Every figure in the book — 146 in all — gathered here in reading order, each with its full caption. A quick way to review the book's visuals in one place; every figure links back to where it appears in the text. The chapter figures come first; the appendix pattern pages follow in a lighter schematic style. (See also the List of Figures and Tables for tables, and a scannable index of short captions.)
Chapter figures
The book-proper figures, hand-drawn to the house palette.
Figure 0.1-1.The book's argument, from the Preface's opening question through the seven Parts to the Conclusion's answer and its converse.
Figure 0.3-1. The MAGE method. Scale creates the enduring reasoning problem; commodity intelligence changes its economics. Modeling makes consequential engineering properties explicit and available to analysis; Alignment makes selected obligations enforceable. Governance conversion turns recurring failures and judgment into models and controls that future work can reuse, so engineering effort can accumulate instead of being paid for again.
Figure 0.4-2. The agent stack and a characteristic failure mode. When a task's reasoning horizon exceeds the working state the harness can keep active, repeated reconstruction contributes to churn.
Figure 0.4-3. The governed environment. Governance mechanisms enforce engineering obligations by acting directly on observable work or through explicit models that expose richer semantics. Durable models, mechanisms, procedures, and documentation accumulate as engineering capital.
Figure 0.5-1.From case to theory. MAGE began with one deeply observed production system, then was compared with eight independent industrial systems. The originating case shows mechanism and sequence; the industrial cases show variation and alternative ways to realize the same moves.
Figure 1.1-1.Where engineering leverage acts. When engineers write most implementation directly, much of their engineering leverage acts through the code. When agents provide abundant realization capacity, more of that leverage moves into the governed engineering environment—the software analogue of the models, fabrication constraints, process instructions, and acceptance criteria surrounding a 3D printer. The environment becomes one means through which engineers retain control while delegating realization: it represents important engineering intent, constrains realization, and evaluates what the fleet produces. MAGE further contends that a governed engineering environment must become the primary means through which engineers exercise control as realization is increasingly delegated.
Figure 1.2-1.DocAble from the user's view. An inaccessible document goes in; a remediated document and evidence of consequential changes come back. Internal structure is omitted because it is not yet relevant.
Figure 1.2-2.Processing one document in DocAble. A user submits a document, creating a job that tracks its processing. The work may be divided into chunks and processed by workers using specialized services for generation, rendering, optical character recognition (OCR), and document-format processing. The resulting changes are reassembled and validated, and the remediated document is returned with evidence.
Figure 1.3-1.Agentic machinery and environment. The foundation model supplies inexpensive semantic reasoning under finite, probabilistic working conditions; the harness turns that reasoning into action, manages its context, and exposes points where the environment can observe or constrain it. These are the properties of the productive substrate the engineered environment must work with.
Figure 1.3-2.The reasoning horizon. At sufficient scale, a task requires more state than a finite reasoner can keep active, so some state must be reconstructed. Representation determines the cost: raw implementation carries irrelevant detail, while purposeful abstraction can keep question-relevant state smaller and cheaper to recover.
Figure 1.4-1.From substrate to method. Finite reasoning state creates the Representation Problem; probabilistic autonomous work creates the Enforcement Problem. Parts II and III develop MAGE's corresponding answers: Modeling and Alignment.
Figure 2.1-1.Obligations bound a realization space without selecting one realization. Each region contains implementations satisfying one engineering obligation; their intersection contains implementations satisfying both. The points within that intersection may differ substantially in structure and implementation while remaining acceptable under the represented obligations. Those remaining choices are realization degrees of freedom.
Figure 2.1-2.From engineering question to engineering consequence. Hold the system fixed and change the question, and the useful representation changes with it. The representation determines which analyses become tractable; analysis produces evidence that can inform architecture and design, expose a property for checking, or both. Part III takes up the separate question of which obligations should be enforced.
Figure 2.1-3.The engineering modeling repertoire. Familiar representations preserve different relationships for different engineering questions. Similar graphical forms can carry different semantics: an arrow may represent a dependency, transition, flow, permission, ownership relation, or derivation.
Figure 2.1-4.MAGE's working model ontology. The six classes distinguish models by the engineering question they answer. Classes may overlap, and each may be encoded using several representation forms. Architecture is not a seventh class; architectural reasoning may traverse several views.
Figure 2.2-1.The structural move: entities and typed relations. Nodes are the entities a question needs; edges are the declared relations between them, and the edge label carries the meaning. Its analyses are graph operations — reachability, path, and cycle checks.
Figure 2.2-2.Document-mutation structural model. The reduction preserves one architectural relation: ordinary remediation reaches format-specific mutation through a structured-document seam. Enforcement of that relation is a separate Alignment decision.
Figure 2.2-3.From computations to composition. Typing the dependencies among registered computations separates payload-bearing relations — data-flow and cross-service — from control gates that a computation consults only to decide whether it runs.
