On what is shared
and what is kept.
This document fixes, for every artefact of the System, which side of the line it sits on and where it shall therefore live.
The System is built of a shareable Shape wrapped around a private Content. The product ships the Shape; the Content shall never leave the Operator's own surfaces.
These Articles establish the criterion by which every artefact is assigned its side, and the home each side is owed.
The dividing criterion.
An artefact is Shape if it would still be true and useful for a different Operator who installed the System fresh; it is Content if it encodes this Operator.
Shape is the methodology, the institution patterns, the automation skeleton. Content is one Operator's authored rules, their studio, their clients, their machine, their identity. The line between them governs everything that follows.
Where an artefact encodes the Operator's principles, their studio, their clients, their machine, or their identity, it shall be held as Content and kept private.
The three tests.
Three sharper tests shall be applied in order to determine the side of any artefact.
First, the Substitution test: replace the Operator with a stranger; if the artefact still makes sense unedited it is Shape, and if it needs rewriting it is Content. Second, the Disclosure test: if it could not be published to a public repository without leaking a client name, a price, a person, a credential, a private path, or PII, it is Content. Third, the Pattern test: the pattern is Shape, the filled-in instance is Content.
A role-folder layout, a lift pipeline, an invariant schema: these are Shape. The Operator's actual role rules and the canonical studio sentence: these are Content.
The rule for the mixed file.
An artefact that fails one test on some sections and passes on others is Mixed, and no Mixed file shall be split before its time.
The boundary line shall be recorded inside the file, or in the per-surface tables of this document, so that the cutover may split it mechanically. Premature splitting fragments working files; the cutover is the one place a split is cheap and verified.
Until that cutover, the Mixed file is held whole, with its line of division marked and waiting.
The home of each surface.
Each surface of the System is assigned its side, and lives where its side is owed.
The Canon is some seventy parts Shape to thirty parts Content, split mostly clean by folder: the framework, architecture, principles, and invariants are pure Shape; the studio-operator material is Content and stays private. The harness already carries the split at repository level: a generic core and a personal overlay, composed at install. The vault is all Content and never migrates; only its empty shape, the folder layout and templates, is shareable. The harness-personal layer is all Content by definition, and nothing within it is ever a candidate for extraction.
The auto-memory store is Content, being facts about the Operator; the mechanism that holds it is Shape. The memories themselves shall never leave the private vault.
The guarded-generic allowance.
Between pure Shape and pure Content stands a third state: the artefact that is generic in form yet coupled to the vault or the overlay.
Where a generically located hook is vault-coupled, it shall stay in the generic repository behind an existence guard, and shall no-op cleanly when the personal overlay or vault is absent. It shall not be moved; instead its coupling shall be documented, so that an Operator reading the generic settings is not misled by a hook that quietly does nothing.
Thus the filing rule is the Substitution test plus this allowance: generic and self-contained goes to the Shape; operator-specific goes to the Content; generic but coupled stays generic, guarded, and declared.
These Articles may be amended in the open, as a charter shows its revisions.
The cursor waits for the next hand.