DLP Specification
Part V: Human Interface Layer

§15 Signal Capture

Object-anchored problem capture. Seven signal types. Flaggable object model. Seven-state lifecycle.

§15 Signal Capture

v2.0.0 · Locked · L1 · March 19, 2026

§15 Purpose

Signal Capture is the mechanism by which humans surface problems, concerns, or observations about governed objects within the substrate. Every signal attaches to a specific governed object and asserts: something about this object requires attention. Signals route to the flagged object's authority chain (B8, §5), ensuring that captured concerns reach someone with the power to act.

Signal Capture is an extension point, not a primitive. The DLP-Core protocol defines the capture requirement through two behavioral invariants: B7 (every governed object is flaggable) and B8 (every signal routes to authority). The ProtoLex Substrate provides the implementation — signal types, routing logic, lifecycle management, and IQ integration. Signal is not one of the 19 primitives (§4); it is an operational mechanism that operates on all 19.

§15 Foundation

§14 provides the parent capture framework. This section specifies Signal Capture as the first of two concrete capture mechanisms. IQ Capture (§16) specifies the second. Signal Capture serves a single architectural purpose: converting human observation of object-level problems into structured, routable governance data.

§15 Governance

No governance authority distinct from lineage for this document.

§15 Substance

§15.1 Signal Capture Definition

Table 15.1.1: Signal Capture Boundary

Signal Capture ISSignal Capture IS NOT
Object-anchored — every signal targets a specific governed objectGlobal ideation capture — use IQ Capture (§16) for free-floating insights
Problem-oriented — "this thing is wrong"Emergence-oriented — "something surfaced" is IQ territory
Reactive — responding to an observed concern about an existing objectGenerative — capturing new ideas or questions belongs to IQ Capture
Routed to the flagged object's authority chain (B8)Routed to the user's personal queue — signals go to authority, not to self

Distinction from IQ Capture. Signal Capture flags problems with existing objects. IQ Capture (§16) captures cognitive overflow that emerges during work but does not anchor to any single object. A signal says "THIS thing is wrong." An IQ says "something emerged that needs a home." The mechanisms are parallel, not subordinate (§14.5).

Six design principles govern Signal Capture:

  1. Zero friction. One selection (signal type) to complete capture. Free text description is available but never required.
  2. Always available. Present on every governed object — all 19 primitives across all 5 tiers (B7, §5). Every interface that renders a governed object MUST include a signal capture entry point.
  3. Structurally typed. Seven signal types classify the nature of the concern and determine routing. Categories map to primitives for automated routing decisions.
  4. Optionally deep. Free text, severity, related signals, and IQ creation are available but optional. Capture MUST succeed at minimum effort.
  5. Authority-routed. Every signal routes to an authority on the governance chain for the flagged object (B8, §5). Algedonic bypass permits routing to any depth in the delegation hierarchy.
  6. Context preserved. A snapshot of system state at capture time is recorded with every signal. This snapshot is immutable — it preserves what the human observed at the moment of capture.

§15.2 Signal Types

Seven signal types classify the nature of the concern and determine routing. The first five are standard signal types for problem-oriented concerns. The sixth — curiosity — is a positive perturbation signal for opportunities. The seventh — reservation — is the second-order lineage extension defined in §14.6.1.

Table 15.2.1: Signal Type Definitions

TypeLabelDescriptionPrimary Primitives
reality_mismatchReality Mismatch"The data does not match what I see" — observed state diverges from recorded stateEvidence, Account
logical_inconsistencyLogical Inconsistency"These things contradict each other" — governed objects are in mutual conflictDecision, Commitment, Intent
business_concernBusiness Concern"We can, but should we?" — strategic or value misalignmentOrientation, Capacity
compliance_concernCompliance Concern"We may not be allowed to do this" — authority or constraint questionAuthority, Constraint
otherSomething Else"Does not fit the categories above" — escape valve for uncategorized concerns(none — taxonomy gap indicator)
curiosityCuriosity"This could be an opportunity" — positive perturbation where something unexpected, promising, or worth investigating has been observed. Semantic polarity is flipped: curiosity signals surface opportunities, not problems.Orientation, Learning, Evidence
reservationAccepted with Reservation"I accept but hold objections" — second-order lineage (§14.6.1)Decision, Commitment

