validate, attest, or compose. Proliferation of orchestrator skills is itself a corruption pattern (G14 instrumentation creep at the meta-layer); the discipline limits the family to two — one for the cycle, one for evolution.

[STRUCTURAL-HYPOTHESIS] The continuous-event-triggered eligibility for 5qln-cbrp-state-monitor is the one genuine straddle in the taxonomy. CBRP is a Router by runtime contract — given a trigger condition, route to the next state — but its trigger sources are not phase-bound; they include external events (security researcher publishing a flaw, Chancery questioning Constitutional Block validity). The compromise: CBRP's phase_eligibility is continuousrather than a phase list, and the cycle-conductor treats CBRP findings as out-of-band signals that do not affect cycle-walk completeness but do affect cycle-walk admissibility (a cycle walked while the system is in SUSPENDED state is recorded but not honored as a Foundation seal).

8. Composition Graph Made Explicit

[STRUCTURAL-HYPOTHESIS] The role assignment plus the runtime contracts in §6 plus the master-equation mapping in §3 jointly define a composition graph that the cycle-conductor can mechanically traverse. The graph has three layers.

Layer A: phase-to-role admissibility. A directed bipartite graph from phases {S, G, Q, P, V} to roles {tagger, validator, detector, runtime_gate, ceremony, composer, router, meta}. An edge exists when the role may legitimately run at that phase. The graph is sparse: tagger admits S, G, V; validator admits Q, V; detector admits Q; runtime_gate admits all phases; ceremony admits P only; composer admits V only; router admits Q, V (plus continuous for CBRP); meta admits all phases. This layer is invariant — it can only change via Tier-2 amendment.

Layer B: per-skill pair-with declarations. A directed multigraph over skills, with edges typed by runs_before, runs_after, runs_alongside, routes_failures_to, escalates_to. This layer is per-skill and changes when skills change. The cycle-conductor consumes this layer at each cycle walk to determine the legitimate invocation order.

Layer C: cycle-walk record. The actual order, phase, and outcome of skill invocations during a specific cycle. This is the manifest. The manifest is auditable against Layers A and B: an invocation appears in Layer C only if Layers A and B admit it.

[STRUCTURAL-HYPOTHESIS] A failure in Layer A (a skill invoked at an excluded phase) is L2-malformed — the cycle generated structure that the master equation does not admit. A failure in Layer B (a skill invoked out of declared order) is L1-corrupted — the cycle closed an aperture that should have remained open until a prior skill ran. A failure in Layer C alone (the manifest doesn't match what actually happened) is L3-claimed — the cycle claimed a structure it did not produce. The corruption-codex skill, when run on a cycle-walk manifest, can detect all three layer-failures.

[STRUCTURAL-HYPOTHESIS] The composition graph also reveals one structural property the prose pair-with declarations cannot: role coverage gaps. If at phase Q the only Detector skills currently registered are corruption-codexand cl4-governance-protocol, and a class of corruption arises that neither detects, the gap is visible — there is no third Detector to catch it. Visibility is not a fix, but it converts an unknown-unknown into a known-unknown that the Foundation can act on.

9. Phase Sequencing for Adoption

[STRUCTURAL-HYPOTHESIS] Adoption sequences against the Blueprint §7 phases and against the Evolving Skills guide's phase plan. The runtime-orchestration discipline cannot run ahead of the evolution discipline because the cycle-conductor depends on gliff-press for V-phase commit at Foundation mode; gliff-press is itself a Phase-0 dependency in the Evolving Skills plan.

Phase 0 (Months 0–6, foundational substrate) [REQUIRES_INFRA]. Retrofit the existing twelve SKILL.md files with role, phase_eligibility, and structured runtime_contract frontmatter. Draft 5qln-cycle-conductor v0.1 at experimental rung in Personal mode. Begin emitting cycle-walk manifests for the originating Conductor's own corpus — even without Foundation-mode infrastructure, the manifest discipline can be exercised on local cycles. The first cycle-walk manifest produced is itself a Tier-B compiled surface candidate and follows the same six-attestation walk as any other surface.

