Every figure in the book — 132 in all — gathered here in reading order, each with its full caption. A quick way to review the book's visuals in one place; every figure links back to where it appears in the text. The chapter figures come first; the appendix pattern pages follow in a lighter schematic style. (See also the List of Figures and Tables for tables, and a scannable index of short captions.)
Chapter figures
The book-proper figures, hand-drawn to the house palette.
Figure 0.2-1.The book's argument, from the Preface's opening question through the six Parts to the Conclusion's answer and its converse.
Figure 0.3-1. The MAGE method. Scale creates the enduring reasoning problem; commodity intelligence changes its economics. Modeling makes important engineering knowledge explicit, so Alignment can govern richer properties. Governance conversion turns recurring failures and judgment into models and controls that future work can reuse, so engineering effort can accumulate instead of being paid for again.
Figure 0.4-2. The agent stack and a characteristic failure mode. When a task's reasoning horizon exceeds the working state the harness can keep active, repeated reconstruction contributes to churn.
Figure 0.4-3. The governed environment. Governance mechanisms give engineering obligations authority by acting directly on observable work or through explicit models that expose richer semantics. Durable models, mechanisms, procedures, and documentation accumulate as engineering capital.
Figure 0.5-1.From case to theory. MAGE began with one deeply observed production system, then was compared with six independent industrial systems. The originating case shows mechanism and sequence; the industrial cases show variation and alternative ways to realize the same moves.
Figure 1.1-1.Where engineering leverage acts. When engineers write most implementation directly, much of their engineering leverage acts through the code. When agents provide abundant realization capacity, more of that leverage moves into the governed engineering environment—the software analogue of the models, fabrication constraints, process instructions, and acceptance criteria surrounding a 3D printer. The environment represents consequential intent, constrains realization, and evaluates what the fleet produces.
Figure 1.2-1.DocAble from the user's view. An inaccessible document goes in; a remediated document and evidence of the consequential changes come back. Internal structure is omitted because it is not yet relevant.
Figure 1.2-2.One DocAble job—the territory later models describe. A document becomes a job, may be divided into chunks, is processed by workers using specialized services, then reassembled, validated, and returned with evidence. Parts II and III will represent selected pieces of this territory differently depending on the engineering question.
Figure 1.3-1.The agentic substrate. The foundation model supplies inexpensive semantic reasoning under finite, probabilistic working conditions; the harness turns that reasoning into observable, interceptable action. MAGE engineers the environment around the combination.
Figure 1.3-2.The reasoning horizon. At sufficient scale, a task requires more state than a finite reasoner can keep active, so some state must be reconstructed. Representation determines the cost: raw implementation carries irrelevant detail, while purposeful abstraction can keep question-relevant state smaller and cheaper to recover.
Figure 1.4-1.From substrate to method. Finite reasoning state makes representation consequential; probabilistic autonomous work makes external authority consequential. Parts II and III develop MAGE's corresponding answers: Modeling and Alignment.
Figure 2.1-1.Obligations bound a realization space without selecting one realization. Each region contains implementations satisfying one engineering obligation; their intersection contains implementations satisfying both. The points within that intersection may differ substantially in structure and implementation while remaining acceptable under the represented obligations. Those remaining choices are realization degrees of freedom.
Figure 2.1-2.From engineering question to authority. Hold the system fixed and change the question, and the representation changes with it—a closed state or action space, a finite transition system, or temporal behavior. The representation determines which analyses become tractable, not a single prescribed technique; the analysis yields evidence to interpret. Only then does engineering decide what deserves authority, the question Part III takes up.
Figure 2.1-3.MAGE's working model ontology. The six classes distinguish models by the engineering question they answer. Classes may overlap, and each may be encoded using several representation forms.
Figure 2.2-1.Document-mutation structural model. The reduction preserves one architectural relation: ordinary remediation reaches format-specific mutation through a structured-document seam. Enforcement of that relation is a separate Alignment decision.
Figure 2.2-2.Purposeful reduction. The structural model suppresses unrelated runtime and implementation detail while preserving the architectural seam needed to answer where document mutation belongs.
Figure 2.2-3.From computations to composition. The initial projection captured 113 registered computations but only two hand-authored relations. Deriving and typing thirty-three candidate dependencies exposed two distinct semantics: eleven payload-bearing relations — ten data-flow and one cross-service — and twenty-two control gates.
