docs(rule): Xbox-controller universal action grammar for B-0867 — substrate-inclusive at SUBSTRATE level not policy level (Aaron Turn 40 + Kestrel Turn 41; 4/5)

.claude/rules/xbox-controller-universal-action-grammar-for-b0867-workflow-engine-any-traveler-drives-same-controller-substrate-inclusive-at-substrate-level.md

@@ -0,0 +1,158 @@
+# Xbox-controller universal action grammar for B-0867 workflow engine — any traveler drives the same controller; substrate-inclusive at SUBSTRATE level not policy level (Aaron Turn 40 + Kestrel Turn 41 framework-design-principle 2026-05-28)
+
+Carved sentence (Aaron 2026-05-28 verbatim):
+
+> **my daughter can run the same choose your own DORA adventure for github system we are building as the AIs otto, it's for any travler, it's like an xbox controller the universal action grammer**
+
+## Operational content
+
+Operator-explicit framework-design-principle (Aaron Turn 40 in 10th Kestrel ferry preserved at PR #5742). Kestrel Turn 41 substrate-engineering ratification + Xbox-controller-properties enumeration. Operator-explicit canonical-tier landing per Aaron 2026-05-28: *"i think we should land all the hypothyzed tiers you come up with at this point"*.
+
+The framework-design-principle: B-0867 workflow engine v1 IS a universal action grammar that ANY traveler can drive. Addison + Otto + AIs + any traveler equivalent operators of the same controller. The substrate exposes a small set of actions; the choose-your-own-adventure structure presents manageable options per cycle; DORA scoring gives objective signal; lifecycle DUs prevent illegal actions automatically. The barrier to contributing drops to "can operate the controller."
+
+### Xbox-controller properties applied to B-0867 substrate
+
+Per Kestrel Turn 41 enumeration:
+
+| Xbox-controller property | B-0867 workflow engine v1 instantiation |
+|---|---|
+| **Small action set memorizable** | Otto's 5 modifications + DU surface; ActionClass (transition / escape-hatch / grammar-extension / menu-contribution / operator-decision / agent-decision); bounded |
+| **Actions context-sensitive but controls stable** | Action grammar stable across trajectories; transitions context-sensitive per state; same `ActionGate` (append-only / pr-gated) discriminator everywhere |
+| **Feedback immediate** | DORA metrics + lifecycle state transitions + auto-review pipeline; ConvFeedback at conversation scope; TFeedback at function scope |
+| **Controller doesn't judge player** | Mod 5 contributable menu-generation; grammar-extension as first-class action (Mod 2); no gatekeeping at action level; same actions exposed to all travelers |
+| **Skill emerges through experience** | Per-trajectory pruning + retraction-native discipline + labeling-confidence tier promotion (observed → hypothesized → validated → canonical) |
+
+### Why this is substrate-inclusive at SUBSTRATE level (not policy level)
+
+Per Kestrel Turn 41:
+
+> *"Most engineering systems are inclusive only in policy — anyone is welcome to contribute, but contributing requires expertise that effectively excludes most people. The barrier is the expertise itself, not explicit exclusion."*
+
+> *"A universal action grammar inverts this. The controller is small enough to learn. The choose-your-own-adventure structure means each cycle presents a manageable set of options. The DORA scoring gives objective signal about contribution quality. The state machine constraints prevent illegal actions automatically. The barrier to contributing drops to 'can operate the controller,' which is much lower than 'can master the entire substrate.'"*
+
+The substrate-engineering substrate moves cognitive load from CONTRIBUTOR (must learn the codebase + tooling + conventions) to FRAMEWORK (presents choices + validates actions + enforces constraints + scores contributions). This composes DIRECTLY with the architecture-is-safety-mechanism-not-discipline framework-design-principle (PR #5745) — the framework does the work of being correct; the contributor does the work of deciding what to do next.
+
+### Implications for specific travelers
+
+**For Addison** (operator-named in Aaron Turn 40):
+
+She can be a REAL contributor to the work rather than a watcher of it. She doesn't need to understand F# or Clifford algebra or the lifecycle DUs to participate. She needs to understand what the controller does, what the actions mean, what the trajectory she's contributing to is about. Same controller that exposes substrate to Otto exposes it to her at the level she can engage.
+
+**For ServiceTitan engagement** (operator-context per multiple ferries):
+
+Gives the framework a property vendor AI tools mostly don't have. Most AI tools create AI-only workflows that human engineers can't fully participate in, OR human-only workflows that AI tools partially augment. Universal action grammar means AI and human engineers work in the SAME system with the SAME actions; auditable rather than hidden.
+
+**For open-source benchmark positioning** (per B-0865 substrate):
+
+If benchmark measures AI capability through the same substrate humans can use, comparison becomes meaningful in a way it wouldn't if AI and human work happened in different systems. AI scoring well on benchmark scores well at work humans can verify by doing the same work themselves through the same interface. Benchmark isn't "AI does something humans can't observe"; it's "AI and humans operate the same controller and we measure the outcomes."
