The Web-First Amendment

Genre: program amendment — a ratified owner direction that revises the program's topology and sequencing. Not a spec and not a plan: it records what changed and why, defers the unchanged model to the sibling docs, and leaves implementation shape to the PR that carries it.

Status: Ratified by the owner, 2026-07-21. Owner: universe@grida.co. Position tracked on the program umbrella gridaco/nothing#43.

What it touches. It supersedes the "one model" reading of goal.md and the phase ordering of the charter where the two conflict. It does not touch the standing rules (see What it does not supersede).

The revised topology

The end state was stated as one engine, one model, many hosts. It becomes:

One engine kernel, source-native semantic models, one provisional resolved render contract, many hosts.

The single word that changes is model. There is not one universal document model that HTML, SVG, and n0 all reduce to. Each source keeps the semantic model its grammar demands; they converge downstream, at a shared render contract, not upstream at a shared authored model.

• One engine kernel — the shared downstream: bounds, culling, damage, drawlist construction, raster caches, batching, export. Convergence begins only where the inputs genuinely match.
• Source-native semantic models — HTML/CSS, SVG, and n0 each retain their own semantic model, cascade/resolution, and editing semantics. n0 is not promoted to the universal HTML/SVG model.
• One provisional resolved render contract — a single source-neutral description of derived frame data (see The shared boundary), shaped by real producers, internal and breakable.
• Many hosts — unchanged.

The Web semantic family leads

HTML/CSS and SVG are prioritized now, ahead of the charter's original phase order, and are treated as one Web semantic family:

• HTML and inline SVG are one namespace-aware document sharing one browser-grade cascade (inheritance, resources, and layout integration included). Descendant style inside inline SVG comes from the surrounding document cascade.
• Standalone SVG is a different grammar entry into the same SVG/Web machinery — the same semantic compiler, the same cascade behavior — not a separate renderer.

Four constructions are ruled out because each fractures that family:

• No serialize-and-reparse. Inline SVG must not be flattened to a string and re-parsed through a nested renderer; it already lives in the one document.
• No temporary SVG-only matcher as the final cascade. A bespoke SVG-only property matcher may exist as scaffolding; it must not become the cascade of record. The cascade of record is the shared browser-grade (Stylo) cascade.
• No universal n0 model. n0 must not become the model HTML/SVG are expressed in.
• No three renderers behind one trait. The goal is one shared downstream, not three complete renderers hidden behind a Render abstraction.

The shared boundary

The provisional common product is derived frame data — never an authored source of truth, never a file format, never a round-trip promise. It carries only normalized visual facts:

• stable source-neutral identity and provenance;
• geometry and resolved bounds;
• transforms, clips, masks, effects, isolation, and painter order;
• ordered paint stacks;
• shaped-text artifacts;
• resource references and exact environment revisions.

It must not carry: HTML tags, selectors, or CSS syntax; SVG element or attribute syntax; n0 bindings or operations; raw embedded XML; parser ASTs; filesystem or network policy; backend objects, opaque callbacks, Any, or nested pictures; serialization or round-trip guarantees.

Invalidation stays source-specific. Each source owns how its inputs change; sharing begins only where the inputs genuinely match — bounds, culling, damage, drawlist construction, raster caches, batching, export.

The chassis invariants hold, even though n0 is not the current product target — because they are what makes the boundary a contract rather than a dump: explicit time; stable identity; immutable frame products; declared font/image/resource environments; damage as data; no I/O or ambient clock in the core.

The contract yields, not the fields. It is internal and breakable by design. If honoring it would force a Web-specific field into the shared representation, the sharing boundary moves downward (toward the drawlist) rather than the contract admitting the field.

Forbidden in the new path

New edges this amendment draws, beyond the standing non-goals it inherits (goal.md already forbids native .grida/schema support; the frozen surfaces and patrol-before-drop rules still bind):

• No render through legacy import adapters. Web HTML/SVG must not be routed through the legacy SVG-import-to-document converter; that path collapses Web semantics into the design-tool model and loses the shared cascade.
• No legacy node model in the new path. The legacy geometry-first node model / scene graph does not appear downstream of the Web sources.
• No backend escape hatch around the kernel. The render product is the resolved contract, not an opaque backend picture handed past the shared kernel; nested backend pictures are not a substitute for expressing isolation and effects as data.
• Adopt by contract, not by copy. Legacy know-how (SVG element→paint semantics, the painter's no-escape-hatch discipline) is patrolled and re-derived against the contract, with a captured-essence ledger — never copied wholesale.

Deferred by evidence, not by prose

This amendment originally left three questions to later evidence:

Subsequent status (2026-07-23): the coupled D-C/D-M vector stage is now taken: glyphless facts join high into the shared downstream: one engine-private compiler, private drawlist, painter, damage policy, and cache policy. cg is the shared leaf-vocabulary seat; adoption remains per-leaf. The generic frontend trait and the D-M shaped-text stage remain deferred. The charter registry is the current decision record.

• D-M: n0's join point — the vector stage now selects the common resolved contract and shared downstream; the shaped-text stage remains open. A deliberately tiny n0 canary exercises the shared downstream to keep it source-neutral; that canary is an invariant probe, not an n0 product milestone, and n0 XML capability work stays parked (kept building and tested, not expanded). A gap analysis against n0's real downstream facts — the n0-join-point finding — reframes this as a staged, per-fact boundary. The vector-input equivalence and mixed-composition spike established the high join for glyphless visual primitives and proved that the shaped-text stage can remain open. D-M is coupled to D-C's paint/stroke gap report and was not inferred from the canary.
• A generic frontend trait — none is published or stabilized yet. Concrete data must be shaped by at least two real producers first.
• D-C: the leaf-vocabulary seat — cg is selected for glyphless vector paint/stroke facts; adoption remains per-leaf under the recorded conformance and deletion gates.

The charter's decision registry records the taken D-C/D-M vector dispositions and the open D-M shaped-text stage. The generic frontend trait remains deferred here under the two-producer rule.

A fourth, concrete decision the first prototype surfaced with evidence is now taken: D-L, how SVG paint enters the shared cascade. The answer is Servo-capable support maintained in official upstream Stylo: prefer the first published release containing servo/stylo#383; because 0.19.0 predates that merge, use the tested immutable official-upstream revision until such a release exists. A floating branch and private source fork are excluded. The SVG-paint-cascade finding records the evidence and boundary: D-L settles provenance only, not production SVG/XML or stylesheet ingress, consumption of the computed values, the 24 SVG-struct longhands still Gecko-only at the pin, or rendered capability.

What it does not supersede

Unchanged and still binding: patrol-before-drop, oracle discipline (the bar is the Chromium/consensus oracle, never a legacy engine), frozen surfaces (the v1 schema and the published wasm freeze contract), and the two gate classes. A capability is not "landed" until its required scoreboard gate is legally available and passes; while FLIP is unratified, a capability that needs it is parked honestly rather than backed by manufactured evidence.

The revised topology changes what converges where; it does not relax how anything is proven.

Subsequent status (2026-07-24)

The two-paths question this amendment left open — the mature static Web renderer beside the prototype spine — is resolved by D-N in the charter's registry: the n0 path is the SVG engine of record, static and animated; the product host routes through the retained websem session — beyond-slice constructs degrade by name at the default best-effort admission and refuse loudly under --strict (the record's same-day addendum); htmlcss::svg is demoted to a frozen semantics donor that evolution rungs port onto the cascade of record. D-N settles routing and succession only — the standing rules above, including the FLIP posture, are unchanged.