Figure 2.3-1.The behavioral move: states and transitions. A model keeps the legal states and the permitted transitions and discards the code; the transition it omits — here the skip from IDLE straight to DONE — is the behavior it forbids. Its analyses search for a reachable bad state or a required event that never arrives.
Figure 2.3-2.Recovery-ordering model. The fallback artifact must become durable before database state may refer to it. The load-bearing fact is the absent transition from FALLBACK_STAGED directly to DB_UPDATED.
Figure 2.3-3.Behavioral models expose different classes of properties. A transition relation can support local legality checks, reasoning over reachable states, or temporal claims over executions. The appropriate checker follows from the property; richer machinery is not automatically stronger for every question.
Figure 2.4-1.The ownership move: a claim over time. A claim binds a holder to a resource and carries the generation and lifetime that tell a current claim from a superseded one; a second, stale claimant is exactly what the generation exists to reject. Its analyses explore concurrent interleavings for an invariant violation.
Figure 2.4-2.In-flight ownership model. A current claim records owner, epoch, and lifetime. Merge releases the claim; expiry makes it reclaimable. The model distinguishes a live claim from a stale one without representing the storage machinery that implements the lease.
Figure 2.4-3.Model classes overlap. The same lease state supports ownership, behavioral, and measurement questions. The classes distinguish purpose, not storage objects.
Figure 2.5-1.The decision move: the same arrow, a different mood. A structural edge states that a call happens; a decision edge states that it is permitted. The absent edge carries the weight — "not allowed," not "does not happen" — and the analyses check a declared policy for consistency and least privilege.
Figure 2.5-2.Service-flow model. A declared graph of which service may reach which. The public web tier is the only node facing the outside; an absent edge means the relationship is not permitted by the model, and enforcement is separate.
Figure 2.5-3.Observation and intent answer different questions. The observed system can reveal that A calls C; the decision model can state whether that relationship is permitted. Agreement establishes correspondence, not correctness.
Figure 2.6-1.The measurement move: quantities against a bound. Telemetry becomes a model when quantities are related and a value is read against a declared envelope; the analyses aggregate and compare rather than watch a stream call by call.
Figure 2.6-2.Core measurement relation. A current value is interpreted against a separately declared reference bound. The model defines what is compared; it does not determine the consequence of the comparison.
Figure 2.6-3.GenAI cost-and-capacity model. Generation work fans into usage and concurrency; usage and pricing determine cost against a budget, and concurrency contributes to capacity demand against a capacity envelope. The model names the quantities worth relating — the interpretation placed over raw requests and charges, not the telemetry itself.
Figure 2.6-4.Modeling and enforcement are separate decisions. The measurement model defines the quantity and reference bound; Alignment determines whether the result is observed, used to adapt behavior, used to trigger graceful degradation, or enforced by a gate.
Figure 2.7-1.From observability to provenance. Logs, traces, and other runtime observations can expose far more of an execution than an engineering question needs. A provenance model retains the consequential entities, operations, relationships, and evidence needed to reconstruct selected history.
Figure 2.7-2.Attribution provenance model. A run contains consequential operations; each operation records its target, mutation, responsible pass, and retained evidence. Audit and explanation can be derived from this shared history.
Figure 2.7-3.Computation structure versus realized history. The computation graph models declared computations and their typed composition; the per-session edit record logs the consequential mutations one run actually produced. They remain separate reductions today. A shared computation identity could join runtime edits to the static model when an engineering question requires that relation, without collapsing the two representations into one.
Figure 2.8-1.Heterogeneous models over shared identities. Structural, behavioral, ownership, decision, measurement, and provenance models remain separate representations while joining through stable identities and explicit correspondence where needed. Their combination supports architectural reasoning without requiring the architecture to be encoded in one representation.
Figure 2.8-2.Task-driven traversal. A task enters the substrate through a named system entity and follows only the model relations required by its engineering question.
Figure 2.8-3.Three correspondence patterns. Derive where implementation is the source of truth; generate where the model is the source of truth; otherwise maintain traceability and check the correspondences that are decidable.
Figure 2.8-4.Coverage of model correspondence. Mechanical checks cover only claims the representation makes decidable; semantic claims still require judgment, and unmodeled properties have no model-based coverage.
Figure 2.8-5.Checked predicates over a structured model. A structured model supplies the domain; invariants state properties over that domain; a checker evaluates them at a declared cadence. This is one executable-model pattern, not the definition of executability.
Figure 3.0-1.How intent becomes enforceable. Enforcement begins by placing a mechanism at a boundary where the obligation can be evaluated or constrained. Mechanisms enforce selected obligations; experience reveals additional opportunities for governance; accumulated controls eventually require governance of their own.