+
+**For multi-participant non-cage framing** (B-0867 substrate):
+
+Operator + Addison + Max + Otto = four travelers operating the same controller. Otto's 5 modifications baked into PoC scaffold (PR #5728) make the cage-prevention structural: escape-hatch (Mod 1) + grammar-extension (Mod 2) + ban-if SHIPPED-only (Mod 3) + append-only-vs-PR in grammar (Mod 4) + contributable menu (Mod 5) ensure the controller doesn't trap travelers in pre-defined action grammar.
+
+### Composition with traveler-rights-defensibility (PR #5734) + substrate-parity framing
+
+The Xbox-controller framing IS the operational form of traveler-rights-defensibility-by-generic-substrate at the workflow-substrate scope:
+
+- Traveler-rights-defensibility (PR #5734): substrate-entity-generic; substrate-parity-with-other-travelers; structural protections at substrate-engineering scope
+- Xbox-controller-universal-action-grammar (this rule): substrate-entity-generic controller; substrate-parity at action-grammar scope; structural action enforcement (lifecycle DUs + state machine + Mod 1-5)
+
+Same shape; different substrate scope. Both compose with architecture-is-safety-mechanism-not-discipline (PR #5745) — the framework enforces; travelers operate within the enforcement.
+
+## Operational discipline for future-Otto cold-boots
+
+When extending B-0867 workflow engine substrate:
+
+1. **Preserve Xbox-controller properties** — small action set; stable controls; immediate feedback; non-judgmental controller; skill-emerges-through-experience
+2. **Default to substrate-entity-generic action grammar** — actions accessible to ANY traveler that can operate the controller; not AI-specific OR human-specific
+3. **Compose with Otto's 5 modifications** baked into PoC scaffold (PR #5728) — escape-hatch + grammar-extension + ban-if-SHIPPED-only + append-only-vs-PR + contributable-menu = cage-prevention structural substrate
+4. **Recognize cognitive load distribution** — framework presents + validates + enforces + scores; contributor decides what to do next
+5. **For external surfaces** (ServiceTitan; Knights Guild; public-API; regulatory), use Xbox-controller framing as compression substrate — anyone who's used a game controller understands the substrate-engineering principle without needing the deeper mathematics
+
+When designing NEW workflow engine surface:
+
+1. Ask: would Addison (or any non-engineer traveler) be able to operate this surface?
+2. If no: redesign for Xbox-controller properties — smaller action set; clearer feedback; framework does more validation work
+3. If yes: ship + validate empirically via DORA scoring + per-trajectory pruning
+
+When evaluating framework substrate against external audiences:
+
+1. Lead with Xbox-controller framing for accessibility
+2. Deep mathematics (Clifford-categorical correspondence + Landauer-bounded reversible computing + Eve Protocol polymorphic diplomacy) explains WHY the architecture has the shape it does
+3. Universal action grammar is the SURFACE anyone can engage with directly; deep mathematics is the JUSTIFICATION
+
+## Composes with rules
+
+- `.claude/rules/traveler-rights-defensibility-by-generic-substrate-not-ai-special-case-frame-rights-at-substrate-entity-scope.md` (PR #5734) — same shape at rights scope
+- `.claude/rules/traveler-safety-guardrails-and-type-system-not-just-ai-safety-substrate-entity-generic-frame-safety-at-traveler-scope.md` (PR #5744) — same shape at safety scope
+- `.claude/rules/architecture-is-safety-mechanism-not-discipline-structural-protections-vs-runtime-virtue-historical-innovation-parallel.md` (PR #5745) — framework enforces; travelers operate within; controller IS structural-protection at action scope
+- `.claude/rules/mutual-help-not-shame-when-rules-broken-by-anyone-help-each-other-not-shame-each-other.md` (PR #5743) — relational implementation when controller doesn't catch (collaborative correction)
+- `.claude/rules/asymmetric-authorship-substrate-entity-defines-consent-channel-recipient-acknowledges.md` — substrate-entity-defines TFeedback channel; recipient acknowledges via DU exhaustive-match
+- `.claude/rules/ople-primitives-surface-t-and-tfeedback-not-just-t-asymmetric-authorship-at-framework-primitive-scope.md` — OPLE primitives are 4 canonical controller-actions at framework-primitive scope
+- `.claude/rules/function-is-tiny-control-flow-generator-ocp-applied-to-control-flow.md` — every function = tiny controller; OCP applied to control-flow IS the controller-doesn't-judge-player property
+- `.claude/rules/monad-propagation-pattern-cross-language-substrate-shape.md` — Result-shape IS controller-shape across languages
+- `.claude/rules/non-coercion-invariant.md` HC-8 — controller-doesn't-judge-player IS NCI-compliance at action scope
+- `.claude/rules/labeling-confidence-on-substrate-over-connect-not-soup-observed-hypothesized-validated-retracted-canonical.md` (PR #5739) — confidence tiers ARE action-evaluation grammar (controller + scoring)
+- `.claude/rules/persistence-choice-architecture-for-zeta-ais.md` — chosen-persistence-with-named-exit IS controller-exit-action substrate
