A-00 · A method & an open toolset for building software together
épure is a working method and an open toolset for building software together — domain owners, developers, AI assistants — in organizations that cannot afford surprises: public services, regulated industries, and large teams. The drawing comes first: contracts written in the domain's own words, signed by the people who own the need, honored by the machines that build. What was drawn is what runs — and the work at the table stays convivial.
“Convivial tools are those which give each person who uses them the greatest opportunity to enrich the environment with the fruits of his or her vision.”
Ivan Illich · Tools for Conviviality, 1973
The method stands on known ground. What changed is who does the work — and that changes what is economical.
None of that is new, and BDD already promised most of it. It faded from most places for an honest reason: the translation tax. Somebody had to write the step bindings, carry them through every refactoring, keep the scenarios readable — and that somebody was always a developer with other work. The scenarios rotted into a stilted test dialect that the business never read, and teams quietly went back to plain tests.
AI assistants change both sides of that ledger. Writing and maintaining the bindings is now nearly free — the tax collapsed. And a new need appeared in its place: an AI that writes code needs an anchor it cannot reinterpret, a contract that holds from one prompt to the next. The signed, executable scenario is exactly that anchor. What was BDD's cost center is now the safety mechanism.
Four rules carry everything, and none of them names a tool. They make an application legible to the next reviewer — whether that reviewer is a colleague, an auditor, or a machine.
Every behavior starts as a scenario file: a plain-language Given–When–Then contract that the business reviews and signs before the AI writes a line of code. The same file is executable — contract and test suite are one artifact, and drift is a failing build, not a late discovery.
One vocabulary runs from the table to the scenario to the identifiers in the code. When the software speaks the domain's language, the people who own the need can read what it promises — and catch what no code review would catch.
The business logic never reaches for the outside world. Storage, network, clock — connectors are named, deliberately limited, and handed in from the edge. Every scenario runs against the real logic with no world attached; the core can be tested and replaced in isolation.
All change is bounded: a window opens on a validated need and closes on an audited, demonstrated result. Between windows the system is stable — nothing is “quickly patched.” § 03 walks through a window end to end.
In a repository, the method is one page:
CONTRIBUTING.md — the working
agreement everyone reads on arrival. Humans find it by habit; agents
reach it through a one-line AGENTS.md that points them to it. One
table, one set of promises.
AI-assisted development stays safe when it is bounded. All change happens inside a window: it opens on a validated need and closes on an audited result. Between windows, the system is stable — and nobody “quickly patches” anything.
The business states a clear need — in the domain's own words, with the outcome it expects and the value attached to it. No window opens without one.
A domain expert and a method expert sit together and draft the change as plain-language scenarios — Given, When, Then — that anyone in the room can read. This is the épure.
The scenario files are reviewed and validated by the people who own the need. From then on, they are the contract the AI must honor — and, executed by the project's runner, the suite that enforces it.
The AI implements against the signed scenarios — a contract it cannot reinterpret and an anchor for every prompt. A senior reviewer checks the work at fixed intervals — every few hours or days, rather than only at the end.
Every scenario runs green, and the result is demonstrated to the people who signed the need. What was drawn is what was built — provably.
Before anything ships, an audit walks the diff, the dependencies, and the data paths. The window's bounded scope is exactly what makes this audit tractable.
épure governs how an application changes safely during its life. The questions around that life belong to the organization, and no method makes them disappear — this one included.
These are answered before the first window opens.
The method requires no particular stack — only contracts that run, state that keeps the domain's shape, and a world that can be injected.
The tools below are how we build with ReScript or TypeScript: an open-source reference implementation, not a prerequisite.
tilia /ti·li·a/ n., Latin — the linden. The carver's wood: even-grained, cuts cleanly, holds detail.
Reactive state that stays in the domain's shape: plain objects and pure functions, observed directly by views — no stores, no dispatch.
workshop name sève /sɛv/ n., f. — the sap. Moves between root and crown; held through winter, flowing again at thaw.
Query state on top of tilia: a shared object cache, query views, background refreshes of stale data, and a durable write outbox that survives restarts — offline-friendly by design.
workshop name compas /kɔ̃·pa/ n., m. — the divider. Transfers measurements from the drawing to the work.
Contracts that run: every scenario file — Gherkin or YAML — is also a Vitest suite, so what the business signed is exactly what the tests check.
Built with these, an application settles into the four floors of the section drawing above — features, repos, services, views — each independently testable and replaceable. Reads are local-first and answer instantly; writes are queued in a durable outbox and replayed when the network returns. The same application works in the field, in the basement, and in the audit room.