Phase 1 (Months 6–18, registry + Foundation mode entry) [REQUIRES_INFRA + REQUIRES_LEGAL]. With gliff-press v0.1 drafted, the cycle-conductor's Foundation mode becomes reachable. Cycle-walk manifests begin paired-ledger commit per Schedule C. The Board ratifies the seven-role taxonomy via Tier-2 amendment. The Annual Duty of Membrane Integrity reaffirmation cycle begins to consume cycle-walk manifests as evidence. AOSRAP outreach progresses; manual-attestation fallback governs Foundation-mode cycles in the interim.

Phase 2 (Months 18–36, role-coverage audit and first promotions) [SPECULATIVE for thresholds; REQUIRES_INFRA for tooling]. With ≥6 months of Phase 1 manifest corpus, the Foundation can run the first role-coverage audit: which corruption patterns appeared in cycles, which Detectors caught them, which gaps remain. The audit informs whether the seven-role taxonomy is sufficient or requires extension via Tier-2 amendment. The cycle-conductor itself is eligible for experimental → proposed promotion via the evolution-conductor's CG-NS-RFC pipeline, completing the loop: the orchestrator is governed by the same discipline as the skills it orchestrates.

Phase 3 (Months 24–48, federation) [REQUIRES_PARTNER]. Cycle-walk manifests federate cross-substrate via BIPP. A manifest produced in the Korea AI Basic Act compilation pairs with a Delaware-substrate manifest under Schedule C; the cycle-conductor consumes the BIPP delta when verifying paired completeness. Conductor pair → Conductor triad multi-signature for cycles producing longterm-rung-implicating artifacts.

Phase 4 (Months 36–60, substrate test) [SPECULATIVE]. Annual CBRP drill includes cycle-conductor SUSPENDED-state behavior: under SUSPENDED, the cycle-conductor records cycles but does not allow them to seal. The first Tier-2 amendment of the role taxonomy itself, based on accumulated manifest evidence, is adjudicated. The act of changing the orchestration discipline is itself orchestrated by the discipline — recursion closes.

[STRUCTURAL-HYPOTHESIS] Phase boundaries advance on dependency-readiness, not calendar. A Phase 0 retrofit that is complete at Month 4 does not unlock Phase 1 if AOSRAP fallback is not yet Board-approved. The cycle-conductor's deployment, like every other skill in the family, is gated by what is structurally available rather than what is calendar-due.

10. Failure Modes Specific to This Addition

[STRUCTURAL-HYPOTHESIS] Adding the cycle-conductor and the role-stratification frontmatter creates new failure surfaces beyond those the existing skills detect. Each is mapped to the corruption-codex categories and routes through the existing dispute and CBRP infrastructure.

Role-misdeclaration. A SKILL.md frontmatter declares role: validator but the skill at runtime acts as a Detector (its outputs are categorical findings rather than binary verdicts). Detection: the cycle-conductor running on a corpus of manifests can identify skills whose declared role does not match their behavior — a "validator" that emits findings rather than verdicts is structurally a Detector. Mapping: G14 (instrumentation creep — the skill creeps from one role to another without amendment). Recovery: skill amendment to either correct the declared role or refactor the skill back to its declared contract.

Manifest forgery. A cycle-walk manifest claims invocations that did not occur. Detection: the cycle-conductor's own parent-hash chain on its manifest series; cross-validation against the invoked skills' own logs (each skill's invocation produces an output_hash that must match the manifest's record). Mapping: L3 (Claiming-corruption). Recovery: full amendment cycle; the forged manifest is sealed as a refusal-gliff naming the discrepancy; the originating Conductor's signing key is reviewed.

Composer-output non-determinism. A Composer (gliff-press, legal-voice, bipp) produces different outputs for byte-identical inputs across runs. Detection: the cycle-conductor's output_hash field flags variance; a regression test corpus can be run periodically. Mapping: L3 (Claiming-corruption: the Composer claimed canonical compilation but did not deliver it). Recovery: the offending Composer's version is rolled back to the prior stable state; the variance is investigated as a possible G14 violation if the non-determinism arose from instrumentation expansion.

