-- Meta-Constitutional Declaration
-- This is not valid user-level SIGNAL syntax
-- These are properties of the language itself

meta_principle I {
    label: "The Enforcement Completeness Principle"
    statement:
        "Every declared constraint, rule, and state machine must be evaluated
         on every relevant mutation. No mutation path through a correct SIGNAL
         interpreter bypasses governance. Enforcement is unconditional or the
         interpreter is incorrect."
    consequence:
        "A SIGNAL interpreter that permits any governed mutation to bypass
         constraint evaluation is a non-conforming interpreter. Programs may
         not assume that non-conforming interpreters exist."
}

meta_principle II {
    label: "The Finite State Principle"
    statement:
        "Every entity whose fields are fully typed to declared domains has a
         finite, enumerable state space. The set of all possible states of
         a SIGNAL program is computable."
    consequence:
        "SIGNAL programs over finite domains are fully verifiable. Every
         reachable state can be checked against every constraint. Coverage
         is not statistical — it is total."
}

meta_principle III {
    label: "The Causal Transparency Principle"
    statement:
        "Every automated decision in a SIGNAL system has a complete,
         retrievable causal chain: the mutation that triggered it, the rule
         that evaluated it, the condition that was satisfied, the action
         that was taken, and the entity state before and after."
    consequence:
        "No automated decision is unexplained. The explanation may be
         computationally complex to retrieve but is always present.
         A system that cannot produce a causal chain for any decision
         is non-conforming."
}

meta_principle IV {
    label: "The Conservation Principle"
    statement:
        "Constraints declared as constitutional are monotone: they cannot
         be satisfied and then unsatisfied by any sequence of legal mutations.
         If a constitutional constraint holds at time T, it holds at all
         times T' > T, or a constitutional violation has occurred."
    consequence:
        "Constitutional constraints are not just enforced — they are
         invariant. The constitution does not oscillate. Violations are
         not transient states to be corrected; they are formal events
         that require documented resolution."
}

meta_principle V {
    label: "The Sovereignty Principle"
    statement:
        "Every SIGNAL program has exactly one constitution. The constitution
         is the supreme authority within its program boundary. No external
         program, no bridge, no federation, and no Council review can override
         a program's constitutional constraints without an amendment through
         the declared amendment process."
    consequence:
        "Programs are sovereign over their own domains. Inter-program
         governance operates through declared bridges and federation
         protocols, never through direct constitutional override."
}

meta_principle VI {
    label: "The Explanation Completeness Principle"
    statement:
        "Every inference, every Council review, and every learned rule
         decision must produce a stored, typed, auditable explanation
         artifact at the time of the decision. Explanations cannot be
         reconstructed post-hoc — they must be produced contemporaneously."
    consequence:
        "AI-augmented governance is not a black box. The combination of
         inference versioning, Council audit trails, and explanation
         primitives makes every AI-assisted decision as auditable as
         any manually-authored rule."
}

meta_principle VII {
    label: "The Completeness Principle"
    statement:
        "A SIGNAL program is complete if and only if: every signal has
         at least one handler, every domain is fully covered by all
         pattern-matching functions that reference it, every state
         machine has at least one terminal state reachable from every
         state, and every constitutional constraint is jointly satisfiable."
    consequence:
        "An incomplete SIGNAL program is a compile error, not a runtime
         failure. Incompleteness is a property of the program text,
         detectable before any execution occurs."
}

meta_verify {
    -- Principle I: enforcement completeness
    all_mutations_governed()
    no_interpreter_bypass_paths()

    -- Principle II: finite state
    all_entity_states_finite()
    all_domains_enumerable()

    -- Principle III: causal transparency
    all_decisions_traceable()
    explanation_artifacts_present_for: [ALL inference, ALL council, ALL learned_rule]

    -- Principle IV: constitutional monotonicity
    constitutional_constraints_are_monotone()

    -- Principle V: sovereignty
    no_external_constitutional_override()
    amendment_process_declared()

    -- Principle VI: explanation completeness
    all_inference_explanations_contemporaneous()
    all_council_reviews_audited()

    -- Principle VII: program completeness
    all_signals_handled()
    all_domains_covered_in_patterns()
    all_state_machines_have_terminal()
    constitutional_constraints_jointly_satisfiable()
}

language_version 4.0 {
    parts:       [I, II, III, IV]
    interpreter: "signal-runtime >= 4.0.0"
    strict:      true         -- all meta-verify checks enforced
    warnings_as_errors: true  -- no warnings in production programs