Figure 3.1-1.Intervention boundaries. Guidance shapes reasoning input; mechanisms can constrain actions or determine whether completed work, artifacts, or runtime states are accepted. Place the mechanism at the earliest boundary where the obligation is legible and enforceable.
Figure 3.2-1.Three distinct relations. Correspondence tests agreement between representations; conformance tests an artifact against an independent obligation; acceptance asks whether the receiving environment will take the result. Evidence for one relation does not establish the others.
Figure 3.2-2.Correspondence strength and governing role are independent. DocAble's execution machinery consumes an explicit computation model to determine remediation composition. A separate analytical graph view projects that structure and is held in correspondence with its upstream declarations. Stronger correspondence makes the view more trustworthy as a representation; it does not make the view govern execution.
Figure 3.2-3.The semantic gap. A property that spans several events cannot be decided from any event alone. Move the mechanism to the earliest boundary where the evidence required by the obligation is assembled.
Figure 3.3-1.Constraint or sensor. Prefer a constraint when the unwanted state can be excluded cheaply and reliably. Otherwise instrument the relevant state and produce evidence for later evaluation.
Figure 3.3-2.Match the mechanism to the property. An obligation may be held structurally by excluding the invalid state, evaluated by exploring reachable states, or checked as a temporal property over executions (for example with TLA+/TLC). These are alternatives selected by the engineering claim, not stages on a maturity ladder. A gate is a separate decision that enforces the resulting verdict.
Figure 3.3-3.One Measurement, Different Enforcement Decisions. The same measured quantity may be observed without enforcement, used to adapt behavior, trigger graceful degradation, or control admission. The appropriate response follows from the obligation attached to the measurement, not from a maturity sequence.
Figure 3.3-4.Negative and positive constraints. A negative constraint removes a forbidden action; a positive constraint requires a specified action or evidence-producing behavior. Both restrict the admissible implementation space.
Figure 3.3-5.Provenance-carried admission. A protected operation must derive through the sanctioned abstraction, which attaches provenance to the resulting operation. The receiving boundary requires that provenance before admitting the operation. The mechanism removes the degree of freedom to obtain the operation through some other implementation path, without requiring the environment to enumerate those alternative paths.
Figure 3.4-1.Governance conversion. When a failure exposes a recurring failure mode rooted in missing representation, obligation, evidence, evaluation, or enforcement, encode the missing structure at the appropriate layer. Future work inherits the result as engineering capital when that durable structure continues to lower future cost or uncertainty.
Figure 3.4-2.Correct judgment without enforcement. The system observed the dangerous condition and evaluated it correctly, but no enforcing mechanism acted on the verdict. The durable repair removed the unsafe capability rather than making the warning louder.
Figure 3.4-3.Where enforcement stops. A concern may remain unrepresented, require judgment, be evaluated without enforcement, or be governed. These are design choices, not maturity levels; different obligations should stop at different points.
Figure 3.5-1.The conflict is the edge. Two controls may be individually valid yet impose incompatible demands on the same resource. The interaction belongs to the relation among the controls and shared resource, not necessarily to either control's implementation.
Figure 3.5-2.Three views of the control machinery. The catalogue identifies controls; the interaction view relates controls through shared resources; the coverage view relates controls to the obligations that justify them. Stable identities connect the three views while letting each answer a different engineering question. A missing mechanism appears as a coverage gap; an untraced mechanism appears as a candidate orphan.
Figure 3.5.1-1.Two execution units for document remediation. (a) Whole-document execution keeps the artifact's working state and media resident in one long-running worker. (b) Page-chunked execution divides the document across workers, reducing the working state and memory required by any one worker.
Figure 3.5.1-2.Chunked residency versus skeletonized residency. (a) Page chunking limits how much document state and associated media a worker holds at once, but media remains part of the worker's resident representation. (b) Skeletonization keeps only document structure and media references resident. Individual media objects stream from external storage to the consumer on demand, so total media size no longer determines persistent worker memory.
Figure 3.5.1-3.Two execution policies over the same remediation graph. The graph contains actions—page analysis, construction of document context, and GenAI queries—and information dependencies among them. (a) Page-oriented execution groups actions according to where their artifacts occur, so a page partition can span several dependency levels. (b) Frontier execution groups actions according to when they are ready: page analyses execute first, their results enable construction of document context, and that context enables independent GenAI queries for alt text. The work and its dependencies are unchanged; only the execution boundary changes.
Figure 3.5.1-4.Analysis before implementation. (a) In a weighted dependency graph the heaviest chain is the critical path, which sets the latency floor and names an optimization target. (b) Decomposing the dominant node exposes parallel children and can shorten the path, a possibility visible in the model before the split is built. (c) A serial information dependency can be removed by changing the representation supplied to each operation: instead of sibling-to-sibling context propagation, each image consumes one shared precomputed page context, so the alt-text operations run independently.