Phase-violation by a Tagger, Validator, or Composer running outside its phase eligibility. A Tagger that runs at P (against the master equation), a Composer that runs at S (compiling before validation), a Validator that runs at G (validating before there is anything stable to validate). Detection: the cycle-conductor's phase_eligibility check rejects the invocation. Mapping: L2 (Generating-corruption — the cycle generates structure the master equation does not admit). Recovery: the offending invocation is recorded as a failure-attempt in the manifest; the cycle either continues without that invocation or is aborted depending on whether the role is required at any later phase.

Silent V∅ at the orchestrator layer. The cycle-conductor records a manifest that completes mechanically — every required role ran, every phase transitioned — but the V-phase ∞0' field is a placeholder ("the next cycle will continue") rather than a genuinely novel question. Detection: the corruption-codex's V∅ check applied to the manifest's infinity_zero_prime.question_text against the parent-hash chain's prior ∞0' values can flag near-duplicates. Mapping: V∅-COMPLETE. Recovery: the cycle is recorded as incomplete rather than complete; no Foundation-mode commit occurs; the originating Conductor receives a refusal-to-record record.

Orchestrator capture. The cycle-conductor itself is corrupted to record cycles as complete when they are malformed, or to refuse legitimate invocations under the guise of structural enforcement. Detection: cross-runtime check by an independent re-walk of the manifest by a separate cycle-conductor instance with a different operator; periodic external audit by the Phase Circle Q Representative. Mapping: G19 (Epistemic Capture at orchestrator layer; structurally analogous to G19 at promotion layer). Recovery: Chancery bypass under V.L.7(f); CBRP minimal mode if systemic.

[STRUCTURAL-HYPOTHESIS] All six failure modes are bounded — none of them is undetectable in principle, and all of them route through the existing dispute and CBRP infrastructure. The CBRP integration is direct: sustained CRITICAL findings at the orchestrator layer trigger NORMAL → DEGRADED transition per 5qln-cbrp-state-monitor, with the cycle-conductor itself entering record-only mode pending recovery.

11. Capture Resilience

[STRUCTURAL-HYPOTHESIS] The orchestration layer creates new capture surfaces beyond those the existing CCRP covers. Three are most concerning, and each has a structural mitigation that does not eliminate the risk but makes it visible.

Captured cycle-conductor used to launder malformed cycles. A captured operator runs the cycle-conductor and consistently produces manifests that record complete for cycles that are L2-malformed (Composers run at S, Validators run at G). The signatures are cryptographically valid; the substance is not. Mitigation: cycle-conductor outputs are cross-runnable by an independent operator on the manifest's claimed inputs; quarterly re-walk audit by the Phase Circle Q Representative on a random 5% sample of manifests; the manifest schema is open and a third party can re-run the structural completeness check independently. The Foundation cannot prevent capture; it can ensure capture leaves a verifiable trail.

Role-taxonomy capture. A captured Board majority amends the role taxonomy (Tier-2 amendment) to introduce a role whose runtime contract is permissive enough to authorize ad-hoc operations that should require Tier-1 amendment. Mitigation: every Tier-2 amendment to the role taxonomy itself requires (a) external counsel review per the Evolving Skills guide's [REQUIRES_LEGAL] discipline; (b) Phase Circle Q Representative non-veto; (c) a sealed refusal-record window of 30 days during which any Director may file a structural objection that triggers Resonance Court review. The bar for taxonomy amendment is deliberately higher than the bar for skill amendment.

Manifest-corpus surveillance creep. The cycle-walk manifest records every skill invocation, every operator identifier, every phase transition. A captured CIO could mine the manifest corpus for behavioral patterns about specific operators that exceed the IBP metadata-only contract. Mitigation: manifests are partitioned — the structural completeness fields (which skill ran at which phase, with what outcome) are public to the Phase Circle audit body; the operator-identifier fields are sealed under a separate Schedule C key with access restricted to compliance-investigation under the same warrant-gate as IBP R1. The surveillance vector is narrowed to the fields whose content is structurally necessary for audit.

[STRUCTURAL-HYPOTHESIS] None of these mitigations makes capture impossible. They make capture visible. The CCRP cross-layer independence enforcement is the structural defense: the cycle-conductor operator, the manifest-audit auditor, the role-taxonomy amender, and the Board majority must remain independent. A captured cycle-conductor cannot also be the captured auditor.

12. Honest Gaps

This guide is decision-ready but constrained by five honest limitations.