Figure 2.3-1.Recovery-ordering model. The fallback artifact must become durable before database state may refer to it. The load-bearing fact is the absent transition from FALLBACK_STAGED directly to DB_UPDATED.
Figure 2.3-2.Model, representation, implementation. The engineering question determines a reduced temporal model; an explicit transition relation is one executable representation of that model; implementation adds the operational machinery omitted by the reduction.
Figure 2.3-3.Behavioral models expose different classes of properties. A transition relation can support local legality checks, reasoning over reachable states, or temporal claims over executions. The appropriate checker follows from the property; richer machinery is not automatically stronger for every question.
Figure 2.4-1.In-flight ownership model. A current claim records owner, epoch, and lifetime. Merge releases the claim; expiry makes it reclaimable. The model distinguishes a live claim from a stale one without representing the storage machinery that implements the lease.
Figure 2.4-2.Why ownership becomes an interleaving problem. Reclaim and reissue can overlap a stale holder's late release. An epoch fence makes the old holder's release inapplicable to the current claim.
Figure 2.4-3.Model classes overlap. The same lease state supports ownership, behavioral, and measurement questions. The classes distinguish purpose, not storage objects.
Figure 2.5-1.Service-flow model. A declared graph of which service may reach which. The public web tier is the only node facing the outside; an absent edge means the relationship is not permitted by the model, and enforcement is separate.
Figure 2.5-2.Observation and intent answer different questions. The observed system can reveal that A calls C; the decision model can state whether that relationship is permitted. Agreement establishes correspondence, not correctness.
Figure 2.6-1.GenAI cost-and-capacity model. Generation work fans into usage and concurrency; usage and pricing determine cost against a budget, and concurrency contributes to capacity demand against a capacity envelope. The model names the quantities worth relating — the interpretation placed over raw requests and charges, not the telemetry itself.
Figure 2.6-2.Core measurement relation. A current value is interpreted against a separately declared reference bound. The model defines what is compared; it does not determine the consequence of the comparison.
Figure 2.6-3.Modeling and authority are separate decisions. The measurement model defines the quantity and reference bound; Alignment determines whether the result is observed, used to adapt behavior, triggers graceful degradation, or carries gating authority.
Figure 2.7-1.Attribution provenance model. A run contains consequential operations; each operation records its target, mutation, responsible pass, and retained evidence. Audit and explanation can be derived from this shared history.
Figure 2.7-2.Computation structure versus realized history. The computation graph models declared computations and their typed composition; the per-session edit record logs the consequential mutations one run actually produced. They remain separate reductions today. A shared computation identity could join runtime edits to the static model when an engineering question requires that relation, without collapsing the two representations into one.
Figure 2.8-1.Heterogeneous models over shared identities. Structural, behavioral, ownership, decision, measurement, and provenance models remain separate representations while joining through stable identities and explicit correspondence where needed.
Figure 2.8-2.Task-driven traversal. A task enters the substrate through a named system entity and follows only the model relations required by its engineering question.
Figure 2.8-3.Three correspondence patterns. Derive where implementation is the source of truth; generate where the model is the source of truth; otherwise maintain traceability and check the correspondences that are decidable.
Figure 2.8-4.Coverage of model correspondence. Mechanical checks cover only claims the representation makes decidable; semantic claims still require judgment, and unmodeled properties have no model-based coverage.
Figure 2.8-5.Checked predicates over a structured model. A structured model supplies the domain; invariants state properties over that domain; a checker evaluates them at a declared cadence. This is one executable-model pattern, not the definition of executability.
Figure 2.8-6.Modeling expands the semantic reach of Alignment. Alignment mechanisms can act directly on observable actions and artifacts; explicit models make additional system-level properties available for constraint, sensing, evaluation, and admission.
Figure 3.0-1.Five questions organize Alignment. The Part locates where authority can act, determines what obligation is legitimate, decomposes how mechanisms carry authority, shows how experience adds durable obligations and controls, and finally treats the GEE's accumulated controls as an engineering system.
Figure 3.1-1.Intervention boundaries. Guidance shapes reasoning input; authority can bind actions, completed units of work, or accepted artifact/runtime state. Place a mechanism at the earliest boundary where the obligation is legible and the consequence can be affected.