Curiosity as positive perturbation. The first five standard signal types are problem-oriented — they surface concerns, mismatches, inconsistencies, and compliance questions. Curiosity inverts the semantic polarity: it signals that something worth investigating has been observed, even though nothing is wrong. A human notices an unexpected pattern, an unexplored opportunity, or an emergent capability that the governance record does not yet reflect. Curiosity signals route through the same B8 mechanism as problem-oriented signals — they reach authority on the flagged object's governance chain — but the authority's response is exploratory rather than corrective. Curiosity signals frequently spawn IQs (§16) because investigation is the natural response to a positive perturbation.

Signal type selection guidance. Signal types are mutually exclusive per signal instance. A single concern selects one type. If the concern spans multiple types (e.g., a reality mismatch that also raises a compliance question), the human selects the primary type and may describe the secondary dimension in the free text field, or raise a second signal.

Taxonomy evolution. The other type serves as an escape valve. High frequency of other signals indicates taxonomy gaps — the existing six standard types do not cover the concern space. Signal distribution analytics (signal type frequency by object type, by account, over time) enable taxonomy refinement. Licensee configurations MAY add signal types beyond the required seven; they MUST NOT remove any of the seven.

§15.3 Flaggable Object Model

B7 (§5) requires that every primitive class have a signal attachment surface. The flaggable object type enumeration covers all 19 primitives across all 5 tiers (§4.5).

Table 15.3.1: Flaggable Object Types

PrimitiveTierDefault Routing TargetTypical Signal Types
Intent1owner_id — intent owner is responsible for purpose alignmentlogical_inconsistency, business_concern
Commitment1owner_id — commitment owner accepted the responsibilitylogical_inconsistency, reality_mismatch, reservation
Capacity1owner_id — capacity owner controls the resource allocationreality_mismatch, business_concern
Work1assigned_to_id — work assignee is executing the transformationreality_mismatch, logical_inconsistency
Evidence1verified_by (or author_id if unverified) — verifier is the last authority; author if no verifier assignedreality_mismatch, compliance_concern
Decision1made_by — decision-maker is accountable for the choicelogical_inconsistency, compliance_concern, reservation
Authority1holder_id — authority holder governs its own delegation scopecompliance_concern, logical_inconsistency
Account1steward_id — account steward maintains the state recordreality_mismatch, logical_inconsistency
Constraint1owning_authority_id — constraint owner controls the rulecompliance_concern, logical_inconsistency
Identifier2owning_entity_id — entity that owns the addressed objectreality_mismatch
Entity2parent_entity_id (or self if root entity) — parent entity in recursive structurecompliance_concern, reality_mismatch
Context2owner_id — context owner established the situational framereality_mismatch, business_concern
Namespace2steward_id — namespace steward governs concept definitionslogical_inconsistency, compliance_concern
Orientation3owner_id — orientation owner holds the cognitive stancebusiness_concern, logical_inconsistency
Learning3source_entity_id — source entity initiated the learning cyclereality_mismatch, business_concern
Activation3owner_id — activation owner controls readiness assessmentbusiness_concern, reality_mismatch
Interpretation4assigned_to — assigned reviewer owns the meaning-resolutionreality_mismatch, logical_inconsistency
Environment Interface4owning_entity_id — entity that owns the boundary with external systemsreality_mismatch, compliance_concern
Cycle5executed_by — cycle executor manages the temporal patternreality_mismatch, business_concern

Routing rationale for infrastructure and extension primitives. The Tier 1 primitives have well-established routing targets (owner, assignee, maker, holder). The following six primitives from Tiers 2–5 require specific routing rationale:

  • Account routes to the account steward. Typical signals are reality_mismatch (state record diverges from observed organizational state) and logical_inconsistency (account records conflict with decisions or commitments recorded elsewhere).
  • Constraint routes to the constraint's owning authority. Typical signals are compliance_concern (rule applicability is questioned) and logical_inconsistency (constraints conflict with each other or with authority delegations).
  • Identifier routes to the owning entity. Typical signals are reality_mismatch (broken references, duplicate identifiers, addressing failures).
  • Namespace routes to the namespace steward. Namespace governance varies by scope: core-scope concepts route to the protocol steward, domain-scope to domain authority, tenant-scope to organizational steward, sandbox-scope to sandbox owner. Typical signals are logical_inconsistency (concept conflicts across scopes) and compliance_concern (unauthorized concept additions).
  • Activation routes to the activation owner. Typical signals are business_concern (readiness assessment disputes — conditions are met but the activation should not proceed, or vice versa).
  • Environment Interface routes to the owning entity responsible for the boundary with external systems. Typical signals are reality_mismatch (external data does not match substrate state) and compliance_concern (boundary violations, unauthorized data exchange).

§15.4 Signal Schema

The signal flag schema defines field requirements at the architectural level. Substrate implementations MUST provide these fields; they MAY extend with additional fields.

Table 15.4.1: Signal Flag Schema

FieldTypeRequirementImmutableDescription
flag_idIdentifierREQUIREDFrom creationUnique signal identifier
object_typeEnumeration (19 primitive types)REQUIREDFrom creationFlagged object's primitive type — MUST be one of the 19 primitive types
object_idReferenceREQUIREDFrom creationFlagged object's identifier
signal_typeEnumeration (7 types)REQUIREDFrom creationConcern classification — one of the seven signal types (§15.2)
severityEnumeration: low, medium, high, criticalOPTIONALNoSignaler's assessment of urgency; defaults to medium if unspecified
descriptionTextOPTIONALFrom creationFree text description of the concern — IMMUTABLE after capture
raised_byReference → EntityREQUIREDFrom creationThe human who raised the signal
raised_atTimestampREQUIREDFrom creationWhen the signal was raised
context_snapshotObjectREQUIREDFrom creationSystem state at capture time — IMMUTABLE after capture (see Table 15.4.2)
routed_toReference → EntityREQUIREDPer routing eventAuthority holder the signal is routed to; updated on escalation
routed_atTimestampREQUIREDPer routing eventWhen routing occurred
statusEnumeration (7 states)REQUIREDNoCurrent lifecycle state — see §15.6
spawned_iq_idReference → IQOPTIONALFrom assignmentIf this signal spawned an IQ, the linked IQ identifier
related_signalsArray of ReferencesOPTIONALNoLinks to related signals on the same or related objects
resolutionObjectOPTIONALFrom resolutionResolution record: summary, resolver identity, timestamp, linked artifacts
dismissalObjectOPTIONALFrom dismissalDismissal record: rationale, dismisser identity, timestamp
escalation_historyArray of ObjectsOPTIONALAppend-onlyRouting history: each escalation event records previous target, new target, reason, timestamp
reservation_natureEnumeration (7 natures)ConditionalFrom creationREQUIRED when signal_type = 'reservation'; classification per §14.6.1
surface_triggerObjectConditionalNoREQUIRED when signal_type = 'reservation'; trigger configuration per §14.6.1

Progressive immutability. Signal fields become immutable at the state where they are set. Fields set at creation (object identity, signal type, description, context snapshot, attribution) are never modified. Fields set during processing (routing, resolution, dismissal) are immutable from their assignment point. This enforces audit integrity: the governance record preserves what was observed, when, by whom, and how it was resolved.

Table 15.4.2: Context Snapshot Schema

FieldRequirementDescription
object_stateREQUIREDCurrent state of the flagged object at capture time — property values, status, relationships
object_labelREQUIREDHuman-readable label of the flagged object
captured_atREQUIREDTimestamp of the snapshot
preceding_actionOPTIONALWhat the signaler was doing immediately before raising the signal
active_constraintsOPTIONALConstraints currently in scope for the flagged object
view_contextOPTIONALThe signaler's interface context — view mode, filters, navigation path

The context snapshot is the evidentiary basis for the signal. It captures what the signaler observed at the moment of capture. The snapshot is IMMUTABLE — even if the flagged object's state changes during processing, the snapshot preserves the state that prompted the concern.

§15.5 Signal Routing

Signal routing implements B8 (§5): every signal MUST reach an authority on the governance chain for the flagged object. Routing occurs automatically on signal creation and may be overridden through escalation at any non-terminal state.

