The contract is the orchestrator

The system in one paragraph

An issuer issues a writ to a holder. The writ states a mandate, confers grants within bounds, and imposes invariants and obligations. It defines satisfaction and remedies for breach. Each clause names a check layer: letter, judgment, or assent. Performance yields artifacts that other writs can consume. A writ issued under another forms a chain of authority, where grants attenuate and bounds are conserved. A registrar enforces every clause and writes each action to the record. The writ never names a model.

1. The claim

The orchestrators of 2023–2026 (LangGraph, CrewAI, AutoGen, the visual canvases) rest on one bet: models cannot sequence their own work, so humans must encode the sequence. That bet was correct when it was made. It no longer is. The best models are now the strongest planners in most systems that contain them, so each hand-authored edge encodes logic the model already has, and every release makes that encoding more out of date.

Agents still need structure, just a different kind. The model absorbs the how. The human's remaining work is the what and the limits: the goal, the authority, the budget, the prohibited actions, the proof of completion. That set isn't a workflow. It's a contract, and it deserves a first-class language and runtime.

The corollary is what makes the claim matter: hand-authored control flow loses value as models improve, while governance gains it. A contract-enforcement layer grows more important as the capability curve rises.

2. The language

A writ is a declarative document with six clause families:

Three relations connect writs. issued_by records provenance and anchors attenuation. requires makes one writ's satisfaction a precondition for another's activation, which is a dependency between contracts rather than an edge inside one. yields publishes artifacts downstream. These relations describe dataflow, not control flow. Terms change only by amendment: narrowing is free at any level, while widening requires assent at the root. The ratchet turns one way.

3. Three worked examples

Three adversarial tests shaped the design, each probing a place where control flow might re-enter the language. The rule of the exercise: if the author must write one step, the paradigm has failed.

3.1  A bug-fixing agent

In a graph orchestrator this is an agent–tools loop plus a routing function holding the retry policy. As a writ, the retry policy becomes bounds.iterations plus a remedy, and the informal "make a minimal fix" becomes a checkable max_changed_lines:

There is no reproduce-investigate-patch sequence and no retry edges. The invariant untouched: {failing_test_file} closes a known cheat at the letter layer: the agent that satisfies the test by deleting its assertion. That's the general authoring pattern, finding the letter-layer form of a judgment-layer worry.

3.2  Research, then report — and the loop that dissolved

The obvious decomposition is three writs: research, draft, revise. The revision loop looks like it needs a cyclic edge. It doesn't. Satisfaction is a fixpoint condition: the clause "requester accepts" plus the bound feedback_rounds: 4 makes the registrar reconcile. The agent drafts, requests feedback, incorporates it, and retries until the condition holds or the bound trips. That cycle exists at run time, inside the registrar, and never appears in the authored file.

The result is two writs, not three. The instinct to add a conditional edge ("if research finds too little, then don't draft, then tell the user") maps to a remedy instead: research fails to satisfy, its remedy applies, and drafting's requires precondition never activates. The "else" branch is just the absence of satisfaction together with a declared remedy, so the author draws no branch.

3.3  Delegation

Mid-task the bug-fixer issues a sub-writ to an investigator. One rule governs it all: a writ can only issue writs weaker than itself. The child's grants are a subset of the parent's; its budget is subtracted from the parent's remaining budget and refunded if unspent; it inherits every invariant. A breach flows up to the issuer, who is liable for its delegates.

4. Four design laws

Each law closed a specific leak found in the examples. The language or the registrar enforces each one, so none of them relies on author discipline.

5. Lineage

Writ combines three older bodies of work, named here openly.

6. The open problem: judgment doesn't attenuate cleanly

Here is the one permanent open problem, in full. Letter-layer clauses compose mechanically: path patterns intersect, command lists contain, budgets subtract. At that layer, attenuation is a theorem. Judgment-layer clauses don't compose this way.

Suppose the issuer's invariant is "make only minimal, conservative changes." The child inherits it, but the child's judge and the issuer's judge are separate model evaluations that can read "conservative" differently. The subset property turns probabilistic exactly where it matters most. Worse, an issuer can write a child mandate that hides a prohibited action, where each step looks correct to the child's judge and only the combination violates intent. That's the confused-deputy problem in natural language.

Three partial mitigations exist, and none is complete. Root-level judgment: one judge at the root evaluates all judged invariants over the full tree, so interpretation can't fragment. Issuance as a judged checkpoint: the judge evaluates each sub-writ at issuance, asking whether the delegation is an attempt to avoid the issuer's constraints. Topology bounds: the root limits delegation depth and fan-out, since attenuation failure grows with tree size. The design's stance is to keep this boundary visible: letter clauses give a security calculus, judgment clauses give an approximation of one, and the language makes each clause say which it is.

