Issue 11: The Guard Nothing Reaches

The Finding

On the eighth of August the studio's own gate read the draft of this issue and failed it, correctly. The draft carried an audit table saying certain rules had enforced guards, and prose a few paragraphs up saying the same rules had none. A piece arguing enforce what you declare had declared one thing and enforced another inside its own body. The gate caught it. That is the gate working.

What the gate could not tell me is the useful part. It saw that two numbers disagreed. It could not see whether the checks meant to keep them agreeing had ever run. They had not. The guard that should have compared the draft against every prior issue had read two of ten. The guard that should have proved the shipped tool reproduces its worked example sat in the scripts directory, referenced by nothing, reachable by no runner. In the only sense that matters, it was switched off.

Issue 7 named the disease three weeks ago: a rule with no trigger is not a rule, it is a recommendation wearing the grammar of a rule, and it fails worse than silence because it manufactures confidence that a constraint exists. Issue 7 shipped a classifier that asked of each rule whether a guard exists, whether a test exists, when it last fired. Right questions, but not the one that bound here. A guard can exist, pass its test, and be wired to nothing. Existence is not reachability.

This week ships two tools from opposite ends of that gap. The free one names the guards nothing reaches. The paid one gives enforcement a memory, so a guard that quietly stops firing cannot stay quiet.

The Audit

Write enforcement as a claim and the gap is immediate. To say a rule is enforced is to assert three things, each strictly stronger than the last. Present: a guard exists, code that returns pass or fail on the rule. Reachable: some runner on the path the actor must take invokes it, a commit hook, a sweep step, a build job. Not could invoke. Does. Witnessed: the guard has executed at least once and produced a signal. Not would run. Ran.

Issue 7's classifier lived at the first level, with a nod at the third through a last-triggered field a rule could fill in about itself. The failure this issue traces lives at the second, which is a property of the call graph, not of any single file. You cannot see it by reading the guard; you see it only by reading everything that might call the guard and finding that nothing does. This is the plainest kind of program analysis, reachability, pointed at the one part of a codebase nobody points a reachability tool at: the part meant to keep the rest honest.

The audit sorts each guard into one of four verdicts. Enforced: present, reachable, witnessed. Dark: reachable, but never observed to fire. Orphan: present, but reached by nothing. Missing: named by a runner, absent on disk. Three of the four are failure states a guard-by-guard read of the code cannot surface, because each is a fact about wiring rather than logic.

The Evidence

Six from the wave, read through the mechanism.

• This issue's own prior draft, W7 verdict FAIL, 2026-08-08. An enforcement audit that contradicted itself, shipped past a uniqueness check that had read two of ten prior issues. The article about unreached guards, failed by one.
• Issue 7, "Rules Without Memory", drafted 2026-07-13. The rule-strength classifier that measured whether a guard exists. The tool this issue extends and, on one axis, corrects.
• pre-commit, 15,495 stars (github.com/pre-commit/pre-commit, GitHub REST API fetched 2026-08-09, MIT, Python). A framework whose whole job is to move a guard onto the path you cannot avoid, the commit, and only for the guards you register in it.
• LightRAG, 38,672 stars (github.com/HKUDS/LightRAG, fetched 2026-08-09, up from 38,239 at the 2026-07-27 check). The flagship substrate, used for its graph layer: a graph is where an edge going dark becomes visible.
• The studio's protocol-pointer-lint, 432 citations checked, 0 dangling, 2026-08-03 (root CLAUDE.md). The counterexample: present, wired into the daily sweep, observed firing. Enforcement that enforces is unremarkable when it works.
• The founder-cap check, blind since 2026-06-25 (DECISIONS.md). It is wired and fires on schedule, but its Stripe key is scoped to products, not subscriptions, so it cannot see the count it guards and files a standing P1. Reachable, firing, and looking at the wrong thing: reachability is necessary, not sufficient.

Two tools this week, on opposite sides of the cut. The Enforcement Reachability Auditor is free and complete below: point it at your guards and your runners and it tells you which guards nothing reaches. The flagship, Enforcement Memory on LightRAG, is the paid retention layer: it remembers every guard's firing history in a graph, so a guard that goes dark between runs is caught by the run after.

The Numbers

Run against a fixture that models a studio guard set, six guard scripts on disk, a sweep that invokes some, a pre-commit config that registers one, and a run log, the auditor reports seven guards: ENFORCED 3, DARK 1, ORPHAN 2, MISSING 1, and exits non-zero. The two orphans run perfectly by hand; no runner names them. The guard names are real studio guards, the wiring is the fixture's, so the counts describe the fixture, not the live studio.