Figure 3.5.1-5.The GenAI dependency chain and its latency floor. A section summary feeds a document summary feeds alt text; because each level waits for the one before it, their per-call times add to an irreducible floor of 7.6589 s. The vision value is measured; the text-summary value is estimated.
Figure 3.5.1-6.Using prediction error as evidence. (a) The gap between a model's prediction and the observed measurement is a residual, pointing to a wrong parameter, a wrong relation, or a missing mechanism; the numbers are illustrative. (b) Prediction and measurement create a feedback loop: explain the residual, refine the model, and test the revised model against subsequent observations.
Figure 3.5.1-7.Modeling as a loop. (a) Not the linear design → implement → document-with-models. (b) A problem drives a model; analysis yields a prediction and a design; those drive implementation and measurement; measurement refines the model, and the loop continues while the questions justify the cost.
Figure 4.1-1.Precision Follows Knowledge. Explore uncertain needs; represent claims as they stabilize; enforce an obligation only when it is stable and consequential enough to justify it.
Figure 4.1-2.Engineering recurring work. A governed engineering environment combines support for probabilistic reasoning with enforcement of selected obligations; the same models, knowledge, procedures, skills, tools, and evidence may contribute to both. The dashed arrow marks a recurring MAGE move: as judgment becomes better understood, some obligations may become sufficiently clear and evaluable to enforce. The return path observes outcomes and failures and improves the environment; where recurring judgment can be encoded economically, this is the governance conversion developed in Section 3.4.
Figure 4.2-1.Where a migration starts. Existing system stock determines what can be recovered; settled intent determines how much structure and enforcement the work can support initially. Enforcement is not a single project-wide dial — the more settled a particular obligation, the more enforcement it can safely receive, so a security, legal, or safety constraint may be settled even when the product behavior around it is still exploratory.
Figure 4.2-2.Representation and enforcement strengthen independently. A representation may become structured or executable without becoming a gate; selected obligations are enforced only when the consequence warrants it.
Figure 4.2-3.Discovering models during a brownfield migration. Weak signals — primitive density, repeated shapes, the component and boundary view — identify places worth inspecting; they do not dictate the remedy. Partitioning separates legitimate primitive-heavy code and mechanical debt from repeated shapes that reveal missing engineering concepts. Naming those concepts as typed vocabulary and explicit relations changes the substrate on which later migration and enforcement operate.
Figure 4.2-4.Audit, Drain, Promote. A new lint lands audit-only — every finding reported, no commit blocked, so it never breaks an in-flight agent. A fix wave drains it to zero, and only then is it promoted to blocking, so future violations within the mechanism's declared detection surface are refused at that boundary.
Figure 4.2-5.Derive, don't copy. Once a fact has a source of truth, downstream consumers should query, derive, join, or generate from it rather than maintain parallel snapshots. Where neither representation fully determines the other, explicit correspondence checks make disagreement visible.
Figure 4.3-1.A Point and a Space. An example pins one chosen case; a generative test states a property over a domain and searches for a counterexample. Use the broader claim when the obligation itself is broad enough to support it.
Figure 4.3-2.Let the claim choose the search. Input/output properties, reachable-state invariants, and temporal properties require different kinds of falsifying evidence. Structural exclusion is preferable when the invalid behavior can be removed from the admissible space entirely.
Figure 4.3-3.From models to evidence. Coverage becomes meaningful only after the engineering obligations have been named. Explicit models can derive that population; tests, lints, searches, proofs, and human review then supply evidence appropriate to each claim.
Figure 4.3-4.Generate, Judge, Search Again. One loop, whatever the oracle's source: a generator makes inputs, the system runs them, an independent oracle judges each outcome, a counterexample feeds back to shrink or diagnose, and coverage asks whether the search reached the region the claim is about — refining the generator, and where traceability exists joining model-claim coverage back to the claim. The oracle may be a declared property, a robustness contract, a reference implementation, or a structured model; the loop does not care which.
Figure 4.3-5.Two evidence boundaries. Evaluate a property as soon as it can honestly be decided, but for consequential work, a later boundary may re-establish evidence whose freshness matters before admission or exposure. Early evaluation limits wasted work; final evaluation protects against stale evidence and intervening change.
Figure 4.4-1.Binding a Reaction to a Lifecycle Event. A lifecycle transition emits an observable event that fires the reaction deterministically, though its payload still splits three ways — execute a known action, delegate a bounded judgment, or escalate to a human. The firing is mechanical; the procedure it delivers may still hold judgment.
Figure 4.4-2.Externalizing operational judgment. Each runbook step is typed Execute, Delegate, or Escalate: an Execute step becomes an executable tool; a Delegate step receives prepared context and a decision procedure; an Escalate step is surfaced explicitly to a human.