    -- Compatibility: this program accepts programs authored against
    -- prior versions as valid inputs via defined upgrade paths
    accepts_programs: [
        { version: "3.x", via: automatic_migration },
        { version: "2.x", via: guided_migration },
        { version: "1.x", via: manual_migration }
    ]
}

sensor TemperatureSensor {
    hardware_id:  String    where matches(/^TEMP-[0-9]{6}$/)
    zone_id:      UUID

    -- What the sensor produces
    reading: {
        temperature_c: TemperatureC
        humidity_pct:  Percentage
        timestamp:     DateTime
        confidence:    Float    where value >= 0.0 AND value <= 1.0
    }

    -- How readings are validated before entering the domain model
    validation: {
        temperature_c: within(-30.0, 50.0)
        reading_interval: between(30s, 2m)   -- reject readings outside this interval
        confidence_floor: 0.85               -- reject low-confidence readings
    }

    -- What happens when readings are invalid or absent
    on_invalid_reading:  log_and_use_last_valid
    on_missing_reading:  {
        after:   5m   -> warn(ZoneTemperatureReadingMissing, zone_id)
        after:   15m  -> set StorageZone.sensor_status = "degraded"
        after:   30m  -> invoke(TriggerColdChainManualInspection, zone_id)
    }

    -- Calibration: when the sensor needs recalibration
    calibration_interval: 90d
    on_calibration_due:   warn(SensorCalibrationRequired, hardware_id)
}

sensor BarcodeScanner {
    hardware_id:  String
    worker_id:    UUID     -- which worker is using this scanner

    reading: {
        barcode:   String
        scan_time: DateTime
        location:  { aisle: String, bay: String }
    }

    validation: {
        barcode: matches(/^[A-Za-z0-9\-\.]{1,128}$/)
    }

    on_invalid_scan: prompt_rescan
}

sensor WeightScale {
    hardware_id:   String
    bin_id:        UUID

    reading: {
        weight_kg:  Float   where value >= 0.0
        timestamp:  DateTime
    }

    -- Automatic reconciliation: when the scale reading diverges
    -- from the system's expected weight for the bin
    reconciliation_trigger: {
        when: abs(reading.weight_kg - expected_bin_weight(bin_id)) > 0.5
        then: emit(WeightDiscrepancyDetected, {
                  bin_id:         bin_id,
                  expected_kg:    expected_bin_weight(bin_id),
                  measured_kg:    reading.weight_kg,
                  delta_kg:       reading.weight_kg - expected_bin_weight(bin_id)
              })
    }
}

actuator ConveyorBelt {
    hardware_id:   String
    zone_id:       UUID

    commands: {
        start:   { speed_mps: Float where value >= 0.1 AND value <= 2.0 }
        stop:    {}
        reverse: { speed_mps: Float where value >= 0.1 AND value <= 0.5 }
        set_destination: { bin_code: String }
    }

    -- Safety constraints: these are meta-constitutional for the actuator
    -- They cannot be overridden by any rule or workflow
    safety_constraints: {
        cannot_start_during: [EmergencyStop, SafetyHold]
        requires_clearance_from: SafetyZoneSensor
        max_speed_in_occupied_zone: 0.3
    }

    on_command_failure: {
        retry:  2 with backoff 1s
        then:   emit(ActuatorCommandFailed, { actuator_id: hardware_id, command: failed_command })
    }
}

actuator PrintLabel {
    hardware_id:   String
    printer_zone:  String

    commands: {
        print: {
            template:   String
            data:       Map<String, String>
            copies:     Int where value >= 1 AND value <= 10
        }
        reprint: { job_id: UUID }
    }

    on_paper_out:    emit(PrinterPaperOutAlert, { printer_id: hardware_id })
    on_jam:          invoke(PrinterJamResponse, hardware_id)
}

reconciliation InventoryPhysicalReconciliation {
    model_entity:  InventoryLot
    physical_source: WeightScale
    schedule:      every_cycle_count AND on_demand

    -- How to detect divergence
    divergence_threshold: {
        qty:     abs(model.qty_on_hand - physical_estimate.qty) > 2.0
        value:   abs(model.qty_on_hand - physical_estimate.qty) * unit_cost > 100.0
    }