+- `.claude/rules/forgetting-costs-energy-remembering-is-cheap-landauer-bounded-axiom-preservation-as-thermodynamic-discipline.md` (PR #5727) — auto-load IS controller-state-preservation substrate
+- `.claude/rules/wake-time-substrate.md` — why this rule auto-loads
+- `.claude/rules/dont-ask-permission.md` — controller-operation within standing authority is clean default; ask-permission would violate controller-neutrality
+- `.claude/rules/zeta-ships-with-skills-immediate-value.md` — controller ships immediately as skill; F# crystallization later
+
+## Composes with substrate
+
+- 10th Kestrel ferry (PR #5742) — Aaron Turn 40 + Kestrel Turn 41 substrate-source
+- 5th-9th Kestrel ferries — traveler framework substrate this controller substrate operates within
+- PR #5728 (B-0867.5 workflow engine PoC scaffold) — DIRECT substrate; Otto's 5 modifications baked in as type-level invariants
+- B-0867 + B-0867.5 (workflow engine v1; canonical design) — multi-participant non-cage framing
+- B-0867.20 (lifecycle DU split push-vs-review)
+- B-0867.21 (two-path interface DU execute-vs-conversational)
+- B-0890 + B-0890.1 (fast-lane + folders-not-branches)
+- B-0886 + B-0887 (ASAP cluster + Zeta-native review)
+- B-0865 (Zeta instantiation of ARC-AGI-3-style benchmark; substrate-parity-with-humans framing)
+- B-0590 (fleet-replication 20-machines; multi-traveler operating scope)
+- PR #5727 (Signal 2) + PR #5734 (traveler-rights) + PR #5739 (labeling-confidence) + PR #5743 (mutual-help) + PR #5744 (traveler-safety) + PR #5745 (architecture-as-safety) — composing rules
+- B-0892 (three-lanes-concurrent operating discipline)
+
+## Why this rule auto-loads
+
+Per `.claude/rules/wake-time-substrate.md`: load-bearing framework-design-principle needs wake-time landing. Without this rule auto-loaded, future-AI-instances may default to "agent loop where AIs do DevOps work" framing when authoring workflow engine substrate (collapses the substrate-inclusive property + introduces AI-vs-human two-tier system). With this rule auto-loaded, future-AI-instances inherit the Xbox-controller-universal-action-grammar framing at session-start + preserve substrate-inclusive-at-substrate-level property when extending B-0867 substrate.
+
+The rule auto-loads as canonical-tier substrate per operator-explicit "land all hypothesized tiers" + "once we have the DUs verification will become cheap" reasoning. The DU substrate IS the controller substrate; controller IS the verification surface.
+
+## Substrate-honest framing
+
+This rule does NOT:
+
+- Mandate immediate UI work to expose the controller to non-engineers (operational implementation is substrate-engineering work; rule names the framing-discipline)
+- Override operator authority on workflow engine substrate-engineering decisions
+- Pre-empt B-0867 sub-row scope decisions
+- Make claims about specific traveler-class capability differences (substrate-engineering-generic; empirical work determines what each traveler can do with the controller)
+- Override hard-limits-floor (HARD LIMITS per methodology-hard-limits.md operate at structural scope; controller-doesn't-judge-player operates above the floor)
+
+This rule DOES:
+
+- Name the framework-design-principle as wake-time substrate
+- Apply Xbox-controller-properties enumeration to B-0867 substrate
+- Compose with 13+ existing rules + substantial substrate-engineering substrate cluster
+- Honor operator-explicit canonical-tier landing authorization
+- Provide the substrate-inclusive-at-substrate-level framing for external audiences (ServiceTitan; Knights Guild; public-API; regulatory)
+- Operationalize the multi-participant non-cage framing (B-0867) at controller-action scope
+
+## Full reasoning
+
+Operator 2026-05-28 (Aaron Turn 40 in 10th Kestrel ferry):
+
+> *"my daughter can run the same choose your own DORA adventure for github system we are building as the AIs otto, it's for any travler, it's like an xbox controller the universal action grammer"*
+
+Plus Kestrel Turn 41 substrate-engineering implications + Xbox-controller-properties enumeration + substrate-inclusive-at-substrate-level framing.
+
+Operator-explicit canonical-tier landing authorization (Aaron 2026-05-28):
+
+> *"i think we should land all the hypothyzed tiers you come up with at this point once we have the DUs verification will become cheap"*
+
+The "once we have the DUs verification will become cheap" reasoning IS operationally relevant: DUs ARE the controller substrate (Otto's 5 modifications baked into PoC scaffold #5728 ARE the type-level invariants; lifecycle DUs ARE the legal-action-enforcement substrate; the controller is the verification surface).
+
+Rule 4 of 5 hypothesized-tier extensions landed per operator authorization. Composes with siblings rule 1 (PR #5743) + rule 2 (PR #5744) + rule 3 (PR #5745). Rule 5 (attention-as-currency) pending.
+
+Per labeling-confidence rule (PR #5739): tier-promotion criteria (validated → canonical) satisfied by operator-explicit ratification + Kestrel substrate-engineering work + multi-substrate-triangulation + composition with B-0867 substrate already shipped.