Figure 4.4-3.Surrounding a judgment step with deterministic work. A run-measure-assess loop wraps a three-step spine: determinize the data space, apply judgment, then determinize the experiment space. Bounding the one judgment step between deterministic ends leaves a logged trace a later checker can evaluate.
Figure 4.5-1.What a reusable skill needs. A domain model, the recurring concerns that matter within it, and a decision procedure that ties them together compose into a reusable skill a fresh agent can enter repeatedly.
Figure 4.5-2.Delivering task-relevant context. Engineering knowledge — models, rules, procedures — splits into a small standing context (mission, compact method, the few policies whose salience must survive every task) and a task-relevant slice retrieved when the work calls for it. Both feed the agent's context; a lifecycle event can re-surface what matters now.
Figure 4.5-3.MAGE as agent knowledge. Domain expertise supplies the obligations, evidence, and judgments that matter; the self-governance skill supplies a procedure for reasoning about them; and coding intelligence realizes the resulting models, guidance, and controls in the available environment. Consequential controls remain subject to the same correspondence and evidence requirements as other agent-generated artifacts.
Figure 5.0-1.Two views of the evidence. The originating case supplies longitudinal depth: sequence, mechanism, and within-case recurrence. Independent industrial reconstructions supply variation across systems and organizations but less process visibility. Together they motivate the theoretical account developed in Part VI.
Figure 5.2-1.The Seven Build Stages. Retrospective sequence from feasibility probe through serverless migration, showing the pressure and major engineering consequence at each stage.
Figure 5.2-2.Growth of Two Countable Control Artifacts. Project-specific lint files and gate scripts at four repository snapshots. The counts locate investment in environmental checks; they do not measure governance quality.
Figure 5.2-3.The Support Ratio. Support-apparatus source divided by production source at four repository snapshots. The ratio rises from 0.85× after the prototype to roughly 3× in the mature windows.
Figure 5.3-1.What Got Built. One upload crosses six product responsibilities and returns with standards findings, fidelity evidence, and provenance. Probabilistic interpretation is bounded inside the remediation core; deterministic machinery owns the surrounding workflow and the checks it can actually decide.
Figure 5.3-2.Model as a Bounded Subroutine. A deterministic caller supplies a typed task; the model returns a candidate; deterministic checks reject covered failures before incorporation. Properties outside those checks remain outside the guarantee.
Figure 5.3-3.The modeling history. DocAble acquired a stable decomposition of remediation computations before it acquired an explicit model of their composition. As locally reasonable choices accumulated consequential global cost, modeling exposed dependency semantics and effect boundedness. Typed declarations made those relationships analyzable and checkable; later redesign made explicit composition authoritative for execution, while separate analytical views continued to grow around stable computation identities. The progression is from a partial model to a richer and increasingly consequential one, not from no model to model.
Figure 5.3-4.One Seam, Hardened in Layers. A convenient library call silently corrupted the accessibility structure the product exists to add. That failure motivated a canonical-library policy and a typed mutation seam that concentrated every format change in one place. A build-time ban then refused the raw calls that would bypass the seam. Later the enforcement itself misreported success when a stale repository root hid real findings, forcing a repair to the gate. Each layer answers a specific failure rather than a plan drawn in advance.
Figure 5.3-5.The Delegation Staircase. As explicit representation and environmental enforcement accumulated, larger units of engineering work could be delegated. Representation moved system knowledge out of one person's head; enforcement moved repeatable admission decisions out of direct review. Human work moved from reading every diff toward system-level strategy and the residual semantic judgment the environment could not yet decide. A failure in either representation or enforcement could move work back down the staircase.
Figure 5.4-1.Modeled and Observed, Not Yet Binding. A timeout incident produced a measurement, a provisional per-chunk model, and reportable evidence. Production admission still does not depend on the model: its bound is not calibrated strongly enough to justify blocking. The terminal enforcement node is left open on purpose — representation and observation can mature before enforcement is earned. The open node is part of the evidence, not an omission.
Figure 5.5-1.Eight Entry Points. MAGE provides the comparison vocabulary; no source is claimed to implement the complete method. The organizations begin with different problems and invest in different parts of the agentic engineered environment. The figure locates emphasis; it does not rank maturity.
Figure 5.5-2.The Modeling Ceiling. Three tiers of modeling: engineering knowledge, executable system models, and checked correspondence. The software-first corpus concentrates on the knowledge tier; Siemens reaches the executable-model tier; the originating case checks selected model–implementation relations, and the public sources do not establish comparable mechanisms. The tiers locate the public source evidence, not organizational capability.
