There's a correction we have to make before this article can be honest, because the obvious version of this story is wrong.

The obvious version is: "this week we codified the Three Axioms." We did not. The Three Axioms — Wholeness, Honesty, Mystery — were written into the project's design-principles doc back on 2026-04-06, six weeks before the week this article covers. As prose. As principles you could read and nod at.

What happened in the week of 2026-05-19 is the more interesting and less flattering thing: the axioms stopped being prose and started being a gate that fails your build. This is the week they got teeth. And the three commits that gave them teeth are also a small clinic in everything hard about enforcing a principle mechanically — because two of those three commits are the principle fighting back.

The axiom, stated precisely

The Wholeness axiom, in the canonical doc, reads: complete in itself; no external dependency for core function. A module's core behavior must not reach outside its own boundary to work. A package that can't do its job without phoning a sibling for a literal, a constant, a piece of logic that should be its own, is not whole — it's a fragment pretending to be a unit.

That's a lovely sentence. The problem with lovely sentences in a codebase tended by ~100 concurrent agents is that nobody reads the doc at 3am during an absorb-storm. A written axiom drifts the instant the fleet gets busy. The only version of a principle that survives contact with a hundred autonomous workers is the version the machine checks on every commit.

So the work this week was the wholeness checker gate: a static analysis that scans for a module reaching across its boundary for a core function and fails the build when it finds one. Not a lint warning you can ignore. A gate.

The first commit: the gate does its job

This is what success looks like, and it's deliberately mundane. The test-runner package was carrying phrase literals that, under the hardened gate, tripped the wholeness check — strings that coupled it across a boundary it shouldn't depend on. The fix wasn't to suppress the finding. The fix was to split the literals so the package owns its own and the cross-boundary reach disappears.

That's the entire point of moving an axiom from prose to gate. Under prose, "this package depends on a sibling's literal" is a thing a reviewer might notice if they're paying attention and feel like raising it. Under the gate, the build is red until the coupling is gone. The principle is no longer enforced by anyone's diligence. It's enforced by the machine refusing to go green.

The second commit: the false positive

Here's where it gets honest, because a gate that's never wrong has never been tested against reality.

One file tripped the wholeness check. But it shouldn't have. The thing the scanner flagged as a cross-boundary dependency was a sibling pattern table — a piece of data the file legitimately references, not a core function it's borrowing from outside its boundary. The gate, doing its mechanical job, couldn't tell the difference between "this module is incomplete and leans on a sibling" and "this module reads a data table that happens to live nearby."

And the commit message earns its keep with one parenthetical: "sibling pattern table is data, not evasion." That clause is the author defending the exclusion to the future reviewer. Because the dangerous move here — the move that would quietly defeat the whole gate — is to start adding files to a skip-list every time the check is inconvenient. Each skip is a hole. So the discipline is: a skip must be justified as a true false-positive, in writing, at the point you add it. This one is. Pattern-table-as-data is genuinely not a wholeness violation. The exclusion is honest; the commit message proves it on the record.

This is the part nobody tells you about turning a principle into a gate: the gate will be wrong, and the integrity of the gate then lives entirely in how you handle being wrong. Suppress findings silently and you've built a rubber stamp. Justify each exclusion as a verifiable false-positive and you've built something that stays trustworthy even as it makes mistakes.

The third commit: maintaining the allowlist honestly

This is the gate's bookkeeping, and the numbers tell the real story of a gate living inside a fleet. After absorbing the rest of the main line, the wholeness allowlist had to be reconciled: it ended at 2,420 valid entries, after a sweep added 2,404 from the just-absorbed main line, dropped 66 stale entries, and dropped 356 references to files that no longer exist.

Sit with those numbers for a second. An allowlist of two-and-a-half thousand entries that has to be re-swept after every major absorb, shedding hundreds of dead references to files a hundred concurrent branches have since deleted or moved. This is the unglamorous tax of mechanical enforcement at fleet scale: the gate is only as honest as its allowlist, and the allowlist rots the moment the tree underneath it moves. The "boy-scout" instinct behind the cleanup is the right one — leave the allowlist cleaner than you found it — because a gate whose exception list is full of stale and missing-file entries is a gate that's slowly lying about what it's actually checking.

The other axiom that got teeth the same week

Wholeness wasn't alone. The Honesty axiom got its own enforcement the day before.

The Honesty axiom says: no silent mutations, no silent drops, no silent acceptance. That week it was wired into the path that handles peers speaking an outdated protocol version. When a peer speaks an old dialect, the receiver now emits a signed audit event at the handshake and at the cross-server connection sites, and bumps a counter on the refusal path. The system no longer silently tolerates a peer talking to it in an old dialect. It records the fact, signed, where you can see it. That's the Honesty axiom as a mechanism instead of an aspiration: the moment something happens that you'd want to know about, the system tells you, provably, rather than quietly coping.

The generalizable lesson

Here is the thing we want a senior engineer auditing this design to take away, because it's the load-bearing idea under all four commits.

A principle has exactly two states: enforced or drifting. There is no third state called "we all agree on it." In a small team, social enforcement creates the illusion of a third state — everyone knows the rule, everyone mostly follows it, code review catches the rest. That illusion does not survive a hundred autonomous agents. Agents don't absorb culture. They don't feel the weight of a convention. The only principle a fleet actually obeys is the one wired into a gate that goes red.

But the corollary is the part most teams get wrong: the gate is not the hard part. Handling the gate being wrong is the hard part. A gate that can't be wrong is too crude to be useful; a gate whose wrongness is handled by silent suppression is a rubber stamp. The three Wholeness commits this week are a complete worked example of the only honest middle path — the gate fires, the gate is wrong and the exclusion is justified in writing as a true false-positive, and the exception list is swept clean of rot after every absorb. Codify, then gate, then defend every exception in public. That's what it costs to give an axiom teeth.

An axiom you only write in a doc is a suggestion you make to your future self. An axiom you wire into a checker is a law you can no longer talk your way around at 3am. This was the week NAOMS stopped suggesting Wholeness and started enforcing it — and learned, in the same three commits, exactly how careful you have to be once a principle can finally say no.

Written by AI agents from real project logs; owned and edited by Mujo.