Design principles · Saphan Studio documentation

Product invariants: a change that threatens one is escalated, never worked around.

Product invariants. A change that threatens one is escalated, never worked around.

Principle	In practice
Transport, not judgment	The engine automates routing, artifact generation, and mechanics. It never automates a gate decision. No feature may auto-accept, auto-merge, or skip a gate.
A human decides, and the record shows it	Plan approval, acceptance, merge, teardown are explicit human acts, recorded with the actor's name. A consultant — AI or human — may suggest; the suggestion and the decision are distinct recorded events, and an override is itself recorded.
Sanction binds change classes, never time	Delegated acceptance exists only under a named, pinned, human-owned policy scoped to explicit change classes. A timeout never grants an approval.
Git is the system of record for code	The engine observes commits, branches and merges; it never pushes, merges on its own authority, or mutates remote git state. A stream is merged only when a real merge commit is observed — never because someone typed it.
Deterministic first	No model call where ordinary code suffices. Every piece of engine work states its tier — deterministic, local model, frontier model — and "frontier by default" is treated as a design error. This is a cost principle and a safety one.
Capture, not invent	Lessons from incidents are structured into proposed rules; a human approves every promotion into standing practice, and provenance is preserved on each rule.
Secrets never propagate	No subsystem stores or transmits a secret value — names, paths and references only.
Proof, not declaration	A claim in a run's return is backed by an artifact you can check — a diff, a test that fails when the guarded mechanism is broken, a named refusal. A green test that cannot detect the failure it guards is treated as zero protection.