SYS.41 / KEEL
KEEL — designing what does not exist yet
The rest of the product answers "what is this codebase?". KEEL is the half before: a bounded interview that takes any of four starting positions to a buildable plan.
The four quadrants
Where you are starting from decides what the interview is for.
| Has a codebase | No codebase | |
|---|---|---|
| Has an idea | FIT — ground the idea in real code: what changes, what breaks, what already exists | FOUND — design from zero, producing a real file scaffold |
| No idea | CHART — interrogate the code, propose directions with evidence, you choose | ORIGIN — a structured interview from base questions |
All four converge on the same artefacts. What differs is where the evidence comes from, and that difference is made visible rather than explained.
The stage machine
Each stage owns named facts it must establish. A turn’s job is to fill them, not to converse.
| Stage | Question |
|---|---|
| INTAKE | What are we working on? |
| SURVEY | What does the code actually say? (codebase quadrants only) |
| INTENT | What are we building, and why this rather than something else? |
| SHAPE | What is in, and what is deliberately out? |
| ARCHITECTURE | What is it made of, and what does each part own? |
| SCAFFOLD | Where does each of those live on disk? |
| PLAN | What is the smallest useful version, and what comes after? |
| HANDOFF | How does this leave the building? |
A stage exits when every required fact is settled, when its turn cap is hit, or when you press move on. SURVEY is omitted rather than greyed out for the quadrants that have no codebase: a stage that will never run must not look like work in progress.
The server decides every transition. The model may report that a stage is complete; that field is stored and read by nobody. The slot table decides, and it cannot be talked into anything.
Provenance
Four values, and the glyphs are load-bearing rather than decorative.
| Value | Meaning | Mark |
|---|---|---|
| VERIFIED | Read from the codebase and re-checked against the real file index | ■ |
| STATED | You said it, in your own words | ▶ |
| INFERRED | The agent worked it out | ◤ |
| UNKNOWN | Nobody established it | □ |
Three of the four places these appear are plain text where colour does not exist, so the glyph carries the meaning. One definition serves all of them.
- Unknown names are discarded, not created
- A model inventing a fact name would otherwise put a field in the session that no stage can complete, no screen can render and no export can explain — and it would look like data.
- VERIFIED is re-derived, never believed
- A citation that does not resolve demotes to INFERRED, and a VERIFIED claim with no citation at all demotes regardless.
- STATED must trace to an actual turn of yours
- This blocks the model laundering its own inference as your words — the subtlest failure available here, because the claim is perfectly plausible: it is about you.
Contradictions are dropped, never demoted
The one thing this has that a design tool working from your description cannot.
Every tool of this kind works from your account of your own system, so it can only agree with you. This one has the parsed repository behind it, and can answer "you said the API is REST, but thirty-four files import something else".
Because that is an accusation about somebody else’s codebase, every citation on it must resolve — one real path does not launder an invented one beside it. A contradiction that loses its evidence is discarded outright. There is no honest weaker form of "you are wrong about your own code".
What comes out
One plan, one scaffold, one record of the interview — and a pack of renderings of all three.
- The plan
- A typed, versioned document, every claim carrying its provenance. It ends addressed to a coding agent and is written to be pasted into one.
- The scaffold
- Real folders and files with a one-line purpose each, browsable before anything is written to disk.
- The session
- The interview reorganised by stage into decisions and the reasons for them.
- The pack
- Further documents — an agent-context file, a spec, a plan, a task list, a principles file, decision records, an architecture view and a threat model — each a pure rendering of the same gated plan. No second model call, so no second place for the same facts to disagree.
A session can also be adopted — the scaffold becomes a real project, which is then analysed, gets a Constitution and gets Skills. The whole loop closes.
Whether the plan is still true
A session freezes its evidence, so months later it sits there as green as the day it was written.
`pskl keel stale` re-runs the citation check against the newest snapshot and says which verified findings cite files that are no longer there. They can no longer be checked, which is a different claim from being false — and the command says the one it means.