    -- How to measure physical reality
    physical_estimate: {
        method:    weight_based
        formula:   scale_reading.weight_kg / sku.weight_kg
        confidence: scale.reading.confidence
    }

    -- What to do when divergence is detected
    on_divergence: {
        below_threshold: {
            log_discrepancy: true
            create_cycle_count_task: true
            auto_adjust_after: confirmed_by_second_scan
        }
        above_threshold: {
            create_cycle_count_task: true
            hold_affected_lots: true
            notify:              [InventoryManager, QualityTeam]
            requires_approval_for_adjustment: InventoryManager
        }
        critical: {
            -- Divergence > 50% of lot quantity
            halt_picks_from_affected_bin: true
            notify:                       [WarehouseDirector]
            escalate_to:                  ManualFullCountProtocol
            requires_council_review:      true
        }
    }

    -- The formal reconciliation record
    creates: ReconciliationRecord {
        lot_id:              UUID
        model_qty:           Float
        physical_qty:        Float
        divergence:          Float
        divergence_pct:      Float
        method:              String
        approved_by:         UUID?
        adjustment_applied:  Bool
        timestamp:           DateTime
        @audit_trail(retention: 7y)
    }
}

physical_constraint TemperatureLaw {
    statement: "Temperature in a sealed refrigerated zone cannot change by more than
                3°C per hour without mechanical failure or door opening"
    observed_via: TemperatureSensor
    violation_means: sensor_failure OR door_open OR equipment_failure

    on_apparent_violation: {
        do_not_adjust_model_to_match: true
        -- Physical constraints cannot be "fixed" by updating the model
        -- A model that disagrees with physical law has a bad sensor, not bad reality
        instead: invoke(InvestigatePhysicalAnomaly, zone_id)
    }
}

physical_constraint MassConservation {
    statement: "The total mass of goods in a bin cannot decrease without
                a recorded stock removal event"
    observed_via: WeightScale
    violation_means: theft OR unrecorded_removal OR scale_failure OR damage

    on_apparent_violation: {
        emit: UnexplainedStockReduction
        create: SecurityIncidentRecord
        do_not_auto_adjust: true
    }
}

constitutional_authority {
    level:   2           -- 1=sovereign, 2=delegated, 3=subordinate
    -- Level 1: sovereign programs answer to no external authority
    -- Level 2: delegated programs operate under level-1 authority
    -- Level 3: subordinate programs operate under level-2 authority

    granted_by: null     -- level 1 programs are self-authorising
    -- granted_by: { program: "MCMPrimeEngine", since: "2026-01-01" }

    scope: {
        temporal:     indefinite
        geographic:   "US"
        domain:       "capital_management"
        entities:     [CapitalCycle, CapitalPool, ReinvestmentAllocation]
    }

    delegates_to: [
        { program: "DebtPaybackEngine",   level: 2, scope: "debt_management" },
        { program: "EconomiesOfScale",    level: 2, scope: "production_economics" }
    ]
}

conflict_resolution CapitalSystemConflictProtocol {
    programs:  [MCMPrimeEngine, DebtPaybackEngine, EconomiesOfScale]
    authority: MCMPrimeEngine   -- level-1 program resolves conflicts

    protocols: {

        -- When two programs both reject a mutation for different reasons
        dual_rejection: {
            apply:  both_rejections    -- the mutation is rejected, both reasons recorded
        }

        -- When one program approves and another rejects
        split_decision: {
            default: higher_authority_prevails
            except_when: {
                -- Safety and compliance always override economics
                rejecting_program_has_constraint_class == "safety"    -> reject
                rejecting_program_has_constraint_class == "compliance" -> reject
                -- Constitutional constraints always override policy constraints
                rejecting_constraint_is_constitutional == true          -> reject
            }
        }

        -- When both programs approve but with different parameters
        parameter_conflict: {
            apply: conservative    -- take the more restrictive parameter
            -- e.g., both approve a payment but with different amounts:
            --       MCMPrime says max $50,000; DebtPayback says max $30,000
            --       resolution: $30,000 (conservative)
        }

