Code generation by frontier models is already good.

The unsolved problem is the rest of the lifecycle: a model — often a *different, weaker* model than the author — must later read, understand, and safely change that code.

The Discipline optimizes for that.

Its single design target is to **lower the minimum model capability required to maintain code safely**, so that a swarm of small agents can maintain code that a frontier model authored.

The economics that justify everything below: a strong author runs **once**; weak readers run **thousands of times**.

So the discipline moves cost from maintenance-time to authoring-time.

The strong author materializes expensive cognition into infrastructure — meta-layer, contracts, executable scaffolds, recorded rationale — and the weak swarm lives off that capital.

**The Discipline is a capability-gap compensator.**

A clever construct with no materialized rationale is theft from the reader pool.

This is why "make the code simpler" is the wrong frame.

We are not lowering the ceiling of what the code does; we are lowering the floor of who can safely touch it.

The axioms are unchanged from the Charter; here is what each *means for how code and its metadata are written*.

The strongest empirical result we found, dated and controlled: models collapse on out-of-distribution *surface syntax* (EsoLang-Bench, Mar 2026: frontier models 0–11% on esoteric languages they could solve trivially in Python) — **and** current agents largely *recover* that collapse through tools and in-session strategy (the Jun 2026 follow-up: the same tasks, 87–100% with file-editing + interpreter loops).

In-context learning could **not** teach the unfamiliar surface (few-shot gave ~0 benefit); the recovery came from the verification loop and from building executable helpers, not from prose.

The law that follows:

Concretely: AI-Native Rust looks like *ordinary idiomatic Rust* at the token level (no invented notation, no exotic dialect — that would inherit the OOD penalty).

What is unusual is everything around it:

We do not make the language stranger; we make its envelope stricter.

"AI-native" is **more** discipline, not less — but the added strictness lives exclusively in machine-checkable form.

More types, more contracts, more verification, more metadata — never more exotic syntax.

Every constraint we add must be either enforced by a checker (A5) or it does not exist.

A rule a model must *remember* is a rule that decays; a rule a compiler *enforces* is a rule that holds.

The discipline's strictness is the compiler's strictness, extended.

**Bans carry escape hatches.**

Forbidden-by-default constructs (raw `unwrap` in domain logic, inline asm, proc-macro magic, stringly-typed protocols) remain legal *with machinery and a recorded reason* — the `unsafe` / `#[spec(deviates, reason)]` pattern.

A ban with no escape hatch is a bug in the discipline; a deviation with no reason is a bug in the code.

**The strictness is equal across projections.** No language projection enforces the discipline more weakly than another; a rule the pilot enforces is either enforced in every projection or its absence carries a recorded reason.

This is the projection-level twin of `##BAN-WITHOUT-HATCH-IS-A-BUG`: an unexplained asymmetry between projections is a bug in the discipline exactly as a reasonless deviation is a bug in the code. A projection is weaker *with machinery and a recorded reason* — a language genuinely lacking an idiom's analogue (the compiler already enforces it; the idiom does not exist in that language) records that, and the recorded reason is the escape hatch.

The pilot language is the current reference bar because it is furthest along, not because it is privileged; as a projection matures past the pilot on some axis, the bar rises to it. A new language inherits the law on arrival — it is a projection of the one discipline, held to the same floor.

A projection weaker on some rule with no recorded reason is not a smaller stack; it is the discipline silently decaying — the failure mode A5 and A6 exist to make impossible. Weakening a rule for a projection because building its checker is harder there is the same category of error as dropping the rule for being unused (§4): the checker is built or the reason is recorded, never the rule quietly relaxed.

The second decisive result: weak agents given a *written* distillation of a strong agent's strategy barely improved; given an *executable* helper library carrying the same strategy, they leapt (Sonnet 4.6 on Brainfuck: 12→12 with text, 12→64 with runnable helpers).

The mechanism: mid-tier models do not lack the idea; they cannot build the reusable code to carry it out.

Therefore: **explanation capital must be runnable capital.**

The meta-layer ships *executable scaffolds* — generators, typed builders, runnable contracts, differential oracles, compiled examples, local simulators (the nine classes; see `02-EXECUTABLE-SCAFFOLDS.xml`).

Prose that *could* be a checker, a doctest, or a typed API is a WISH until it becomes one.

A spec that says "use the registry pattern" is weaker than one that ships the registry macro plus a working example.

**The honest boundary on this:** that result is about *generation* against an unfamiliar target.

Transfer to *comprehension and modification* of in-distribution Rust is [E-mid] — plausible, not yet measured on our codebase.

It is the primary thing the pilot must validate.

The owner's central worry is correct: a weak model cannot apply forty rules at once, in the right order.

The resolution is that **rules are never all active at once.**

Each rule/pattern is a *card* (`01-PATTERN-CARD-FORMAT.xml`) carrying a **Trigger** (when to switch on), a short **Routine** (≤7 steps), a **Checker** (machine verification), and a **Budget** (attention cost).

The harness delivers only the cards whose triggers fire, as a small activation-matched set (lazy-push). *Specified, not built at card grain: no harness reads a card. Lazy-push itself is real one level up — `vibe` implements `DeliveryMode::LazyPush` for **subskills**, matching an agent's task description against a subskill `description`, with `vibe check` enforcing that a lazy-push unit carries one and warning on activation overlap between siblings. Nothing applies that machinery to cards: no reader of `card-ops`, of a card `trigger`, or of `cards/INDEX.md` exists in any language anywhere in the repository. Card delivery today is a boot instruction a session follows by hand, not an activation match the harness computes.*

Triggers escalate by cost:

This is grounded in the AGENTbench result (Feb 2026): bloated context *hurts* weak agents; minimal, sufficient context helps.

The discipline therefore proselytizes minimal sufficiency — and obeys it: this package is a full authoring/review artifact, but runtime delivery to a weak reader is an *extract* (the card's ops block), never the whole corpus.

This is a beta.

Stated plainly so the pilot can falsify it:

A discipline that names its own failure modes is more trustworthy than one that hides them.

This one names them.

**Guiding layer (T1, language-independent):**

**Mechanisms (T1, language-independent; implemented per-stack):**

Spec-unit URIs for this package read `spec://org.vibevm.ai-native/core-ai-native/<docpath>#<anchor>` (e.g. `spec://org.vibevm.ai-native/core-ai-native/mechanisms/ENGINE-CONFORM-v0.1#rules`); the Rust implementations ship in `stack:org.vibevm.ai-native/rust-ai-native-lang` (`rust-ai-native-conform`, `rust-ai-native-specmap`, `rust-ai-native`).

**Language projections (T2):**

**Cards (the patterns) — shipped per-language by each stack:**

**Appendix (synthesis provenance):**

The vibevm-specific adoption plan lives OUTSIDE this package, in the host's `terraform/`, because the Discipline is the product and vibevm is its pilot.