Table 15.5.1: Default Routing Rules

TierObject TypeDefault RouteEscalation Path
1Intentowner_idOwner → parent entity authority → account authority → root authority
1Commitmentowner_idOwner → authorizing authority → account authority → root authority
1Capacityowner_idOwner → commitment authority → account authority → root authority
1Workassigned_to_idAssignee → commitment owner → account authority → root authority
1Evidenceverified_by / author_idVerifier → account authority → root authority
1Decisionmade_byDecision-maker → authorizing authority → account authority → root authority
1Authorityholder_idHolder → delegating authority → root authority
1Accountsteward_idSteward → parent account steward → root authority
1Constraintowning_authority_idOwning authority → delegating authority → root authority
2Identifierowning_entity_idOwning entity → namespace steward → root authority
2Entityparent_entity_idParent entity → grandparent entity → root authority
2Contextowner_idOwner → account authority → root authority
2Namespacesteward_idSteward → scope authority (per namespace governance scope) → root authority
3Orientationowner_idOwner → account authority → root authority
3Learningsource_entity_idSource entity → parent entity → root authority
3Activationowner_idOwner → commitment authority → root authority
4Interpretationassigned_toAssigned reviewer → account authority → root authority
4Environment Interfaceowning_entity_idOwning entity → integration authority → root authority
5Cycleexecuted_byExecutor → cycle owner → account authority → root authority

Algedonic bypass. Any signal MAY be escalated to any depth in the authority chain at any non-terminal state. The default route targets the nearest authority; algedonic bypass allows direct routing to higher authority when the signaler judges the default route insufficient. This implements Beer's algedonic channel: emergency signals bypass intermediate hierarchy to reach whoever has the power to act. Algedonic bypass prevents organizational silence — signals cannot be trapped at a level that lacks the power or willingness to act.

Routing fallback. If the primary routing target is null (e.g., unverified evidence with no verified_by), the system falls back to the authority chain for the flagged object's containing account. If no account context exists, the signal routes to the instance-level root authority. A signal MUST always route somewhere — an unroutable signal is a B8 violation.

Table 15.5.2: Routing Override Rules

ConditionOverrideRationale
signal_type = 'reservation'Route to flagger's own queue (not authority chain) unless reservation_nature involves compliance or authority concernsReservations are self-directed — the flagger defers their own objection for future review (§14.6.1)
severity = 'critical'Auto-escalate one level above default routing targetCritical signals warrant immediate attention from higher authority
signal_type = 'compliance_concern'Copy to compliance authority regardless of default routing targetCompliance concerns require visibility to the compliance function independent of the flagged object's authority chain
Routing timeout (configurable)Auto-escalate one levelUnacknowledged signals escalate to prevent silent suppression

§15.6 Signal Lifecycle

The signal lifecycle governs flags from creation through resolution. The authoritative lifecycle specification is the state machine companion (v9/state-machines/signal-lifecycle.md); this subsection provides the architectural summary.

Seven states. Two terminal.

Table 15.6.1: Signal Lifecycle States

StateEntry ConditionExit TransitionsAuthority Required
CreatedHuman raises signal on a governed object; context snapshot captured→ Routed (automatic, B8)None — any human may raise a signal on any governed object
RoutedSystem auto-routes to authority holder per Table 15.5.1→ Processing (authority acknowledges) or → Escalated (algedonic bypass or timeout)System (automatic routing)
ProcessingAuthority holder accepts signal for review→ Resolved, → Dismissed, → Escalated, → Monitoring (IQ spawned)Routed or escalated-to authority holder
EscalatedSignal forwarded up the authority chain→ Processing (higher authority accepts) or → Escalated (further escalation)Any human on authority chain, or system (timeout)
MonitoringAuthority spawns IQ from signal→ Resolved (IQ resolves substantively) or → Dismissed (IQ dismissed) or → Processing (IQ refused/superseded without replacement)System (triggered by IQ lifecycle events)
ResolvedConcern substantively addressedTerminalProcessing authority holder, or system (from IQ resolution)
DismissedConcern determined not actionableTerminalProcessing authority holder — MUST NOT be the signal raiser