        -- Deadlock: programs cannot agree within timeout
        deadlock: {
            timeout:  30s
            resolution: human_escalation
            escalate_to: [SystemAdministrator, GUC.review(posture: critical)]
        }
    }

    audit: ConstitutionalConflictLog {
        records: [conflict_type, programs_involved, resolution_applied, outcome, timestamp]
        @audit_trail(retention: permanent)
    }
}

treaty MCMPrimeDebtPayback {
    parties:     [MCMPrimeEngine, DebtPaybackEngine]
    version:     "1.0.0"
    effective:   "2026-01-01"
    reviewed:    every 365d

    -- What each party agrees to
    MCMPrimeEngine_agrees: {
        to_accept:       DebtFreedomAchieved signal as triggering capital deployment
        to_provide:      CapitalPool.available_capital on request from DebtPaybackEngine
        not_to_deploy:   capital_while_debt_payback_plan_is_active
                         AND plan.monthly_surplus < 0.0
    }

    DebtPaybackEngine_agrees: {
        to_accept:       CapitalPool.recommended_surplus_allocation as advisory
        to_notify:       MCMPrimeEngine when plan.strategy changes
        not_to_exceed:   monthly_budget > MCMPrimeEngine.available_for_debt_service
    }

    -- Shared invariants: both programs agree these must always hold
    joint_invariants: {
        "Total monthly obligations (debt service + capital deployment) <= monthly_income"
        "Capital deployment cannot begin until debt_payback_plan.status == complete
         OR explicit override approved by council with score >= 0.80"
    }

    -- What happens when the treaty is violated
    on_violation: {
        notify:       [both_program_administrators, GUC]
        resolution:   council_mediation
        suspension:   treaty_suspended_pending_resolution
    }

    @audit_trail(retention: permanent)
    @council_reviewed(by: GUC, posture: strategic, score: 0.88, at: "2026-01-01")
}

hierarchy BrotherhoodApexConstitutionalHierarchy {
    sovereign:   BrotherhoodApexModule
    -- The Brotherhood Apex module is the sovereign — its constitution
    -- is the supreme authority for the personal economics system

    delegated: [
        {
            program:    MCMPrimeEngine
            authority:  "capital_management"
            level:      2
            treaty:     MCMPrimeDebtPayback
        },
        {
            program:    DebtPaybackEngine
            authority:  "debt_management"
            level:      2
            treaty:     MCMPrimeDebtPayback
        },
        {
            program:    EconomiesOfScale
            authority:  "production_economics"
            level:      2
            treaty:     null    -- no bilateral treaty, governed by sovereign only
        }
    ]

    -- The personal economic identity that gives the hierarchy its purpose
    governed_for:  PersonalEconomicActor   -- the individual whose economics this governs

    -- The hierarchy's own constitution
    hierarchy_constitution: {
        supreme_principle: "The governed individual's long-term economic
                           freedom is the sovereign purpose. All programs
                           in this hierarchy serve that purpose. Any program
                           whose constitution conflicts with that purpose
                           has been misconfigured."
        amendment_requires: governed_individual.explicit_consent
    }
}

SIGNAL Evaluation Order for a Single Mutation M on Entity E:

Phase 0 — Pre-validation
    0.1  Authenticate: verify current_user has a valid session
    0.2  Authorise:    evaluate all policy declarations for [operation, E, fields(M)]
         → if any policy rejects: halt with PolicyViolation, log
    0.3  Guard:        evaluate all bot.guard declarations for [E.event_type]
         → first reject wins: halt with GuardRejection, log
         → collect all warns: log, continue

Phase 1 — State Machine
    1.1  If M changes E.status:
         → evaluate E.states{} transitions
         → if target state not in allowed transitions: halt with StateMachineViolation
    1.2  If E is aggregate member:
         → verify mutation is entered through aggregate root
         → if not: halt with AggregateViolation

Phase 2 — Constraint Evaluation
    2.1  Evaluate all constraints C where C.for includes E
         Priority: constitutional constraints first, then ordered by declaration
    2.2  For each C in priority order:
         → evaluate C.require(E_after_M)
         → if false and C.on_violation == reject: halt with ConstraintViolation, log
         → if false and C.on_violation == warn:   log warning, continue
    2.3  Evaluate all distributed_constraints that include E
         → acquire consensus from required nodes
         → if consensus rejects: halt with DistributedConstraintViolation

Phase 3 — Commit
    3.1  Begin transaction
    3.2  Apply mutation M to entity store
    3.3  Update all computed fields in E that depend on mutated fields
    3.4  Update all @version fields
    3.5  Update all timeseries records for E's fields
    3.6  If E impl EventSourced: append event to event store
    3.7  Sign mutation with interpreter HMAC signature
    3.8  Commit transaction