Figure 3.2-1.Three distinct relations. Correspondence tests agreement between representations; conformance tests an artifact against an independent obligation; acceptance asks whether the receiving environment will take the result. Evidence for one relation does not establish the others.
Figure 3.2-2.Correspondence strength and authority direction are independent. DocAble's computation graph moved from sparse, hand-authored relations toward mechanically projected and parity-checked correspondence while remaining downstream of the executable declarations. Generating execution from the graph would change the authority direction; stronger correspondence alone does not.
Figure 3.2-3.The semantic gap. A property that spans several events cannot be decided from any event alone. Move the mechanism to the earliest boundary where the evidence required by the obligation is assembled.
Figure 3.3-1.Constraint or sensor. Prefer a constraint when the unwanted state can be excluded cheaply and reliably. Otherwise instrument the relevant state and produce evidence for later evaluation.
Figure 3.3-2.Match the mechanism to the property. An obligation may be held structurally by excluding the invalid state, evaluated by exploring reachable states, or checked as a temporal property over executions. These are alternatives selected by the engineering claim, not stages on a maturity ladder. A gate is a separate decision that gives the resulting verdict consequence.
Figure 3.3-3.One Measurement, Different Authority Decisions. The same measured quantity may be observed without consequence, used to adapt behavior, trigger graceful degradation, or control admission. The appropriate response follows from the obligation attached to the measurement, not from a maturity sequence.
Figure 3.3-4.Negative and positive constraints. A negative constraint removes a forbidden action; a positive constraint requires a specified action or evidence-producing behavior. Both restrict the admissible implementation space.
Figure 3.4-1.Governance conversion. When a failure exposes a recurring failure mode rooted in missing representation, obligation, evidence, evaluation, or consequence, encode the missing structure at the appropriate layer. Future work inherits the result as engineering capital when that durable structure continues to lower future cost or uncertainty.
Figure 3.4-2.Correct judgment without consequence. The system observed the dangerous condition and evaluated it correctly, but no authoritative mechanism acted on the verdict. The durable repair removed the unsafe capability rather than making the warning louder.
Figure 3.4-3.Where authority stops. A concern may remain unrepresented, require judgment, be evaluated without authoritative consequence, or be governed. These are design choices, not maturity levels; different obligations should stop at different points.
Figure 3.5-1.The conflict is the edge. Two controls may be individually valid yet impose incompatible demands on the same resource. The interaction belongs to the relation among the controls and shared resource, not necessarily to either control's implementation.
Figure 3.5-2.Three views of one control estate. The catalogue identifies controls; the interaction view relates controls through shared resources; the coverage view relates controls to the obligations that justify them. Stable identities connect the three views while letting each answer a different engineering question. A missing mechanism appears as a coverage gap; an untraced mechanism appears as a candidate orphan.
Figure 4.1-1.Precision Follows Knowledge. Explore uncertain needs; represent claims as they stabilize; grant authority only when an obligation is stable and consequential enough to justify it.
Figure 4.2-1.Where a migration starts. Existing system stock determines what can be recovered; settled intent determines how much structure and authority the work can support initially. Authority is not a single project-wide dial — the more settled a particular obligation, the more authority it can safely receive, so a security, legal, or safety constraint may be settled even when the product behavior around it is still exploratory.
Figure 4.2-2.Representation and authority strengthen independently. A representation may become more structured and executable while authority attaches only to selected obligations once the representation is trustworthy enough and enforcement is warranted.
Figure 4.2-3.Recovering a model from brownfield structure. Existing implementation may express the same engineering concept repeatedly without naming it. Weak detectors can surface candidate regularities, but repetition alone does not establish an abstraction: contextual comparison and engineering judgment determine whether the recurring form carries a consequential concept worth making explicit. Once named, the model becomes a reusable reasoning surface for later work.
Figure 4.2-4.Audit, Drain, Promote. A new lint lands audit-only — every finding reported, no commit blocked, so it never breaks an in-flight agent. A fix wave drains it to zero, and only then is it promoted to blocking, so future violations within the mechanism's declared detection surface are refused at that boundary.