Table 15.6.2: Terminal State Semantics

Terminal StateMeaningRequired Artifacts
ResolvedThe concern was substantive and corrective action was taken or a substantive determination was madeResolution summary describing the action taken; resolver identity; timestamp; linked governance artifacts (modified objects, new Work items, new Decisions)
DismissedThe concern was determined not actionable — noise, misunderstanding, or already addressedDismissal rationale (mandatory — silent dismissal is a B8 violation); dismisser identity; timestamp

No reversion from terminal states. A resolved or dismissed signal cannot be reopened. If new information surfaces that re-raises the same concern, a new signal MUST be created. The new signal MAY reference the prior signal, but the governance record maintains distinct lifecycle instances. This preserves audit integrity — each signal is a complete, self-contained lifecycle.

Dismissal authority constraint. Dismissal MUST NOT be performed by the signal raiser. Only an authority on the flagged object's governance chain may dismiss a signal. This prevents self-suppression: the person who raised the concern cannot also decide it was not actionable. The dismisser MUST provide a rationale — the rationale is part of the governance record and is subject to audit.

Reservation lifecycle variant. Reservation signals (signal_type = 'reservation') follow the same seven-state machine with modified transition behavior (see state machine companion, Reservation Signal Variant). Key differences: routing targets the flagger's own queue (not the authority chain) unless compliance-related; processing is triggered by surface trigger activation (not authority acknowledgment); the flagged object proceeds without interruption (NON-BLOCKING per §14.6.1).

§15.7 IQ Integration

Signal Capture integrates with IQ Capture (§16) at two defined interaction points. These interactions create bidirectional traceability between the signal and IQ lifecycles.

Signal spawns IQ. During processing, the authority holder determines that the concern requires deeper investigation than a signal resolution can provide. The authority creates an IQ with origin_type = "signal" and source_signal_id linking to the originating signal. The signal transitions to Monitoring and remains open until the IQ reaches a terminal state.

The signal does not close when an IQ is created. The signal's lifecycle tracks the concern; the IQ's lifecycle tracks the investigation of that concern. Until the investigation concludes, the concern is unresolved.

Table 15.7.1: IQ Resolution to Signal State Mapping

IQ Resolution OutcomeSignal Terminal StateRationale
adjusted — object was correctedResolvedThe concern was substantive; corrective action was taken
spawns_new — IQ spawned new Work, Decision, or IQResolvedThe concern was substantive; organizational action followed
converts — IQ converted to formal Decision or WorkResolvedThe concern was substantive; promoted to governance action
dismissed — signal was noiseDismissedThe concern was investigated and determined not actionable
refused — investigation refused without successorReturns to ProcessingThe signal concern remains unresolved; authority must re-evaluate
superseded — IQ replaced by another IQStays in MonitoringThe signal tracks the successor IQ until it resolves

IQ spawns signal. During IQ investigation, the investigator discovers a problem with a specific governed object. A new signal is created with origin_type = "iq" and origin_iq_id linking to the parent IQ. The signal enters the standard lifecycle independently of the parent IQ. The IQ records the spawned signal reference for traceability.

Bidirectional traceability. Every signal-IQ interaction creates links in both directions. A signal that spawned an IQ carries spawned_iq_id; the IQ carries origin_type = "signal" and source_signal_id. An IQ that spawned a signal carries the spawned signal reference; the signal carries origin_type = "iq" and origin_iq_id. The lineage chain is traversable in either direction through the dual-language query layer (§28).

Table 15.7.2: Cross-Machine Interactions

InteractionDirectionDescription
Signal → IQ LifecycleOutboundSpawning an IQ creates an IQ instance entering the IQ lifecycle at Open. The signal enters Monitoring and reads the IQ's terminal state but does not transition it.
Signal → Truth Type SystemConstraintSignals carry truth type Authoritative (§6). The context snapshot is Authoritative evidence. If resolution produces new evidence, that evidence enters the truth type system at its own appropriate type.
Signal → Record LifecycleIndependenceSignals can target objects in any record lifecycle state. A signal on a Superseded object is valid. Supersession of the flagged object does not auto-resolve the signal.
Signal ← Claims GraduationInboundA pattern of resolved signals on the same object type or account may be asserted as a Claim and enter the Claims Graduation protocol (§6.5).