Phase 4 — Audit
    4.1  Write to @audit_trail records for all annotated fields
    4.2  Write causal chain record: {mutation_id, entity_id, user_id, role,
         rule_chain_trigger, timestamp, fields_changed, before_state, after_state}
    4.3  Update materialised_views that depend on E
    4.4  Update metrics that reference E

Phase 5 — Rule Evaluation
    5.1  Collect all rules R where R.condition references fields of E
    5.2  Sort R by priority descending (higher priority evaluated first)
    5.3  Evaluate R.condition(E_after_M) for each R in sorted order
    5.4  For each R where condition is true:
         → if R.on == SignalName and signal not yet received: skip
         → else: execute R.then block
         → R.then block may: set fields, emit signals, invoke functions
         → field sets in R.then go through Phase 0–4 for each affected entity
         → emitted signals are queued, not immediately dispatched

Phase 6 — Signal Dispatch
    6.1  Dispatch all signals queued in Phase 5
    6.2  For each signal S:
         → evaluate all rules R where R.on == S
         → R.condition evaluated and R.then executed if condition satisfied
         → signals emitted in R.then are queued for next dispatch cycle
    6.3  Signal dispatch cycles continue until the signal queue is empty
         or MAX_RULE_CHAIN_DEPTH is reached (default: 50)

Phase 7 — Bot Evaluation
    7.1  Evaluate bot.watch expressions for entities affected by M
    7.2  Evaluate bot.pipeline triggers for E.event_type
    7.3  Update adaptive_threshold records for rules with adaptive modifier
    7.4  Check temporal_commitment deadlines for entities affected by M

Phase 8 — Constitutionality Check (async, non-blocking)
    8.1  Queue entity E for next constitutionality audit cycle
    8.2  Update audit metrics for constraint firing rates

END

For any SIGNAL program P that satisfies meta_verify:
  For any entity mutation M on entity E in P:
    ∀ constraint C ∈ P.constraints where C.for includes E:
      C.require is evaluated during the execution of M
      
Proof: By the evaluation order (Phase 2), constraint evaluation
is a required phase. A conforming interpreter cannot skip Phase 2.
A program that passes meta_verify has no code path that bypasses
the interpreter. Therefore, for any M, all relevant C are evaluated. □

For any automated decision D in a SIGNAL program P:
  ∃ a causal chain record CR such that:
    CR.mutation_id traces back to the user action that initiated M
    CR.rule_chain lists every rule that fired between M and D
    CR.entity_state_before and CR.entity_state_after are recorded for each step

Proof: By the evaluation order (Phase 4), causal chain records
are created for every mutation. Rule execution in Phase 5 creates
mutation records for each field set, each of which has a Phase 4
record. The chain is recoverable by following mutation_id links. □

For any constitutional constraint CC in program P:
  For any entity state S₀ that satisfies CC:
    For any legal sequence of mutations M₁, M₂, ..., Mₙ:
      The resulting state Sₙ satisfies CC
      
Proof: Constitutional constraints have on_violation = reject.
By Theorem 1, CC is evaluated on every relevant mutation.
If any mutation Mᵢ would produce a state Sᵢ that violates CC,
the mutation is rejected. Therefore Sᵢ = Sᵢ₋₁ (mutation did not commit).
By induction, no legal sequence of mutations can produce a state
that violates CC once it was satisfied. □

Note: "Legal" means "passing all governance checks." 
An illegal mutation (bypass) is handled by bypass detection,
not by this theorem.

For any SIGNAL rule chain in program P where P satisfies meta_verify:
  The rule chain terminates in finite steps
  
Proof: By meta_principle VII (completeness), all state machines
have terminal states. By meta_principle II (finite state), the
state space is finite. Each rule firing either:
  (a) Changes an entity's state, or
  (b) Emits a signal, or
  (c) Invokes a function (which terminates by declared type)
State changes are governed by state machines that prohibit cycles
(meta_verify: no_infinite_rule_chain). Signal dispatch has
MAX_RULE_CHAIN_DEPTH. Therefore, by finite descent, any rule
chain in a conforming program terminates. □

program BrotherhoodApexPersonalEconomics {

    -- Language version declaration (Part IV)
    language_version 4.0 { strict: true, warnings_as_errors: true }

