What the engine is

A job, not a service

The engine runs on a schedule, reads the contracts in its config, grades every entry and records a decision for each one. Then it exits. There is no process to keep alive, no uptime to monitor, and no in-memory state between runs.

This was chosen over a long-running service on purpose. ADR-001 weighed both. A daemon buys sub-minute reaction time, which is irrelevant when the headroom being defended is measured in days, and costs patching, uptime monitoring and restart handling. It is also harder to verify: “trust me, the daemon is running” against a log of discrete runs you can read.

It decides; it does not act by default

A run produces one decision per entry — SKIP with a reason, or a planned extension. In dry-run, which is what an omitted mode means, the plan is recorded and nothing is signed or submitted. Live is an explicit opt-in, never a default and never inferred.

A refusal is a first-class outcome, not an error. When the write guard declines a subject the run records REFUSED BY WRITE GUARD and carries on to the next contract — one protected subject must not abort a run, or a guard on one contract would silence the engine for every other. Guards

What the schedule costs you

The trade is reaction time. Worst case, an entry crosses a threshold immediately after a run and waits a full interval before anything notices. So the interval is part of your threshold: set the act-now boundary with the schedule in mind, not against it.

And a scheduler is not a metronome. Ours has been measured, and the delivered cadence is not the configured one — the figures, the delivery rate and the worst observed gap are published on the engine page rather than repeated here, because a second copy of a measurement drifts from the first.

A missed run has to be visible

If the schedule does not fire, nothing happens — and nothing happening looks exactly like nothing needing to happen. That is the failure mode this shape introduces, so it is treated as one: cold starts and scheduler reliability are alerted on, and a missed run is meant to be noticed rather than silently absorbed.