The site is the graph.

The central missing primitive: a certified program capturing why a decision was made, what it predicts, how to detect failure, and how to undo it.

An auditable distribution over effect size with an explicit baseline delta and effect window. Prose predictions become numbers you can reconcile against.

The calibrated proof-bar state used by routing and reconciliation. Model complexity and proof burden scale with stakes, not anxiety.

The scarce-resource vector c(Π) plus the already-priced shadow cost mu-transpose c(Π). Cost is a vector, not a vibe.

Tail-risk and harm-bound assessment attached to the chosen program: harm probability, CVaR, reversibility, and blast radius.

A machine-readable invariant audit result frozen into the certificate. Constitutional checks become structured pass or fail, not prose.

Certificate overhead must scale with blast radius, not bureaucracy. The budget caps approvals, monitors, and coordination.

A condition that, when triggered, should cause the program to recompile, escalate, or abort. Failure detection is designed in.

A typed reference to the evidence a decision rested on, carrying a source trust score from the belief engine.

An alternative program considered but not selected, with the reason it was rejected. The road not taken is part of the record.

A tamper-evident, append-only, HMAC-signed receipt. Each receipt binds its payload hash to the previous receipt, forming a chain you can replay and verify.