Figure 4.2-5.Discovering models during a brownfield migration. Weak signals — primitive density, repeated shapes, the component and boundary view — identify places worth inspecting; they do not dictate the remedy. Partitioning separates legitimate primitive-heavy code and mechanical debt from repeated shapes that reveal missing engineering concepts. Naming those concepts as typed vocabulary and explicit relations changes the substrate on which later migration and enforcement operate.
Figure 4.2-6.Audit → Drain → Promote, generalized. The simple three-beat move is the simplest case. In general the audit's findings are partitioned, draining and redesign identify the obligation that deserves authority, and the final mechanism may be the original detector promoted to blocking or a narrower constraint, validator, or drift guard — while the detector itself remains an audit signal.
Figure 4.2-7.Derive, don't copy. Once a fact has a source of truth, downstream consumers should query, derive, join, or generate from it rather than maintain parallel snapshots. Where neither representation fully determines the other, explicit correspondence checks make disagreement visible.
Figure 4.3-1.A Point and a Space. An example pins one chosen case; a generative test states a property over a domain and searches for a counterexample. Use the broader claim when the obligation itself is broad enough to support it.
Figure 4.3-2.Let the claim choose the search. Input/output properties, reachable-state invariants, and temporal properties require different kinds of falsifying evidence. Structural exclusion is preferable when the invalid behavior can be removed from the admissible space entirely.
Figure 4.3-3.From models to evidence. Coverage becomes meaningful only after the engineering obligations have been named. Explicit models can derive that population; tests, lints, searches, proofs, and human review then supply evidence appropriate to each claim.
Figure 4.3-4.Generate, Judge, Search Again. One loop, whatever the oracle's source: a generator makes inputs, the system runs them, an independent oracle judges each outcome, a counterexample feeds back to shrink or diagnose, and coverage asks whether the search reached the region the claim is about — refining the generator, and where traceability exists joining model-claim coverage back to the claim. The oracle may be a declared property, a robustness contract, a reference implementation, or a structured model; the loop does not care which.
Figure 4.3-5.Two evidence boundaries. Evaluate a property as soon as it can honestly be decided, but for consequential work, a later boundary may re-establish evidence whose freshness matters before admission or exposure. Early evaluation limits wasted work; final evaluation protects against stale evidence and intervening change.
Figure 4.4-1.Binding a Reaction to a Lifecycle Event. A lifecycle transition emits an observable event that fires the reaction deterministically, though its payload still splits three ways — execute a known action, delegate a bounded judgment, or escalate to a human. The firing is mechanical; the procedure it delivers may still hold judgment.
Figure 4.4-2.Externalizing operational judgment. A deterministic step becomes an executable tool; a bounded-judgment step receives prepared context and a decision procedure; an irreducible judgment is surfaced explicitly to a human.
Figure 4.4-3.The Fenced Judgment Step. A run-measure-assess loop wraps a three-step spine: determinize the data space, apply judgment, then determinize the experiment space. Fencing the one judgment step between deterministic ends bounds the messy part and leaves a logged trace a later checker can evaluate.
Figure 4.5-1.The Skill Skeleton. Every shipped skill shares one construction: a fundamental model of the domain, orthogonal facets that cut it along independent concerns, and a governing principle — a SKILL.md of principles — that ties them together and tells the agent when to reach for which. The three shipped skills, self-governance (engineer the environment), self-operate (operate the lifecycles), and self-communicate (govern technical communication), are three instances of this one skeleton.
Figure 4.5-2.Delivering task-relevant context. Engineering knowledge — models, rules, procedures — splits into a small standing context (mission, compact method, the few policies whose salience must survive every task) and a task-relevant slice retrieved when the work calls for it. Both feed the agent's context; a lifecycle event can re-surface what matters now.
Figure 5.0-1.Two views of the evidence. The originating case supplies longitudinal depth: sequence, mechanism, and within-case recurrence. Independent industrial reconstructions supply variation across systems and organizations but less process visibility. Together they motivate the theoretical account developed in Part VI.
Figure 5.2-1.The Seven Build Stages. Retrospective sequence from feasibility probe through serverless migration, showing the pressure and major engineering consequence at each stage.
Figure 5.2-2.Growth of Two Countable Control Artifacts. Project-specific lint files and gate scripts at four repository snapshots. The counts locate investment in environmental checks; they do not measure governance quality.