§15 Boundaries

Signal Capture is limited to flagging problems with existing governed objects. It does not create new governance records; it does not serve as a general feedback mechanism; it does not route to user personal queues. Signal routing MUST respect the authority chain for the flagged object; it MUST NOT bypass authority entirely.

§15 Positions

Locked positions:

  1. Signal Capture flags problems with specific governed objects and routes to authority on the flagged object's governance chain (B8).
  2. All seven signal types are required and mutually exclusive per signal instance.
  3. Signal context snapshots are immutable from capture and provide evidentiary basis for the concern.
  4. Signal routing implements algedonic bypass; escalation is available to any depth in the authority chain.
  5. Dismissal authority constraint: dismissal MUST NOT be performed by the signal raiser.
  6. Signals and IQs are independent lifecycle mechanisms that can spawn each other with bidirectional traceability.
  7. Reservation signals are non-blocking and route to flagger's personal queue (unless compliance-related).

§15 Lineage

Version history:

  • v2.0.0 (2026-03-19): Locked specification with seven signal types, comprehensive flaggable object enumeration across all 19 primitives, schema with progressive immutability, seven-state lifecycle, and full IQ integration.

Provenance:

This section defines Signal Capture as a concrete instantiation of the Capture Principle (§14.1) with full schema, routing, lifecycle, and IQ integration details. It specifies behavioral enforcement of B7 (all objects flaggable) and B8 (signals route to authority) with enumerated primitive types, routing targets, and escalation paths.

§15 Commitments

SDK MUST constraints:

  • MUST enforce B7: every interface that renders a governed object MUST include a signal capture entry point covering all 19 primitive types.
  • MUST enforce B8: every signal MUST route to an authority on the governance chain for the flagged object; algedonic bypass MUST be available to any depth.
  • MUST enforce progressive immutability: fields set at creation remain immutable; fields set during processing are immutable from assignment.
  • MUST preserve context snapshots: snapshots are immutable from capture and accessible for audit.
  • MUST implement seven signal types with mutually exclusive selection per signal instance.
  • MUST implement seven-state lifecycle with two terminal states; no reversion from terminal states.
  • MUST enforce dismissal authority constraint: dismissal authority MUST NOT be the signal raiser; dismissal rationale is mandatory.
  • MUST enforce critical severity auto-escalation: critical signals escalate one level above default routing target.
  • MUST implement routing timeout: unacknowledged signals auto-escalate one level to prevent silent suppression.
  • MUST implement reservation signal variant: reservation signals are non-blocking, route to flagger's queue unless compliance-related, with surface trigger configuration.
  • MUST support bidirectional signal-IQ traceability: signal↔IQ links are navigable in both directions with spawned_iq_id, origin_type, and source_id fields.

§15 Coverage

This section provides complete coverage of:

  • Signal Capture definition with boundary clarification (object-anchored vs. free-floating).
  • Seven signal types with semantic classifications and primary primitive mappings.
  • Comprehensive flaggable object enumeration: all 19 primitives with tier classification, default routing targets, and typical signal types.
  • Signal schema with 18 fields covering identity, routing, lifecycle, context snapshot, and reservation extensions.
  • Context snapshot schema with six fields capturing object state, labels, preceding actions, constraints, and view context.
  • Default routing rules for all 19 primitive types with escalation paths to root authority.
  • Routing override rules for reservation, critical severity, compliance concerns, and timeout handling.
  • Seven-state lifecycle with entry conditions, exit transitions, and authority requirements.
  • Terminal state semantics: Resolved and Dismissed with required artifacts.
  • Dismissal authority constraints and rationale requirements.
  • Reservation signal lifecycle variant with non-blocking semantics.
  • IQ integration with two spawn directions, resolution mapping, and bidirectional traceability.
  • Cross-mechanism interactions with Truth Type System, Record Lifecycle independence, and Claims Graduation.

Completeness is achieved. All signal capture flows, routing paths, and integration points are fully specified.