    -- Program identity
    identity: {
        name:        "Brotherhood Apex Personal Economics System"
        version:     "4.0.0"
        authors:     ["M. Davis Holdings & Consulting / SKANND.io Ventures"]
        description: "Complete personal economics governance: capital cycling,
                       debt elimination, production economics, and reinvestment
                       strategy under unified constitutional authority"
        license:     "Proprietary"
    }

    -- Constitutional authority (Part III)
    constitutional_authority {
        level:   1
        scope:   { domain: "personal_economics", governed_for: PersonalEconomicActor }
    }

    -- Meta-constitutional conformance (Part IV)
    meta_verify { all_checks: true }

    -- Language version conformance
    conforms_to: [
        SIGNAL_Part_I   { version: "1.0" },
        SIGNAL_Part_II  { version: "2.0" },
        SIGNAL_Part_III { version: "3.0" },
        SIGNAL_Part_IV  { version: "4.0" }
    ]

    -- Module composition
    modules: [
        MCMPrimeEngine          { treaty: MCMPrimeDebtPayback },
        DebtPaybackEngine       { treaty: MCMPrimeDebtPayback },
        EconomiesOfScale        { treaty: null },
        WarehouseOps            { treaty: null },
        BrotherhoodApexCore     { sovereign: true }
    ]

    -- Constitutional hierarchy (Part III)
    hierarchy: BrotherhoodApexConstitutionalHierarchy

    -- Conflict resolution (Part III)
    conflict_resolution: CapitalSystemConflictProtocol

    -- The constitution (Part II)
    constitution BrotherhoodApexConstitution {

        fundamental_invariants: [
            "The individual's long-term economic freedom is the sovereign purpose",
            "No capital shall be deployed that creates unrecoverable loss",
            "All debt obligations shall be honoured before discretionary capital use",
            "Transparency of all automated decisions is non-negotiable"
        ]

        unamendable_constraints: [
            SurplusSolvency,
            CapitalConservation,
            MinimumPaymentCompliance,
            NoNegativeStock
        ]

        unamendable_rules: [
            PaydayLoanEmergency,
            StockoutAlert,
            SafetyHoldProtocol
        ]

        amendment_process: {
            requires: [
                GUC.review(posture: strategic, min_score: 0.85),
                PersonalEconomicActor.explicit_consent,
                72h_cooling_off_period
            ]
            records_in: ConstitutionalAmendmentLog { @audit_trail(retention: permanent) }
        }
    }

    -- The Council (Part III)
    council GUC {
        personas:  [Godel, Knuth, Shannon, Wolfram, Torvalds, UXCounsel]
        model:     "claude-sonnet-4-6"
        version:   locked
        @audit_trail(retention: permanent)
    }

    -- Observability (Part II)
    observability: {
        metrics:      [ALL]
        traces:       [ALL]
        healthchecks: [DatabaseConnectivity, RuleEvaluationPerformance, SignalBusDelivery]
        export:       prometheus
    }

    -- Reality interface (Part IV)
    sensors:    [TemperatureSensor, BarcodeScanner, WeightScale]
    actuators:  [ConveyorBelt, PrintLabel]

    -- Deployment
    deployment: {
        runtime:        "signal-runtime >= 4.0.0"
        database:       SQLite { mode: WAL, path: "brotherhood_apex.db" }
        host:           "IONOS Shared Hosting"
        single_file:    true
        zero_dependencies: true
        ftp_deployable: true
    }

    -- Testing (Part II)
    test_suite: BrotherhoodApexTestSuite {
        coverage_target: { constraints: 100.0, rules: 95.0, state_machines: 90.0 }
        property_tests:  ALL_DECLARED_PROPERTIES
        scenarios:       [
            "Complete MCM' capital cycle from M to M'",
            "Avalanche debt payback to freedom",
            "JahBrew economies of scale analysis",
            "Warehouse daily operations cycle"
        ]
    }

    -- Formal specification (Part III, IV)
    axioms:   [PaymentSystemAxioms, InventoryAxioms]
    theorems: [
        "Avalanche strategy minimises total interest paid",
        "No order can ship if stock was never reserved",
        "Constitutional constraints are monotone"
    ]

    -- Audit (Part III)
    constitutionality_audit: SystemConstitutionalityAudit { schedule: continuous }
    bypass_detector:         InventoryBypassDetector