Figure 5.2-3.The Support Ratio. Support-apparatus source divided by production source at four repository snapshots. The ratio rises from 0.85× after the prototype to roughly 3× in the mature windows.
Figure 5.3-1.What Got Built. One upload crosses six product responsibilities and returns with standards findings, fidelity evidence, and provenance. Probabilistic interpretation is bounded inside the remediation core; deterministic machinery owns the surrounding workflow and the checks it can actually decide.
Figure 5.3-2.Model as a Bounded Subroutine. A deterministic caller supplies a typed task; the model returns a candidate; deterministic checks reject covered failures before incorporation. Properties outside those checks remain outside the guarantee.
Figure 5.3-3.The modeling history. DocAble acquired a stable decomposition of remediation computations before it acquired an explicit model of their composition. As locally reasonable choices accumulated consequential variation, modeling the composition exposed two previously implicit dimensions: dependency semantics and effect boundedness. Typed declarations then made those relationships projectable and mechanically checkable. The progression is from a partial model to a richer one, not from no model to model.
Figure 5.3-4.One Seam, Hardened in Layers. A convenient library call silently corrupted the accessibility structure the product exists to add. That failure motivated a canonical-library policy and a typed mutation seam that concentrated every format change in one place. A build-time ban then refused the raw calls that would bypass the seam. Later the enforcement itself misreported success when a stale repository root hid real findings, forcing a repair to the gate. Each layer answers a specific failure rather than a plan drawn in advance.
Figure 5.3-5.The Delegation Staircase. As explicit representation and environmental authority accumulated, larger units of engineering work could be delegated. Representation moved system knowledge out of one person's head; authority moved repeatable admission out of direct review. Human work moved from reading every diff toward system-level strategy and the residual semantic judgment the environment could not yet decide. A failure in either representation or authority could move work back down the staircase.
Figure 5.4-1.Modeled and Observed, Not Yet Binding. A timeout incident produced a measurement, a provisional per-chunk model, and reportable evidence. Production admission still does not depend on the model: its bound is not calibrated strongly enough to justify blocking. The terminal authority node is left open on purpose — representation and observation can mature before authority is earned. The open node is part of the evidence, not an omission.
Figure 5.5-1.Six Entry Points. MAGE provides the comparison vocabulary; no source is claimed to implement the complete method. The organizations begin with different problems and invest in different parts of the agentic engineered environment. The figure locates emphasis; it does not rank maturity.
Figure 5.5-2.The Modeling Ceiling. Three tiers of modeling: engineering knowledge, executable system models, and checked correspondence. The software-first corpus concentrates on the knowledge tier; Siemens reaches the executable-model tier; the originating case checks selected model–implementation relations, and the public sources do not establish comparable mechanisms. The tiers locate the public source evidence, not organizational capability.
Figure 6.1-1.The MAGE Dynamic Model. Agentic capacity acts through a governed engineering environment to produce realized performance. Mismatch appears as governance pressure; diagnosis and adaptation reshape the environment; a stronger environment then supports more ambitious work and exposes a new frontier. Bootstrap supplies known structure before failure occurs. The model is directional, not fitted.
Figure 6.1-2.The Determinization Frontier. The frontier separates judgment that must be paid per instance from judgment the environment can carry repeatably. The diagram traces the two routes across it. On the direct route, Alignment encodes a property already decidable over the current artifact as a test, validator, constraint, permission, or gate. On the representation route, Modeling first changes the object of reasoning so that a property once requiring semantic reconstruction from implementation becomes decidable, and Alignment can then bind it.
Figure 6.4-1.Changing the object of engineering. Early agentic software-engineering systems primarily improve the machinery through which an agent acts on an inherited software artifact: repository retrieval supplies broader context, agent-computer interfaces expose useful actions, and program-aware search supplies more structured views of code. MAGE incorporates such machinery but moves the engineering boundary outward. The governed engineering environment — its purposeful models, authoritative obligations, evidence, controls, infrastructure, and operating machinery — becomes a first-class object of design through which agents realize the implementation.
