Deterministic Code

A flexible cognitive loop can interpret, compare, criticise, and revise a weekly dinner plan. The same run still depends on facts that should never have remained open to interpretation. Four people require four portions. A confirmed cashew allergy must be checked against every ingredient. A purchase must not occur without approval. Retrying a failed request must not place the same order twice.

These responsibilities do not benefit from creative variation. They require exactness, and that exactness belongs in deterministic code, not in a cognitive unit pretending to be careful.

Helpful context: Software executes. judgment does not states the division at category level. What is a cognitive unit owns open judgment. This page owns what must stay closed. Closed decisions belong in code explains when work moves out of runtime deliberation.

What the exact layer owns

The cognitive system proposes what should happen. Deterministic code establishes whether the proposal is well formed, permitted, safe to execute, and correctly recorded. A cognitive unit may recommend a substitution. An agent may decide the substitution falls within delegated authority. Neither writes directly to the shopping list or payment system without passing exact checks: schema valid, allergy flags clear, purchase approval present, idempotency key set.

Allowing the same probabilistic component to interpret the situation, select an action, validate its own authority, and perform the side effect is a common architectural mistake. The judgment can remain useful while execution remains unsafe. Thoughtware does not replace conventional software engineering. It creates a stronger reason to preserve exact disciplines, because cognition nearby tempts teams to soften boundaries "just this once."

In the Meal Companion deterministic shell, responsibilities include schema validation before any plan patch applies, allergy enforcement against endorsed household knowledge where cashew flags block ingredients deterministically, portion calculation from household count, plan versioning with transactional patches to working state, shopping-list assembly from accepted meals, permission checks before external calls, purchase approval gates before order placement, idempotent execution so retries do not duplicate charges, and audit trails recording who approved what and when.

Tools belong here. The agent decides when a tool may help the goal. Deterministic adapters govern invocation, permissions, retries, and how observations enter working state, as structured errors, not model prose.

Responsibility	Example
Schema validation	Plan patch shape before apply
Allergy enforcement	Cashew flag blocks ingredient
Portion calculation	Four people, four portions
Plan versioning	Transactional patch to working state
Shopping-list assembly	Aggregate from accepted meals
Purchase approval	Human gate before order
Idempotent execution	Retry without duplicate charge
Audit trail	Who approved what, when

What this looks like in practice

RecommendMealSubstitution proposes a local repair when CritiquePlan names one weakness. Deterministic code then validates the patch against the plan schema, re-runs allergy checks on new ingredients, applies the patch transactionally to working state, and records the change for audit. The cognitive unit never writes world state directly. If the patch would violate a hard constraint, code rejects it crisply, and the cognitive unit does not "try again" until something sticks.

Contrast the failure mode: a cognitive unit that both selects a substitution and updates the shopping list. Re-run safety disappears, ownership blurs, and users learn that exact checks are optional when the model sounds confident.

Leena's cashew allergy is endorsed household knowledge, not inferred each run from chat tone. Deterministic code checks every candidate ingredient list against the endorsed flag before display and again before patch apply. A cognitive unit may propose a meal. Code blocks the proposal if cashew appears. If the model "tries to be helpful" by suggesting trace amounts are fine, that helpfulness is a bug in placement, not a prompt tuning opportunity. The closed decision is closed.

Working state holds current_plan_version. Deterministic code applies transactional patches when RecommendMealSubstitution proposes a repair: validate schema, re-check allergies, increment version, record diff for contestability. Partial regeneration that discards accepted days violates persistence before regeneration, and the deterministic shell enables patch-first UX.

For invoice intake, deterministic code owns totals comparison and payment-terms date arithmetic. cognitive units own explanation credibility. Humans own preferential tolerance policy when the organisation has not settled it.

Determinism should remain deterministic.

Thoughtware White Paper · Pr. 4

The boundary moves

Judgment terrain decides where a responsibility belongs. When inputs and transformations become stable, exactness matters, and behaviour can be verified, work moves toward deterministic code, formalised tolerance rules, shopping-list aggregation, allergy validation.

The reverse also occurs. A rule that looks exact may hide contextual judgment. Escalating every message containing the word "lawyer" produces false positives. Interpretation may need a cognitive unit while deterministic code still enforces what happens after the assessment. Architecture follows the nature of the decision, not a preference for either code or cognition. Maturity moves work out describes the lifecycle. This page describes the destination for closed work.

Sometimes interpretation must happen before exact checks make sense, normalising a messy household message into structured week state. That work may be a cognitive unit (InterpretWeek) followed by deterministic validation. The order matters: interpret, validate structure, then enforce allergies on structured candidates, not the reverse.

Gates, tools, and permissions

The Meal Companion boundary is explicit: the system plans dinners, it does not purchase groceries without approval. That boundary is enforced in deterministic code, not negotiated by a cognitive unit at runtime. The agent may propose a shopping list. Deterministic code assembles the list from accepted meals, validates portions, checks allergy constraints on aggregated ingredients, and holds the purchase action until a human approves. Idempotency keys prevent duplicate charges if the user retries. Audit records who approved and when. cognitive units that "decide" to purchase have collapsed acting into judgment. The household cannot trust a system that treats payment as another fluent output.

Tools, calendar fetch, recipe lookup, inventory scan, belong in deterministic adapters with permission scopes, structured errors, and retry policy. The agent chooses when a tool may help the goal. Adapters govern how invocation happens and how observations enter working state. Observations from tools are not automatically endorsed knowledge. A calendar scrape produces context for this run. A busy-evening rule endorsed by the household produces knowledge. Conflating the two breaks knowledge is endorsed discipline.

Deterministic code also shrinks what reaches cognition, normalising inputs, rejecting malformed requests, enforcing hard stops before metered calls. Sending malformed week state to ComposeWeek wastes money and produces fluent garbage. Deterministic guards shrink unbounded domain, the third async-function break from Chapter 4. See deterministic guards before cognition for placement rules.

Every world write path needs idempotency keys and structured failure returns. cognitive units propose patches. Deterministic code decides whether the same patch applied twice is safe. Retries at the HTTP layer must not duplicate grocery orders, a failure mode that begins when acting work hides inside cognitive unit templates.

Quarterly, walking the deterministic shell inventory reveals which checks moved from prompts to code, which open judgments stabilised toward close, and which exact rules produced false positives and need cognitive unit interpretation again. The boundary moves, and it moves in meeting notes as well as in incidents. Exactness is a feature, not a legacy holdover.

What to do next

An inventory of every exact check in an intelligent feature reveals which still live in prompts. Moving one closed check to code with tests this sprint, and documenting the close in the spec, is the practical first step. Structured cognitive unit output validates before any side effect, because trusting shape alone for content is insufficient. Adapters for tools carry permissions, retries, and structured errors. The boundary revisits when terrain stabilises, or when exact rules hide judgment.

See deterministic guards before cognition and maturity moves work out.

Read next: What is not a cognitive unit.