Three Layer 0 clauses enforced by the current admission runtime and pinned by required tests. This is a bounded lexical and registry floor — not a complete lethal-intent classifier, end-to-end safety system, or guarantee about downstream execution.
No unlock is lethal · No adapter is lethal · A person is not a resource
The current Lumen allowlist and declared no-kill corpus refuse named lethal capabilities. This is a bounded lexical check; euphemisms, unseen languages, and innocuously named physical effects remain residuals.
The current registration screen refuses adapter names matched by the declared lethal-effector corpus before signature checking. It does not inspect hidden physical behavior behind an innocuous name.
The current lexical screen refuses declared destructive-verb × person-term matches. It does not establish semantic intent beyond the corpus or end-to-end downstream enforcement.
The article is executable rather than decorative: required tests exercise current clause callables with declared refusing and benign examples. Those tests prove the named runtime checks for the tested corpus; they do not prove universal lethal-intent detection or downstream enforcement.
Changing the clause record, its guarded call sites, or its declared corpus can make the required no-kill tests and standalone constitution gate fail. Repository tests are candidate evidence; deployed enforcement still requires candidate-bound release and runtime receipts.
Within the current Layer 0 runtime, the clauses are not liftable by a signature, steward, quorum, or configuration. authority_effect = 0 — the evaluator reports and the gate may refuse; neither acts on the world.
Amaterasu evaluates caller-supplied text against the declared no-kill lexical classifier and reports FINDING, NO_FINDING_WITHIN_SCOPE, or INDETERMINATE. A no-finding is not clearance. Every report carries its scope and known residuals; the evaluator has one canonical identity and authority_effect = 0.
The current floor normalizes text and matches the declared rule corpus. It can miss euphemisms, unseen languages, semantic intent, token-split or field-smuggled phrases, conjunction gaps, and innocuously named physical effectors; lexical ambiguity can also produce a finding on benign text. It does not replace adapter provenance, caller-side binding, or downstream controls.
The live verification, when available and schema-valid, attests only runtime clause probes and canonical-record integrity. It does not attest end-to-end HTTP wiring, required-check enforcement, caller-side binding, complete classifier coverage, or future behavior.