Figure 6.4-2.Where Engineering Effort Moves. The lifecycle does not acquire a new set of phases. Implementation shifts disproportionately toward the fleet, while human effort concentrates in intent, abstraction, evidence, tradeoffs, and adaptation. The governed environment carries repeatable structure across all phases. Delegation changes the allocation of work across those phases, not the engineer's accountability for the resulting system or the judgment that acceptance still demands.
Figure 6.5-1.Why software modeled differently. Software was never model-free. Compilation and reproduction were cheap, but producing and revising the detailed implementation required skilled labor, and code itself served as an executable engineering representation. Additional models therefore carried a standing correspondence cost. Commodity intelligence lowers both realization labor and parts of the cost of maintaining secondary representations, expanding the surfaces on which live models can repay their upkeep.
Figure 6.5-2.Established traditions, new composition. MAGE draws on two long-running traditions. Engineering disciplines developed explicit models, constrained representations, verification, and external control; AI repeatedly extended reasoners through knowledge representation, planning state, memory, structured reasoning, tools, and surrounding machinery. MAGE brings these inheritances together around autonomous software work: Modeling makes engineering knowledge explicit, Alignment gives selected obligations authority, and both meet in the Governed Engineering Environment. Governance conversion carries recurring judgment into durable engineering capital. Commodity intelligence changes the economics of this composition, not the provenance of its parts.
Figure 6.5-3.The expanding economics of explicit engineering. Explicit engineering structure has historically paid most readily where assurance demands justified its construction and maintenance. Commodity intelligence may move two economic frontiers. From the high-assurance end, cheaper specification, proof construction, model construction, and derivation may extend strong formal methods into systems that previously could not justify their cost. From the informal end, cheaper representation, reconciliation, realization, and evaluation may make selective Modeling and Alignment worthwhile without requiring complete specification. MAGE principally concerns this second movement. The frontiers may approach or meet for some engineering surfaces, but consequentially underspecified questions remain outside complete machine realization.
Diagrams from the pattern-catalogue appendix, drawn in a lighter reference style.
Figure A-1. Seven reference engineering stacks and their common relationships. Arrows show relationships among capabilities that recurred in one system, not a required architecture or adoption order. Resource Mediation and Context Delivery are shown separately because they provide useful capabilities independently.
Figure A.1-1. The model-coherence composition. An authored MODEL feeds two paths: consumers CONSUME it live rather than copying its facts, and where the model owns the fact it can EMIT downstream artifacts. Consumption flows into a CORRESPONDENCE check — model against world — which DERIVEs its verdict from stable identities where an independent join exists; on disagreement a GATE gives the modeled property authority. Solid path: the load-bearing composition. Dashed attachment: a useful enhancement, not required for the capability.
Figure A.2-1. The assurance composition. A SPEC states the obligation; a CENSUS establishes the population it applies to; discharge fans out to the evidence each obligation deserves — TEST for examples, LINT for structure, PROVE for semantics — and all three lanes converge on COVERAGE, which joins each obligation back to its evidence so omissions show. Solid path: the load-bearing composition.
Figure A.3-1. The auditable-transformation composition. A sanctioned mutation flows through MARK (attach actor and action) to EMIT (persist a structured record); COVER detects any mutation that escaped attribution; READ reconstructs the transformation history from the records; a FIDELITY GATE checks that the transformed artifact kept its required semantics. Solid path: the load-bearing composition.
Figure A.4-1. The observe → react composition. An operating model drives WATCH, which reads runtime state; WATCH flows to RESPOND, which recovers. That solid path is load-bearing. Two dashed attachments strengthen it where the failure class demands: BEAT adds a liveness heartbeat so a hung process reads differently from a slow one, and BLOCK adds the authority to prevent unsafe progress. Solid path: the load-bearing composition. Dashed attachment: a useful enhancement, not required for the capability.
Figure A.5-1. The resource-mediation composition. A RESOURCE POLICY states which resource is scarce and what capacity is acceptable; a MEDIATOR admits at most N actors through one admission point to the SHARED RESOURCE. A dashed LIVE PRESSURE loop tightens or relaxes effective capacity when justified. N=1 and N>1 are settings of the same mediator, not separate stacks. Solid path: the load-bearing composition. Dashed attachment: a useful enhancement, not required for the capability.