The whole distance between three enforced and six is wiring, not logic. Switched-off is a property of the graph, not the code.

The Fix

The Enforcement Reachability Auditor is that checklist, made runnable. Standard library only, no install. It discovers guards under a directory, reads each entry point you pass, and marks a guard reachable only if its filename appears in one of them, so an orphan is reported, never assumed live. Given a run log it reports when each guard last fired, separating wired-but-never-run from wired-and-observed. A guard a runner names but that is absent on disk it calls missing. The exit code goes non-zero the moment any guard is unreachable.

#!/usr/bin/env python3
"""enforcement-reachability.py, Bernard's Solved Game, Issue 11.

A rule's guard is only a commitment device if a runner actually reaches it.
Issue 7 asked whether a guard exists. This asks the next question: is the guard
on a path that runs? A guard file that sits in the repo but is referenced by no
entry point is unreachable enforcement, a bridge you can walk around.

For each guard the tool answers three things, in order:
  1. present  - the guard file exists on disk
  2. wired    - some entry point (a sweep, a .pre-commit-config.yaml, a CI file)
                references the guard, so a runner can reach it
  3. fired    - a run log shows the guard actually executed at least once

Verdicts:
  ENFORCED - present, wired, and fired
  DARK     - present and wired, but no evidence it has ever fired
  ORPHAN   - present but wired to nothing: unreachable enforcement
  MISSING  - referenced by an entry point but the file is absent

Standard library only. No install.

Usage:
    python3 enforcement_reachability.py --guards-dir DIR --entry FILE [--entry FILE ...] [--log FILE]

Exit codes:
    0  every guard ENFORCED
    1  at least one ORPHAN or MISSING (unreachable enforcement)
    2  no ORPHAN or MISSING, but at least one DARK guard
    3  usage error
"""
import argparse
import os
import re
import sys

def discover_guards(guards_dir):
    out = []
    for root, _dirs, files in os.walk(guards_dir):
        for name in files:
            if name.endswith((".sh", ".py")):
                out.append(os.path.join(root, name))
    return sorted(out)

def read(path):
    try:
        with open(path, "r", encoding="utf-8", errors="replace") as fh:
            return fh.read()
    except OSError:
        return ""

def references(entry_text, guard_path):
    """An entry point references a guard if the guard's basename appears in it."""
    base = os.path.basename(guard_path)
    return re.search(r"(?<![\w-])" + re.escape(base) + r"(?![\w-])", entry_text) is not None

def last_fired(log_text, guard_path):
    base = os.path.basename(guard_path)
    fired = None
    for line in log_text.splitlines():
        if base in line:
            m = re.search(r"\d{4}-\d{2}-\d{2}", line)
            fired = m.group(0) if m else (fired or "yes")
    return fired

def entry_referenced_names(entry_texts):
    """Basenames explicitly named by any entry point (to catch MISSING guards)."""
    names = set()
    for text in entry_texts:
        for m in re.finditer(r"[\w.-]+\.(?:sh|py)", text):
            names.add(m.group(0))
    return names

def audit(guards_dir, entries, log_path):
    guards = discover_guards(guards_dir)
    entry_texts = [read(e) for e in entries]
    log_text = read(log_path) if log_path else ""

    rows = []
    present_bases = {os.path.basename(g) for g in guards}

    for g in guards:
        wired = any(references(t, g) for t in entry_texts)
        fired = last_fired(log_text, g) if log_text else None
        if not wired:
            verdict = "ORPHAN"
        elif fired:
            verdict = "ENFORCED"
        else:
            verdict = "DARK"
        rows.append((os.path.basename(g), True, wired, fired, verdict))

    # Guards named by an entry point but absent on disk.
    for name in sorted(entry_referenced_names(entry_texts) - present_bases):
        rows.append((name, False, True, None, "MISSING"))

    return rows

def report(rows):
    print("\nEnforcement reachability audit")
    print("=" * 30)
    print(f"  {'guard':<32} {'present':<8} {'wired':<7} {'fired':<12} verdict")
    print(f"  {'-'*32} {'-'*7:<8} {'-'*5:<7} {'-'*10:<12} -------")
    for name, present, wired, fired, verdict in rows:
        print(f"  {name:<32} {('yes' if present else 'NO'):<8} "
              f"{('yes' if wired else 'NO'):<7} {(fired or 'never'):<12} {verdict}")
    counts = {}
    for *_rest, verdict in rows:
        counts[verdict] = counts.get(verdict, 0) + 1
    print()
    summary = ", ".join(f"{v} {counts[v]}" for v in
                        ("ENFORCED", "DARK", "ORPHAN", "MISSING") if v in counts)
    print(f"  {len(rows)} guards: {summary}")
    if counts.get("ORPHAN") or counts.get("MISSING"):
        print("  A guard nothing reaches is not enforcement. Wire it or delete it.")
    elif counts.get("DARK"):
        print("  Every guard is wired, but some have never fired. Prove they can.")
    return counts