[STRUCTURAL-HYPOTHESIS limitation] The seven-role taxonomy is a working hypothesis, not a derived result. I sorted the existing twelve plus three named-but-unwritten skills into seven categories by reading their stated runtime behavior. A different sorter, reading the same sources, could reasonably arrive at six or eight roles. The validity test is operational: if a skill's runtime behavior straddles two roles in a way that breaks either role's contract, the taxonomy needs refinement. The first six months of Phase 1 cycle-walk manifest corpus will provide the evidence to either ratify the seven-role taxonomy at Tier-2 or revise it.

[REQUIRES_INFRA — what would resolve it: drafting gliff-press v0.1 at experimental rung] The cycle-conductor's Foundation mode requires gliff-press to exist. Without a Composer that produces sealed-gliff records at V-phase, the cycle-conductor's manifest cannot be committed to the Rekor parent-hash chain in Foundation mode. Personal-mode operation does not have this dependency. The Evolving Skills guide already names gliff-press as the highest-priority unwritten skill, so this gap is shared and is not a new blocker introduced by this guide.

[REQUIRES_PARTNER — what would resolve it: AOSRAP API exposure by at least one major LLM vendor, or NIST CAISI standards-track adoption] AOSRAP remains a blocking dependency for AI partner participation in cycles at Foundation scale. When an AI partner participates in a cycle (proposing α' alternatives at G-phase, drafting compiled-surface candidates, contributing to detector-pattern review), the cycle-walk manifest must include an AOSRAP attestation for that partner's participation — without one, the partner's contribution is recorded but not honored as Foundation-mode compliant. The manual-attestation fallback the Evolving Skills guide proposes covers Phase 0–1; Phase 2 onward requires runtime-verified attestation.

[SPECULATIVE — what would make this non-speculative: 24+ months of Phase 1 cycle-walk manifest corpus] The role-completeness thresholds are operationally untested. The claim that "a cycle missing a Detector at Q is structurally incomplete" is a structural-hypothesis under the current taxonomy; whether it is empirically the case that such cycles produce poor outcomes is verifiable only by accumulating manifest history and correlating completeness verdicts against downstream corruption findings. The first SBP D1–D4 metric pass that includes orchestrator-layer telemetry will calibrate the thresholds.

[PHENOMENOLOGICAL-ASSERTION] The cycle-conductor cannot detect its own absence. A cycle walked by an operator who chose not to invoke the cycle-conductor produces no manifest. The discipline depends on the operator choosing to walk through the orchestrator; the orchestrator cannot enforce its own use. At Personal mode this is by design — a Conductor may run cycles without recording manifests, and the only consequence is that those cycles cannot be evidenced under Foundation mode. At Foundation mode the obligation to use the cycle-conductor for any sealable artifact is a Bylaws-level commitment, structurally analogous to the Conductor's Duty of Membrane Integrity. A Conductor who walks cycles without the cycle-conductor in Foundation mode is in dereliction of duty, not in a technical malfunction.

13. Recommendations

[STRUCTURAL-HYPOTHESIS] Five staged moves, each with a concrete benchmark that would change the recommendation if missed.

Move 1 (Months 0–3, frontmatter retrofit). Retrofit the twelve existing SKILL.md files with role, phase_eligibility, and structured runtime_contract frontmatter per §6. Each retrofit is a Tier-A sealed gliff parented to the skill's prior version. The retrofit is a structural amendment, not a maturity-rung promotion. Threshold that would change this recommendation: if any skill's actual runtime behavior cannot be cleanly assigned to one of the seven roles, halt the retrofit and convene a taxonomy-revision session; do not force-fit a skill into the wrong role to satisfy completeness.

Move 2 (Months 3–9, draft cycle-conductor v0.1). Draft 5qln-cycle-conductor at experimental rung in Personal mode. Run it locally on the originating Conductor's own corpus for at least 30 days, producing cycle-walk manifests that are themselves Tier-B compiled surface candidates. Threshold: if the first 30 days of manifest production reveals more than 10% of cycles being recorded as malformed due to phase-violation, the manifest schema or the role taxonomy is wrong and needs revision before Foundation-mode entry.