    -- Version and migration
    schema_version: 4
    migrations:     [v1_to_v2, v2_to_v3, v3_to_v4]
}

BrotherhoodApexPersonalEconomics.program
├── schema/
│   ├── migrations/         -- All declared migrations in execution order
│   ├── schema.sql          -- Complete SQLite schema with CHECK constraints and triggers
│   └── schema_version.json -- Current version and upgrade path
│
├── governance/
│   ├── constitution.json   -- Machine-readable constitutional declaration
│   ├── constraints.json    -- All constraints with metadata and rationale
│   ├── rules.json          -- All rules with priority, conditions, and actions
│   ├── state_machines.json -- All entity lifecycle graphs
│   └── policies.json       -- All access control policies
│
├── api/
│   ├── openapi.yaml        -- Complete API specification from entity declarations
│   ├── events.asyncapi.yaml -- Signal bus event catalog
│   └── webhooks.yaml       -- Connector webhook specifications
│
├── tests/
│   ├── unit/               -- Generated test scaffolds for all constraints and rules
│   ├── scenarios/          -- Declared scenario tests
│   └── properties/         -- Property-based test harness
│
├── docs/
│   ├── constitution.md     -- Human-readable constitutional summary
│   ├── audit_guide.md      -- How to audit the running system
│   ├── explanation_guide.md -- How decisions are explained and retrievable
│   └── regulatory_map.md  -- Which constraints implement which regulations
│
├── observability/
│   ├── prometheus.yml      -- Metric declarations
│   ├── dashboards/         -- Pre-built Grafana dashboards from metric declarations
│   └── alerts.yml          -- Alert rules from metric and heartbeat declarations
│
├── deployment/
│   ├── acela_corridor.php  -- Single-file PHP monolith
│   ├── Dockerfile          -- Container deployment option
│   └── deploy.sh           -- FTP deployment script for IONOS
│
└── audit/
    ├── constitutionality_report_template.json
    ├── bypass_detection_config.json
    └── amendment_log_schema.json

meaning BrotherhoodApexMeaning {

    -- The purpose this program serves that cannot be reduced to a formal declaration
    purpose:
        "To make one person's economic life governable by principles they chose,
         enforceable by rules they declared, and transparent to scrutiny they
         invited. Not to replace judgment but to make the consequences of
         judgment traceable. Not to eliminate error but to make error visible.
         Not to guarantee outcome but to ensure that between intention and
         outcome, nothing arbitrary intervened."

    -- The values this program embodies
    values: [
        "Economic freedom is built in cycles, not transactions",
        "Debt is a constraint on freedom that compounds until eliminated",
        "Capital correctly deployed compounds freedom; capital incorrectly
         deployed compounds constraint",
        "Every rule in this system was chosen; every constraint was accepted;
         every constraint can be amended; no amendment is without cost"
    ]

    -- The limits this program acknowledges
    limits: [
        "This program cannot govern the will of its user",
        "This program cannot govern the behaviour of markets",
        "This program cannot govern the health of the user",
        "This program cannot govern the social conditions in which
         economic decisions are made",
        "This program can only govern the domain model it was given —
         and that model is always a simplification of the world"
    ]

    -- The relationship between this program and the person it serves
    governed_for: PersonalEconomicActor {
        relationship:
            "The program serves the actor, not the reverse. No constraint
             in this system is prior to the human judgment that declared it.
             Every unamendable rule was made unamendable by a human choice.
             Every constitution can be replaced by writing a new program.
             The language is the tool. The governance is the choice.
             The freedom is the purpose."
    }

    -- The acknowledgement that ends the specification
    acknowledgement:
        "SIGNAL v4.0 is complete in the sense that all identified gaps have
         been addressed and all four questions of governance — what is valid,
         who may act, whether it is correct, and what it means — have been
         given formal expression. It is not complete in the sense that no
         formal system governing human activity can be complete. The Gödel
         limit applies. There will always be true things that cannot be proved
         within the system, valid rules that cannot be declared as constraints,
         and correct decisions that no rule anticipated.

         The purpose of the specification is not to eliminate that gap.
         The purpose is to make the governed domain — the domain that CAN
         be formally specified — as correctly governed as the language allows,
         so that human judgment is reserved for what only human judgment
         can address: the things that lie beyond the boundary of what
         the language can express."
}