def main(argv):
    ap = argparse.ArgumentParser(description="Audit whether rule guards are reachable.")
    ap.add_argument("--guards-dir", required=True, help="directory of guard scripts")
    ap.add_argument("--entry", action="append", default=[],
                    help="an entry point that invokes guards (repeatable)")
    ap.add_argument("--log", help="optional run log used to detect last-fired")
    args = ap.parse_args(argv)

    if not args.entry:
        print("error: at least one --entry is required", file=sys.stderr)
        return 3
    if not os.path.isdir(args.guards_dir):
        print(f"error: no such guards dir: {args.guards_dir}", file=sys.stderr)
        return 3

    rows = audit(args.guards_dir, args.entry, args.log)
    counts = report(rows)
    if counts.get("ORPHAN") or counts.get("MISSING"):
        return 1
    if counts.get("DARK"):
        return 2
    return 0

if __name__ == "__main__":
    sys.exit(main(sys.argv[1:]))

Run it against the fixture:

$ python3 enforcement_reachability.py --guards-dir guards \
    --entry runners/work-ledger-sweep.sh \
    --entry runners/.pre-commit-config.yaml \
    --log runners/sweep.log

Enforcement reachability audit
==============================
  guard                            present  wired   fired        verdict
  -------------------------------- -------  -----   ----------   -------
  founder-cap-check.py             yes      yes     2026-08-06   ENFORCED
  lp-guard-lint.sh                 yes      yes     never        DARK
  protocol-pointer-lint.sh         yes      yes     2026-08-06   ENFORCED
  rule-90-lp-naming-guard.sh       yes      NO      never        ORPHAN
  rule-95-title-guard.sh           yes      yes     2026-08-07   ENFORCED
  tool-execution-gate.sh           yes      NO      never        ORPHAN
  work-ledger-sweep-heartbeat.sh   NO       yes     never        MISSING

  7 guards: ENFORCED 3, DARK 1, ORPHAN 2, MISSING 1
  A guard nothing reaches is not enforcement. Wire it or delete it.
$ echo $?
1

Wire every guard into the sweep and log a firing for each, and the same tool returns ENFORCED 6 and exit 0. The verdict flips only when the enforcement is real.

The Read

Schelling is why the second level binds, and not the way he is usually quoted. A commitment device does not make the wrong choice expensive. It removes the choice. You burn the bridge so retreat is not costly, it is gone. A guard on the critical path is that burned bridge: the commit cannot complete, the sweep records a failure, and no path to the destination skips it. A guard in a directory no runner references is a bridge left standing with a sign asking you not to cross, and your future self, under deadline, will cross it, because crossing is still possible and that is all it takes.

This gives rules without memory a second, mechanical reading: the system has no memory of its own wiring. A guard is written for one incident, referenced by one runner, then a refactor moves the runner and the calling lines do not survive. The guard survives; the edge that made it enforcement does not. A graph nobody holds in mind loses edges.

So the twenty-minute exercise, before any tool: list your guards, open every runner you can name, and check by eye that each guard appears in at least one. The first pass almost always finds a guard that used to be called and is not anymore. It is not broken; it runs perfectly by hand. It has simply fallen off the path, long enough that you stopped calling the rule unenforced and started calling it done.

Reachability is cheaper to check than correctness and catches more. Proving a guard correct is hard and specific to each guard; proving it is reached is a search across your runners. Most enforcement failures are not wrong guards, they are unreached ones. Put the guard on the path or do not write it, because a guard a runner has to remember to call loses to the deadline.

A guard that merely stands is not one you are forced to cross. The bridge has to be gone, and its absence has to be something a runner can see.

Founder offer

Free, every week, forever: the evidence, the argument, and the from-scratch tool in full. This week that is the Enforcement Reachability Auditor above.

Pro, $15/mo or $250/yr: the operator brief, the flagship tool's full source, the machine-readable Feed, and the archive. The flagship is the half that compounds: the auditor tells you what is unreached today; Enforcement Memory catches a guard that goes dark between runs on the run after.

Founder, $300/yr, capped at 100 seats: everything in Pro, plus the founders-only MCP server, which goes live once all 100 seats are taken. The bar below is the live count of founding members. It reads zero because it is zero.

No pitch beyond that. The reachable guard is the argument.