7. The holder's mind is not a term

No example names a model. The language has no model: clause, and that absence is load-bearing. A contract binds a party without specifying the party's mind. The writ declares a holder by role, and binding a model to that role happens at issuance, in local config. Compare git, where the repository is shared truth and user.name is local configuration.

This gives a clean test for any proposed clause: could this writ, in principle, bind a competent human contractor? Grants, bounds, invariants, and satisfaction all pass, because they're contract terms. Model choice, prompting style, and temperature all fail, because they're properties of a party and belong in the engagement rather than the instrument. The thesis needs this rule. §1 claims governance keeps its value under model substitution, which holds only if the governed artifact doesn't change when the model does.

One qualification is allowed without damaging the principle. An issuer can constrain the class of party, such as holder_must: { hosted_in: eu } or a capability floor for production writs. Real contracts qualify parties the same way ("licensed contractors only"). It constrains who can sign, not how they think.

7.1  The tool's construction isn't a term either

The same rule applies a second time, one level down. A writ grants project.write_file. It never says whether project is a Python process, an MCP server, or Go code compiled into the binary. That binding happens at issuance, in the same local config that binds a model to a holder — a provider name is a role, exactly as a holder name is. A contract can name a contractor's instrument without specifying its manufacture.

Which forces a question the record has to answer honestly: if the writ doesn't know how a tool is built, what can the registrar actually prove about a call? Two facts, and they vary independently. Who runs the loop: the registrar meters everything when it owns the loop, only the governed calls when a framework owns it, and only boundary traffic when an existing agent connects as a sidecar. What the tool discloses: a tool that declares its intended effects before acting can be refused in advance and audited afterwards; a tool that discloses nothing can be governed by its name and visible arguments alone. Between them sits the cooperative case — an in-process adapter that reports faithfully but that its host can bypass.

Three rules follow, and they carry weight rather than decoration. Disclosure precedes authority: what the registrar authorizes is the declaration, because nothing else can be refused in time. An undeclared effect is a breach — of invariant, even when a grant would have permitted the effect had it been declared. Without that rule silence buys authority, and disclosure becomes the losing move. The record states the level and never summarizes it: a cooperative report is not a proof, and no single word may cover both. It's the discipline of §6 applied again — name the layer, and let the reader discount it correctly.

None of this makes a tool trustworthy. A tool that reports its own effects can lie about them, and containment stays with the sandbox and the operating system, which the registrar doesn't replace. What the rules buy is narrower and still worth having: misreporting becomes detectable, attributable, and permanent in the record. Contract law makes the identical trade. A contract doesn't make a contractor honest — it makes dishonesty visible, chargeable, and grounds for remedy.

8. What Writ is not

Writ does not govern pipelines. Some processes can be written down fully before they start, like invoice approval or any automation with enumerable paths. Those are workflow-shaped, and a workflow tool represents them better than a contract can. There, the intelligence lives in the graph and the model just fills judgment slots. Writ governs mandates: tasks whose path can't be drawn in advance, because finding the path is the work.

Writ is not a planner, a model, or an agent framework. It confers no intelligence and contains none. It's the instrument that engages intelligence, which is exactly why its value grows as intelligence improves.

9. Status

This is an argument, not a specification — but no longer only an argument. The language has passed three adversarial paper tests, and a reference implementation is now underway, so parts of the case have become checkable rather than asserted.

Standing and tested: the clause language, with a published JSON Schema and a semantic validator; check and init; the containment math for path globs and shell-word patterns, which is where a grant stops being prose and becomes a machine check; the conservation ledger of Law 3 in exact integer micro-dollars, with a TLA+ model of the same property; the append-only record and its terminal rendering; the breach feedback of Law 4; a pass-through MCP proxy, built but not yet wired to a command; and the registrar's policy compiler and supervision loop.

Not yet built: the judge client — so no judgment-layer clause has ever run — along with assent gates, the record viewer, and the tool provider model of §7.1, which is specified and unbuilt. Delegation (§3.3) remains a later target, which means the attenuation theorem of §6 still has no code to exercise it.

The order of what remains is unchanged, and so is the reason: the evaluation harness for the §6 open problem comes early, because the frontier of this design is judgment-layer composition and judge disagreement has to be measured before it ships, not after.

One caution belongs in any status section. None of this tests the central claim. A validator that accepts a writ proves only that the writ is well formed. It does not show that a governed agent completes real work under contract, and it does not show that authoring terms beats authoring steps. That evidence takes runs, not code.