Figure A.6-1. The governance-conversion composition, a loop. The CONTROL ESTATE — rules, gates, models, sensors — is inspected and queried to expose GAPS / COUPLING: where control is weak, stale, or entangled. When a failure recurs there, INTERPRET converts the failure class into a durable control, and UPDATE ESTATE folds it in; a solid feedback edge returns to the estate for the next iteration. The four moves form the load-bearing loop.
Figure A.7-1. The context-delivery composition. Engineering knowledge — models, rules, decisions — splits into a STANDING POLICY that is always seen and a TASK SLICE retrieved as needed; both feed the actor's context, which drives the action. A dashed POINT-OF-ACTION attachment reasserts important obligations at the moment of action, and for critical decidable obligations becomes a deterministic gate rather than a reminder. Solid path: the load-bearing composition. Dashed attachment: a useful enhancement, not required for the capability.
Figure A.8-1. Composing an engineering stack. Begin with a capability and its failure classes. Identify the guarantees required to close those failures, select mechanisms that provide them, determine their dependencies, and retain the smallest load-bearing composition that makes the capability claim valid.
Figure B-1.Ten recurring engineering problems and the moves that address them. The moves apply the method developed in Parts II–IV: model knowledge people repeatedly reconstruct, give decidable obligations authority, and make recurring judgment durable when doing so is worth the cost.
Figure B.1-1.One authoritative representation. BEFORE — copies A, B, C each feed a consumer and can drift apart, so disagreement is possible. AFTER — one authoritative representation, with A, B, C derived or queried from it, so disagreement becomes detectable or impossible.
Figure B.2-1.Query, don't snapshot. BAD — the model is copied into a snapshot that a check reads; the model changes, the snapshot does not. GOOD — the check queries the model directly, so the next check sees the change.
Figure B.3-1.Correspondence runs both ways. A two-way loop joins MODEL and REALITY. One arrow asks whether reality still satisfies the model, catching a wrong modeled fact; the other asks whether something important appeared outside the model, catching unmodeled reality.
Figure B.4-1.Required set minus present evidence. The model derives what must be assured; that required set is compared against existing evidence; the intersection is covered, and the remainder is a gap that raises a finding.
Figure B.5-1.Earliest legible, last safe. A timeline runs from where work begins to consequence. Too-early sits where the property is still invisible; the earliest-legible boundary carries the first check; the last-safe boundary carries a re-check just before the point of no return.
Figure B.6-1.Open surface versus closed seam. OPEN — an actor reaches a raw surface by many routes, including unknown ones. CLOSED — the actor passes through one seam that exposes a small set of named verbs, each able to stamp, validate, constrain, and observe. The distinction is encoded by shape, line style, and weight rather than color.
Figure B.7-1.Knowledge delivery at the decision point. Context selection joins the current work with the rules relevant to its scope and supplies that subset to the decision. The distinction is encoded by shape and line style rather than color.
Figure B.8-1.Cause travels with consequence. A cause mints an identity; the identity rides action to change to artifact; from the final artifact the identity lets a reader reconstruct why, not just what.
Figure B.9-1.From system model to operational guidance. Healthy-state predicates, states, and relations feed an operational model that produces generated procedure where possible and reasoning guidance where judgment remains necessary.
Figure B.10-1.Impact as a graph query. A proposed change reaches a substrate node; typed dependency edges identify the controls and models that depend on it, and their union defines the affected set.
Figure C-1.The executable-model pattern. An engineering question selects a representation containing authored, derived, or observed facts. Correspondence machinery compares represented facts with implementation or runtime evidence. Disagreement may remain advisory or, where the obligation has authority, feed a deterministic gate.
Figure C.1-1.Structure and boundaries. Authored ownership and permitted seams are reconciled with the observed repository tree. Sanctioned crossings pass through declared doors; forbidden direct access raises a finding.
Figure C.2-1.Behavior plus ownership. The lifecycle FREE → LEASED → DONE is combined with a lease that records the current owner and expiry. The ownership invariant requires exactly one valid owner while LEASED and no active owner while FREE.
Figure C.4-1.Measurement does not imply authority. A sensor produces an observed measurement, which is compared with a declared bound. The result remains report-only unless the evidence warrants warning or admission authority.
Figure C.5-1.Facts before prose. A structured provenance record supports mechanical validation and re-derivable documentation; independently maintained prose lacks that correspondence.
