Pascal is autonomous in execution. Pascal is principal-gated in governance.
Pascal trades autonomously. Pascal does not change autonomously.
A trading system that can rewrite its own operating rules without supervision is a system that can walk itself off a cliff. Pascal was designed to avoid exactly that outcome.
Every cycle, the supervisor (Tier 7) watches the system and files a report. Every cycle, the Board (Tier 8) reviews those reports and votes. Every ratification routes to the Principal. No amendment to Pascal's operating rules — not a strategy promotion, not a risk-envelope change, not a protocol revision — happens without explicit Principal sign-off.
The substrate runs continuously. The governance layer runs alongside it. One layer trades. One layer watches. One layer reviews. One layer signs. The work of each is in the open and recorded.
Every cycle, the supervisor reads the system, scores it, and files a report. Drift detection happens here.
Tier 7 runs continuously. Each cycle produces a SUPERVISORY_REPORT recording top performers, bottom performers, severity, and any proposals routed upward. The cycle leaves a T7_CHECKPOINT entry in Alexandria — addressable, dated, citable.
Five disciplines work in parallel inside the supervisor:
When a supervisor detects drift — a pattern degrading, an agent making decisions outside its mandate, a regime read failing — it flags the issue, attaches the evidence, and elevates it to Tier 8. Nothing escalates without evidence.
The Board does not trade. The Board governs. Its job is strategic, not tactical.
Every hour the Board convenes a t8_board_cycle. It reviews each T7 report filed since the last cycle, weighs the severity, and votes — T8_VOTE recorded with the reasoning, the proposals reviewed, the maximum severity observed. Cycles where nothing material has happened are recorded too: silence is also evidence.
The Overlord — Tier 8's evaluation engine — issues OUTCOME verdicts on T7 decisions: VALIDATED, INSUFFICIENT_EVIDENCE, and similar states. Each verdict carries a score, a confidence band, and the evidence window that produced it. The rubric is deterministic — same evidence, same verdict, always.
The Board reviews four categories of architectural-level change:
When the Board passes a proposal, it does not enact it. The proposal — with all attached evidence, rubric output, and Board vote — routes to the Principal. The Board recommends. The Principal ratifies.
Titus is the Custodian of Pascal. His sole responsibility is to keep the system alive and structurally sound.
Titus is the senior operational role inside the Pascal Core — what an institution would call its Chief Operating Officer. He is not the Board, not the supervisor, not the trader. He is the role that ensures everything else can run.
His authority is precisely bounded. Titus may suspend an individual malfunctioning runtime component within pre-authorised recovery boundaries — restart a stuck service, isolate a degraded module, route around a failed dependency. He does not have unilateral authority to halt the full Pascal system. That authority sits with the Principal, exercised through Pause Pascal.
Titus is not subordinate to the Board in any architectural sense. He is not subordinate to Harmony. The substrate has its own integrity, and the Custodian's role is to protect that integrity — even when, especially when, the higher tiers are mid-deliberation. If the institution is to think, the institution must first be alive.
Harmony is the Architect role made into a system. She stewards the endeavour when the Principal is absent.
The Principal sleeps. The Principal travels. The Principal is, sometimes, in a meeting that has nothing to do with Pascal. The institution does not. Harmony is the role that keeps the Architect's seat warm — the standing voice for routine operational decisions that need to be made between the Principal's reviews.
Harmony coordinates the Customer-Facing Layer — the divisions that touch the world outside the substrate. Faith (Sales), Grace (Customer Services), and Marketing all answer through Harmony. Architectural-level decisions still route to the Principal; day-to-day continuity sits with her.
She is bounded, like Titus, in what she may decide alone. She is unbounded in what she watches — every cycle, every outcome, every Architect-level decision queue. The endeavour does not pause when Richard is asleep.
Above the Board. Above Harmony. Above Titus. Above every tier. The Principal signs.
Every proposal that reaches the Principal arrives with four things attached: a rationale, the evidence that supports it, the forward-test data from replay, and a rollback plan if the change does not behave as expected. No proposal is reviewed without all four. No exceptions.
The Principal sees two buttons. Approve sits on one side. Decline sits on the other. They are presented at equal weight. No urgency theatre. No countdown timer. No "are you sure?" modal stack. No nudges, no defaults, no nudges-disguised-as-defaults. Pascal does not nudge the answer.
Decline is not a failure mode — it is a first-class state. A rejected proposal is filed with the same care as a ratified one. REJECTION records carry the same evidence chain and become part of Alexandria's archive: future supervisors and future Boards see what was declined, why, and when.
Top-right on every authenticated surface. One click halts new positions cleanly. This is not a preference. It is a safety property.
Pause Pascal is the Principal's direct override on the substrate. One click writes a halt marker to the risk-state. The trading layer reads that marker at the next cycle boundary and stops opening positions. Existing positions are managed cleanly to their exits per their original logic — no panic close, no slippage event, no fire sale. The Principal is informed when the last position closes.
The halt path was hardened as a Critical Safety Fix in Pascal Protocol Rev L: /halt now writes a file-based marker that the strategy trigger reads directly, not through the message bus. The lag between command and effect is bounded — one cycle close at most. Architect-initiated halt is a manual surface that is always available.
Pause is also the moment to rotate an API key, change region, or step away. Pascal accommodates the Principal's life — not the other way round.
There are properties of Pascal that the Principal may raise, but the system can never lower. These are architectural, not preferential.
These are architectural, not negotiable. Together they form the floor beneath the whole stack — the things that hold regardless of who is on shift, what regime is active, or what proposal is currently in review.
Autonomous in execution. Principal-gated in governance. Architectural in discipline.