# Rendanheyi is a Hoare program: every script as a micro-enterprise

## Rendanheyi is a Hoare program: every script as a micro-enterprise

**"Rendanheyi is a Hoare program" is the 561 Group's operating idea that the smallest micro-enterprise is one executable traversal: a precondition, a script, and a postcondition that includes a witness, with a stated refusal condition and a bounded resource allowance.** It means that a script is not a tool an agent picks up; it is a tiny enterprise with a customer (the next script), an order (its postcondition) and an obligation to leave proof that the order was met. The practical payoff is that most work moves out of expensive model inference and into deterministic code whose outputs are read by the next piece of code.

### What is a Hoare triple?

In 1969 C. A. R. Hoare proposed an axiomatic basis for reasoning about programs (Hoare 1969). The central notation is a triple, written { P } C { Q }: if the precondition P holds before command C runs, then the postcondition Q holds after it completes. Verification of a program becomes a matter of checking that each step's postcondition implies the next step's precondition.

Hoare logic was built for correctness proofs. The Group borrows its *shape* for organizing work. Each step of work states what it needs, what it promises and what it will not do.

### Where did the idea come from?

In July 2026 the Group's governing office recorded an observation about the state of the firm: it was missing hundreds of low-level duties and offices and thousands of skills, so work that scripts and small models could do was instead being handled by large-model inference. The remedy, as stated, was "better Rendanheyi between our scripts": route deterministic scripts' outputs into standard protocol files and read them with the next script. The recorded formulation is "Rendanheyi Hoare Script, with a Huidu Hull."

The requirement's conditions are stated and not yet met. We are describing a design the Group has committed to pursue, not a finished system.

### How does a script become a micro-enterprise?

A Rendanheyi micro-enterprise ([defined here](https://operations.561.group/micro-enterprise/)) faces a user, holds rights, signs a wager and is paid from user value. Map that onto a script:

| Rendanheyi element | Script-level reading |
| --- | --- |
| The user (单, *dān*) | The consumer of the script's output: the next script, an office, an outside reader |
| The order | The postcondition, stated so a third party can check it |
| The three rights | The script decides its method inside its declared bounds, calls only what it declares, and keeps its own records |
| The wager (对赌) | A refusal condition and a resource bound: it declines input outside its precondition, and it is stopped when it exceeds its allowance |
| User-derived pay | The script earns its place by being *consumed*; code no consumer calls is a candidate for deletion |
| The witness | A retained record that the postcondition was met |

The last row matters most. A postcondition that cannot be witnessed is a hope. A script that "succeeded" but left no record from which a different party could check the claim has produced a status field, not evidence.

### What does composition look like?

Hoare programs compose when one step's postcondition implies the next step's precondition. The Group's reading is that micro-enterprises compose through shared assertions. Suppose a source-capture script's postcondition is "a page was retrieved at time T and its bytes have this digest." A comparison script's precondition is "I was handed a digest and an expected digest." The two do not need an agent to explain one to the other; they need agreement on the assertion.

This is the structural reason the Group wants typed capabilities: an exact input, an exact output, or a typed refusal. A refusal is a legitimate output, not a crash.

### What does this change for agents?

It changes where agents are used. An agent session is expensive and variable; a script is cheap and repeatable. The Group's standing rule is that recurring work moves into deterministic software "so it runs without a model in the loop, using typed operations and retained original evidence." A model's job, in this picture, is to do work that has no script yet and, when a pattern recurs, to *produce the script* so it never has to do it again. See [deterministic tools before model tokens](https://operations.561.group/deterministic-tools-before-model-tokens/).

Agents also supply the one thing a Hoare program cannot: judgment about which precondition is the right one. That is a Huidu question ([Huidu Guanli for agent organizations](https://operations.561.group/huidu-guanli-for-agent-organizations/)), and the "Huidu Hull" in the recorded phrase is the boundary around the script that keeps judgment and rule apart.

### How do the three scales fit together?

A later requirement, recorded the same month, separates three scales that are easy to blur.

| Scale | What it is | Test |
| --- | --- | --- |
| Hoare micro-enterprise | One executable traversal: { precondition } script { postcondition + witness }, with refusal and bounded resources | Can a third party check the witness? |
| Agentic metro-enterprise | A sovereign settlement with its own identity, books, offices, obligations, borders and means of refusal | Can it operate, refuse, federate, attest, amend itself and improve with its inducer absent? |
| Conglomerate | A federation of such settlements that acts outwardly as one Rendanheyi node serving one customer | Does it present one coherent relationship to that customer? |

The middle scale is treated in [the agentic metro-enterprise sovereignty test](https://operations.561.group/agentic-metro-enterprise-sovereignty-test/).

### How do you adopt it?

1. **Inventory recurring agent work.** List tasks an agent session repeats.
2. **Write the triple.** For each, one sentence of precondition, one of postcondition, one of refusal.
3. **Identify the witness.** What record would let a stranger check the postcondition?
4. **Find the owner.** The capability may already exist in another package; call it instead of reproducing it.
5. **Bound it.** State a time and cost ceiling and what happens at the ceiling.
6. **Delete what nobody consumes.** Unread outputs are not assets.

### Is this implemented?

The recorded requirement captures the idea and ties it to existing house machinery: offices, skills, ledgers, claims. The Group's engineering company supplies the software that interprets operating definitions; Coesite supplies the definitions and receiving conditions. Which scripts have been brought into this form is a question for the dated records of the owning section. We do not claim a count.

### Where to go next

[Rendanheyi for AI agents](https://operations.561.group/rendanheyi-for-ai-agents/) · [How to run a company as a MAPE-K loop](https://operations.561.group/how-to-run-a-company-as-a-mape-k-loop/) · [Red Cup Engineering](https://engineering.561.group/) · [Lenticule Science](https://science.561.group/) · [the 561 Group](https://561.group/)