Figure C.6-1.Composition by reference. Stable identities join the user-journey, service, coverage, test-placement, and execution-policy views. The resulting joined view supports cross-model queries without duplicating those facts into a single stored model.
Figure D.9-1.Brownfield progress. Representation reach and authority reach are independent axes. A system may be strong on either dimension without being strong on the other; the next investment should address the highest-value gap rather than maximize both indiscriminately.
Figure E.2-1. Three orthogonal skills act on one governed engineering environment. Self-governance improves it; self-operate runs it and returns evidence; self-communicate governs the representations both produce.
Figure F.1-1.MAGE across the product lifecycle. Different lifecycle surfaces ask different engineering questions and therefore benefit from different representations. The horizontal flow is not a waterfall: experience and evidence feed earlier activities, while Assurance & Compliance spans the lifecycle. Each surface can adopt MAGE independently.
Figure F.4-1.Change-scoped models, degrees of freedom, and inheritance. A ticket or issue provides an entry point into a change episode. Bidirectional traceability helps locate the responsible implementation and the models and obligations that govern it. Those inherited obligations bound the realization space while leaving some choices open. Acceptance evidence establishes whether the realized change satisfies its obligations; recurring or consequential lessons can then be converted into durable structure that future work inherits.
Figure F.5-1.From incident repair to governance conversion. An incident provides evidence about the realized system. Traceability connects the failure to the models and obligations it realizes; relationships within those models can expose other instances of the same engineering condition even when their implementations differ. Repair can then address the class rather than only the observed instance, while governance conversion preserves the lesson in models or mechanisms that future work inherits.
Figure F.6-1.Assurance across models and realization. Claims may depend on modeled properties, realized properties, or correspondence between the two. Traceability and Alignment connect the required evidence.
Figure F.8-1.From local MAGE adoption to the product GEE. Each lifecycle surface develops representations suited to its own reasoning problems. Shared identity, relations, provenance, temporal scope, and obligations allow those heterogeneous models to compose without collapsing them into one universal model. Agents reason across the resulting knowledge where semantic or situational judgment remains necessary; Alignment carries obligations that can responsibly be made authoritative. Experience from the realized product feeds governance conversion, changing the models and mechanisms future work inherits.
Figure F.9-1.Engineering capital across time and space. A conceptual snapshot of three products shaped by successive engineering episodes. Within each product, useful engineering structure has accumulated selectively; the incomplete constellations represent neither a prescribed product model nor a maturity level. Across products, an assurance obligation connects all three, code-quality mechanisms are shared by two, and connections to a common security posture remain possible. Solid relationships are established; dotted relationships are emerging or possible.
Figure G-2.Spotify projected onto MAGE. Persistent estate representation feeds targeting, concurrent execution, and fleet-level supervision; the reading is judgment moving upstream, not the PR count.
Figure G-3.Shopify projected onto MAGE. The source supports shared externalized knowledge and reusable context; conversion into durable capital is the interpretive step, not an automatic one.
Figure G-4.Docker projected onto MAGE. Strong direct Alignment with deliberately residual human authority; the unhighlighted Modeling and conversion regions mark source-silence, not absence.
Figure G-5.Siemens projected onto MAGE. Strong evidence for rich Modeling; evidence for analysis and verification; no claim from source silence about generalized model↔code admission.
Figure G-6.Zenseact projected onto MAGE. Shared mechanisms centralize while domain knowledge and judgment remain distributed — a concrete organizational answer to scaling both context and authority.
Figure H-1.Weekly Commit Volume. Commits per week across the project history. Bar height measures repository activity, not engineering productivity; interpreting the hardening interval requires classifying the work represented by those commits.
Figure H-2.Product-Path Line Motion. Lines added above the baseline and deleted below it, by path and study window. Mechanization contains the largest observed line motion. The later reduction in deletions is consistent with less structural rewriting but does not establish its cause.
Figure I.2-1.Model induction. The same move runs in three settings: realized work yields repeated low-level forms, weak detection surfaces candidate regularities, and engineering judgment names the concept that survives comparison. The left rail states the move; the three columns instantiate it in software, knowledge work, and CAD. Software is the grounded case; the extension to knowledge work and CAD is a generalization, not evidence DocAble supplied.