Figure 6.1-1.The MAGE Dynamic Model. Agentic capacity acts through a governed engineering environment to produce realized performance. Mismatch appears as churn, escaped defects, and repeated intervention; diagnosis and adaptation reshape the environment; a stronger environment then supports more ambitious work and exposes a new frontier. Prior engineering knowledge supplies known structure before failure occurs. The model is directional, not fitted.
Figure 6.1-2.The Determinization Frontier. The frontier separates judgment that must be supplied per instance from judgment the environment can carry repeatably. Alignment can directly bind a property already decidable over an action or artifact. Modeling can change the reasoning surface so that a property requiring semantic reconstruction becomes a repeatable predicate that Alignment can bind. Modeling may also reduce realization cost even where Alignment was already possible.
Figure 6.3-1.The economics of explicit engineering. The value of making an obligation explicit determines how much investment it warrants; feasible governability determines how much of that investment can become enforcement. High-value obligations can justify substantial engineering even when they remain judgmental, while highly governable obligations need not be mechanized when little value would result.
Figure 7.1-1.Where Engineering Effort Moves. The lifecycle does not acquire a new set of phases. Implementation shifts disproportionately toward the fleet, while human effort concentrates in intent, abstraction, evidence, tradeoffs, and adaptation. The governed environment carries repeatable structure across all phases. Delegation changes the allocation of work across those phases, not the engineer's accountability for the resulting system or the judgment that acceptance still demands.
Figure 7.2-1.Why software modeled differently. Software was never model-free. Compilation and reproduction were cheap, but producing and revising the detailed implementation required skilled labor, and code itself served as an executable engineering representation. Additional models therefore carried a standing correspondence cost. Commodity intelligence lowers both realization labor and parts of the cost of maintaining secondary representations, expanding the surfaces on which live models can repay their upkeep.
Figure 7.2-2.Established traditions, new composition. MAGE draws on two long-running traditions. Engineering disciplines developed explicit models, constrained representations, verification, and external control; AI repeatedly extended reasoners through knowledge representation, planning state, memory, structured reasoning, tools, and surrounding machinery. MAGE brings these inheritances together around autonomous software work: Modeling makes engineering knowledge explicit, Alignment enforces selected obligations independently, and both meet in the Governed Engineering Environment. Governance conversion carries recurring judgment into durable engineering capital. Commodity intelligence changes the economics of this composition, not the provenance of its parts.
Diagrams from the pattern-catalogue appendix, drawn in a lighter reference style.
Figure A-1. Seven reference engineering stacks and their common relationships. Arrows show relationships among capabilities that recurred in one system, not a required architecture or adoption order. Resource Mediation and Context Delivery are shown separately because they provide useful capabilities independently.
Figure A.1-1. The model-coherence composition. An authored MODEL feeds two paths: consumers CONSUME it live rather than copying its facts, and where the model owns the fact it can EMIT downstream artifacts. Consumption flows into a CORRESPONDENCE check — model against world — which DERIVEs its verdict from stable identities where an independent join exists; on disagreement a GATE enforces the modeled property. Solid path: the required composition. Dashed attachment: a useful enhancement, not required for the capability.
Figure A.2-1. The assurance composition. A SPEC states the obligation; a CENSUS establishes the population it applies to; discharge fans out to the evidence each obligation deserves — TEST for examples, LINT for structure, PROVE for semantics — and all three lanes converge on COVERAGE, which joins each obligation back to its evidence so omissions show. Solid path: the required spine.
Figure A.3-1. The auditable-transformation composition. A sanctioned mutation flows through MARK (attach actor and action) to EMIT (persist a structured record); COVER detects any mutation that escaped attribution; READ reconstructs the transformation history from the records; a FIDELITY GATE checks that the transformed artifact kept its required semantics. Solid path: the core path, every step required.
Figure A.4-1. The observe → react composition. An operating model drives WATCH, which reads runtime state; WATCH flows to RESPOND, which recovers. That solid path is required. Two dashed attachments strengthen it where the failure class demands: BEAT adds a liveness heartbeat so a hung process reads differently from a slow one, and BLOCK adds the power to prevent unsafe progress. Solid path: the core path; dashed: enhancement. Dashed attachment: a useful enhancement, not required for the capability.
Figure A.5-1. The resource-mediation composition. A RESOURCE POLICY states which resource is scarce and what capacity is acceptable; a MEDIATOR admits at most N actors through one admission point to the SHARED RESOURCE. A dashed LIVE PRESSURE loop tightens or relaxes effective capacity when justified. N=1 and N>1 are settings of the same mediator, not separate stacks. Solid path: the required path. Dashed attachment: a useful enhancement, not required for the capability.
Figure A.6-1. The governance-conversion composition, a loop. The CONTROL MACHINERY — rules, gates, models, sensors — is inspected and queried to expose GAPS / COUPLING: where control is weak, stale, or entangled. When a failure recurs there, INTERPRET converts the failure class into a durable control, and UPDATE MACHINERY folds it in; a solid feedback edge returns to the machinery for the next iteration. The four moves form the core loop.