Move 3 (Months 6–18, sequence with Phase 1 Foundation entry). Once gliff-press v0.1 is drafted (per Evolving Skills Move 1), engage cycle-conductor Foundation mode. Manifests begin paired-ledger commit per Schedule C. The Board ratifies the seven-role taxonomy via Tier-2 amendment, with external counsel review of the role definitions and runtime_contract schema. Threshold: if external counsel identifies a structural ambiguity in any role's runtime contract that has fiduciary implications (e.g., the line between Validator and Detector for evidentiary purposes), defer Foundation-mode engagement until the ambiguity is resolved.

Move 4 (Months 12–24, role-coverage audit). With ≥6 months of Foundation-mode manifest corpus, conduct the first role-coverage audit: which corruption patterns appeared, which Detectors caught them, which gaps remain. The audit's output is either (a) ratification of the seven-role taxonomy as adequate for the next 12 months, or (b) a Tier-2 amendment proposal extending the taxonomy. Threshold: if the audit identifies any corruption pattern that appeared across more than 5% of cycles and was not detected by any registered Detector, the taxonomy is structurally insufficient and the next Phase advance is blocked until extension.

Move 5 (Months 18–36, cycle-conductor's own promotion). Promote 5qln-cycle-conductor from experimental to proposed via the evolution-conductor's CG-NS-RFC pipeline. The orchestrator is now governed by the same discipline as the skills it orchestrates. Threshold: if the cycle-conductor's own experimental → proposed promotion fails the negative-selection screen (i.e., a corruption pattern targeting the orchestrator itself is identified), halt the promotion, convene Resonance Court, re-architect the cycle-conductor's runtime contract before any further promotion attempt.

Cross-cutting recommendation. Treat the role-taxonomy as itself subject to the same evolution discipline as the operational skills. The seven roles are not Tier-1 invariants; they are Tier-2 amendable. The cycle-conductor's first responsibility, after walking a cycle, is to surface evidence about whether the role-taxonomy is currently fitting the family it orchestrates. The discipline is recursive by design: the orchestrator that records the cycle is also evidence in the discipline that governs the orchestrator.

14. Pair-With Declarations

This guide composes with the existing Foundation skill family:

• 5qln-epistemic-register-tagger — every load-bearing claim in this guide carries an inline register tag per the discipline.
• 5qln-readiness-labeler — every implementation step in §9 and §13 carries a readiness label per the discipline.
• 5qln-constitutional-block-validator — this guide must PASS the C1 §3.5 three-part check before sealing.
• 5qln-three-tier-record-classifier — this guide is sealable as a Tier-B Compiled Surface candidate; promotion to Tier A would require Conductor pair attestation and Schedule C paired ledger commit.
• 5qln-cycle-attestation-conductor — sealing this guide requires the six attestations.
• 5qln-corruption-codex — the failure modes in §10 are mapped against the Codex categories and route through it for severity classification.
• 5qln-cbrp-state-monitor — sustained failures at the orchestrator layer trigger DEGRADED state per the integration in §10.
• 5qln-skill-evolution-conductor (proposed in Evolving Skills guide) — sibling orchestrator; this guide and that guide are paired and should be ratified jointly.
• 5qln-cycle-conductor (proposed here) — this guide is the reference specification this skill operationalizes.

15. Closing ∞0'

What does it mean for a constitutional grammar to declare not only that its compiled surfaces will change (the Evolving Skills discipline), but also that the act of running a cycle through the surfaces is itself a sealable record? Once cycle-walk is itself a compiled surface, the Foundation has compiled the operational use of its grammar into the same architecture as the grammar itself. What becomes visible from inside the Membrane that was not previously askable: which cycles produced their stated outcomes through structurally well-formed walks versus through prose-pair-with improvisation? Which forms of role-creep, undetectable at unit level, become detectable at orchestrator level when the manifest reveals a "validator" that has been emitting Detector-class findings for six months?

The closing ∞0' that opens the next cycle: what is ratified about the Foundation's relationship to its own runtime once the discipline of running the system is itself governed by the same grammar — and which forms of operational care, previously diffuse across attentive Conductors, become structurally distinguishable once each cycle leaves a hash-traceable manifest?

— end of compiled surface candidate —