Figure A.7-1. The context-delivery composition. Engineering knowledge — models, rules, decisions — splits into a STANDING POLICY that is always seen and a TASK SLICE retrieved as needed; both feed the actor's context, which drives the action. A dashed POINT-OF-ACTION attachment reasserts important obligations at the moment of action, and for critical decidable obligations becomes a deterministic gate rather than a reminder. Solid path: the essential composition. Dashed attachment: a useful enhancement, not required for the capability.
Figure A.8-1. Composing an engineering stack. Begin with a capability and its failure classes. Identify the guarantees required to close those failures, select mechanisms that provide them, determine their dependencies, and retain the smallest required composition that makes the capability claim valid.
Figure B-1.Ten recurring engineering problems and the moves that address them. The moves apply the method developed in Parts II–IV: model knowledge people repeatedly reconstruct, enforce decidable obligations, and make recurring judgment durable when doing so is worth the cost.
Figure B.1-1.One authoritative representation. BEFORE — copies A, B, C each feed a consumer and can drift apart, so disagreement is possible. AFTER — one authoritative representation, with A, B, C derived or queried from it, so disagreement becomes detectable or impossible.
Figure B.2-1.Query, don't snapshot. BAD — the model is copied into a snapshot that a check reads; the model changes, the snapshot does not. GOOD — the check queries the model directly, so the next check sees the change.
Figure B.3-1.Correspondence runs both ways. A two-way loop joins MODEL and REALITY. One arrow asks whether reality still satisfies the model, catching a wrong modeled fact; the other asks whether something important appeared outside the model, catching unmodeled reality.
Figure B.4-1.Required set minus present evidence. The model derives what must be assured; that required set is compared against existing evidence; the intersection is covered, and the remainder is a gap that raises a finding.
Figure B.5-1.Earliest legible, last safe. A timeline runs from where work begins to consequence. Too-early sits where the property is still invisible; the earliest-legible boundary carries the first check; the last-safe boundary carries a re-check just before the point of no return.
Figure B.6-1.Open surface versus closed seam. OPEN — an actor reaches a raw surface by many routes, including unknown ones. CLOSED — the actor passes through one seam that exposes a small set of named verbs, each able to stamp, validate, constrain, and observe. The distinction is encoded by shape, line style, and weight rather than color.
Figure B.7-1.Knowledge delivery at the decision point. Context selection joins the current work with the rules relevant to its scope and supplies that subset to the decision. The distinction is encoded by shape and line style rather than color.
Figure B.8-1.Cause travels with consequence. A cause mints an identity; the identity rides action to change to artifact; from the final artifact the identity lets a reader reconstruct why, not just what.
Figure B.9-1.From system model to operational guidance. Healthy-state predicates, states, and relations feed an operational model that produces generated procedure where possible and reasoning guidance where judgment remains necessary.
Figure B.10-1.Impact as a graph query. A proposed change reaches a substrate node; typed dependency edges identify the controls and models that depend on it, and their union defines the affected set.
Figure C-1.The executable-model pattern. An engineering question selects a representation containing authored, derived, or observed facts. Correspondence machinery compares represented facts with implementation or runtime evidence. Disagreement may remain advisory or, where the obligation is enforced, feed a deterministic gate.
Figure C.1-1.Structure and boundaries. Authored ownership and permitted seams are reconciled with the observed repository tree. Sanctioned crossings pass through declared doors; forbidden direct access raises a finding.
Figure C.2-1.Behavior plus ownership. The lifecycle FREE → LEASED → DONE is combined with a lease that records the current owner and expiry. The ownership invariant requires exactly one valid owner while LEASED and no active owner while FREE.
Figure C.4-1.Measurement does not imply enforcement. A sensor produces an observed measurement, which is compared with a declared bound. The result remains report-only unless the evidence warrants a warning or an admission gate.
Figure C.5-1.Facts before prose. A structured provenance record supports mechanical validation and re-derivable documentation; independently maintained prose lacks that correspondence.
Figure C.6-1.Composition by reference. Stable identities join the user-journey, service, coverage, test-placement, and execution-policy views. The resulting joined view supports cross-model queries without duplicating those facts into a single stored model.
Figure D.9-1.Brownfield progress. Representation reach and enforcement reach are independent axes. A system may be strong on either dimension without being strong on the other; the next investment should address the highest-value gap rather than maximize both indiscriminately.
Figure E.2-1.Three complementary skills act around one governed engineering environment. Self-Governance improves the environment; Self-Operate runs operational lifecycles within it and returns evidence about deficiencies; Self-Communicate articulates the system to others and contributes canonical documentation to the environment.
Figure F.1-1.MAGE across the product lifecycle. Different lifecycle surfaces ask different engineering questions and therefore benefit from different representations. The horizontal flow is not a waterfall: experience and evidence feed earlier activities, while Assurance & Compliance spans the lifecycle. Each surface can adopt MAGE independently.
Figure F.4-1.Change-scoped models, degrees of freedom, and inheritance. A ticket or issue provides an entry point into a change episode. Bidirectional traceability helps locate the responsible implementation and the models and obligations that govern it. Those inherited obligations bound the realization space while leaving some choices open. Acceptance evidence establishes whether the realized change satisfies its obligations; recurring or consequential lessons can then be converted into durable structure that future work inherits.
Figure F.5-1.From incident repair to governance conversion. An incident provides evidence about the realized system. Traceability connects the failure to the models and obligations it realizes; relationships within those models can expose other instances of the same engineering condition even when their implementations differ. Repair can then address the class rather than only the observed instance, while governance conversion preserves the lesson in models or mechanisms that future work inherits.
Figure F.6-1.Assurance across models and realization. Claims may depend on modeled properties, realized properties, or correspondence between the two. Traceability and Alignment connect the required evidence.
Figure F.8-1.From local MAGE adoption to the product GEE. Each lifecycle surface develops representations suited to its own reasoning problems. Shared identity, relations, provenance, temporal scope, and obligations allow those heterogeneous models to compose without collapsing them into one universal model. Agents reason across the resulting knowledge where semantic or situational judgment remains necessary; Alignment carries the obligations that can responsibly be enforced. Experience from the realized product feeds governance conversion, changing the models and mechanisms future work inherits.
Figure F.9-1.Engineering capital across time and space. A conceptual snapshot of three products shaped by successive engineering episodes. Within each product, useful engineering structure has accumulated selectively; the incomplete constellations represent neither a prescribed product model nor a maturity level. Across products, an assurance obligation connects all three, code-quality mechanisms are shared by two, and connections to a common security posture remain possible. Solid relationships are established; dotted relationships are emerging or possible.
Figure G.1-1.From assistance to bounded delegation. Under assistance, the worker supplies context, judgment, and acceptance directly around the agent. As work is delegated, selected responsibilities move into the environment — models carry context, evidence establishes properties, and mechanisms constrain and admit the result — and the boundary of what the agent may do on its own expands. The change is a shifting boundary, not a sequence of maturity levels.
Figure G.2-1.From recurring cost to engineering capital. Context and guidance can cheaply reduce reconstruction and improve probabilistic judgment. Where residual churn or consequence warrants further investment, organizations can strengthen representation, evidence, evaluation, or enforcement so that later work inherits more of what earlier work established. The paths are investment choices, not maturity levels.
Figure G.2-2.Four figures this appendix puts to work. Each was developed earlier in the book and is reused here at organizational scale, not reintroduced: the value of explicit engineering against feasible governability (Section 6.3), the governance-conversion loop (Section 3.4), the support-apparatus ratio, and the redistribution of engineering effort (both in Part V). The appendix refers back to these rather than re-deriving them.
Figure H-2.Spotify projected onto MAGE. Persistent estate representation feeds targeting, concurrent execution, and fleet-level supervision; the reading is judgment moving upstream, not the PR count.
Figure H-3.Shopify projected onto MAGE. The source supports shared externalized knowledge and reusable context; conversion into durable capital is the interpretive step, not an automatic one.
Figure H-4.Docker projected onto MAGE. Strong direct Alignment with deliberately residual human authority; the unhighlighted Modeling and conversion regions mark source-silence, not absence.
Figure H-5.Siemens projected onto MAGE. Strong evidence for rich Modeling; evidence for analysis and verification; no claim from source silence about generalized model↔code admission.
Figure H-6.Zenseact projected onto MAGE. Shared mechanisms centralize while domain knowledge and judgment remain distributed — a concrete organizational answer to scaling both context and enforcement.
Figure H-7.Uber projected onto MAGE. Public evidence strongly supports engineering the environment around a replaceable reasoner; the executable-model tier stays out of reach.
Figure I-1.Weekly Commit Volume. Commits per week across the project history. Bar height measures repository activity, not engineering productivity; interpreting the hardening interval requires classifying the work represented by those commits.
Figure I-2.Product-Path Line Motion. Lines added above the baseline and deleted below it, by path and study window. Mechanization contains the largest observed line motion. The later reduction in deletions is consistent with less structural rewriting but does not establish its cause.
Figure J.2-1.Model induction. The same move runs in three settings: realized work yields repeated low-level forms, weak detection surfaces candidate regularities, and engineering judgment names the concept that survives comparison. The left rail states the move; the three columns instantiate it in software, knowledge work, and CAD. Software is the grounded case; the extension to knowledge work and CAD is a generalization, not evidence DocAble supplied.