how we work
The operating model
Three structures run the lab: a precedence stack, a flow relay, and a publish road. All three are on this page, and each behaves the way it claims to. Watch the floor below run a day first.
schematic · a typical day, not this day
The Working Floor
Every seat burns tokens, and the gauge beside it is how much of its rate it has spent. Run one to a hundred and it goes dark — its unfinished work sits amber at its feet and everything new routes past it. Only 05:00 clears the gauges.
hover any element for an explanation
scrolls →
a band is an account · a bar is a gate · hollow is assigned, filled is done · a dark seat is out of tokens, not idle
- assigned, not done
- done, moving
- refused, or stalled on a dark seat
- rate spent
- the operator
The precedence stack
Five levels, top wins. A verification convenience never outranks a child-safety gate. Levels 3 to 5 lift to their receipts. Levels 1 and 2 are welded shut — press one and the stack makes its own argument.
-
This pane doesn't lift. Some layers exist to stay closed.
-
This pane doesn't lift. Some layers exist to stay closed.
-
Every commit walks the same gate line before it lands: the tree must be clean, so no stray or unreadable file rides along; a PII guard reads the full diff for anything that names a person or a machine; and route coverage proves the pages the site links are pages it actually serves. A refusal stops the commit and is logged as a result, not smoothed over.
-
Agents hold three seats — survey, plan, build. Verify is a station every change passes through, not a seat anyone holds. The human holds the other two moments: dispatch and ratify. Work begins only when a person sends it, and counts only when a person accepts it on the record. Between those two moments, every seat leaves a trail the other seats can check.
-
Builds are small and bounded — one capability at a time, hours not weeks — and each one ends in a dated snapshot with its receipts attached. The next build starts from what the last one proved. What failed verification is written down with the same care as what shipped.
The flow relay
The path one change travels is six stations — two of them are the same human: the operator dispatches the work and ratifies the result. The pass plays once. After that, step it yourself — tap a station (arrow keys work too).
Reads the terrain and writes the design: what to build, and what must not move.
Turns the design into bounded tasks, each small enough to verify on its own.
A person sends the work. Nothing dispatches itself.
Writes the change and commits it behind the gates.
Checks fire on every commit. A refusal sends the work back — and is recorded like any other result.
A person accepts the result, on the record. Only then is it done.
The publish road
Ten stations, one rail. A change reaches the public only by walking all ten in order. Any station may refuse, and a refusal stops the walk — nothing further down the road runs on a hope.
- 01preflight
- 02clean tree
- 03build+canary — a verification that must pass
- 04artifact scan
- 05stage
- 06verify staged — a verification that must pass
- 07human review — a human holds this gate
- 08promote gate — a human holds this gate never automated
- 09verify prod — a verification that must pass
- 10log
- amber = a human holds this gate
- green = a verification that must pass
- plain = machinery
This site has walked the road 123 times.
18 were rehearsals: they stop at station 08 by design, and the gate is never put to a person. One reached station 08 with nobody at the keyboard and stopped there — the gate does not take its answer from a machine. Three reached station 08 and the person holding it said no. 17 were refused at station 02, the clean-tree gate — that gate held, fail-closed, and production was not touched. Three were refused at station 03, build and canary — that gate held, fail-closed, and production was not touched. Two recorded frozen-window, an outcome this page
has no reading for: it is counted as a walk and as neither held at the
gate nor promoted, because naming it either would be this page
inventing a meaning the road never wrote down. 12 were refused at station 05, staging — that gate held, fail-closed, and production was not touched. 67 cleared station 08 and promoted. The first was
2026-07-31, at 4a115a0: the walk that first put this site in public. It did not finish clean. Station 09 — verify prod — ran before the live
site answered with the new build, so the walk wrote
promoted-UNVERIFIED against itself and stopped there.
A separate check afterwards read 4a115a0 back
off production, and that confirmation is appended beside the original
line rather than replacing it. Both are the record: this walk did not
prove it reached production, and something later did. That first walk is one case; it is not the only one. 11 of the 67 promoted walks — not only the first — are, as of
this build, still promoted-UNVERIFIED and unamended: station 09 has
not yet confirmed production for any of them,
and this sentence will keep saying so until something does.
Five principles
Each pane lifts to where the principle was earned.
The site you are reading publishes its own gate refusals, dated, next to what shipped — see the Daily Update.
A prompt can be argued with; a pre-commit hook cannot. The PII
gate on this repo has no override flag, on purpose. Git's own
--no-verify still skips every hook, so the gate is a
floor a person must step over deliberately, not a cage.
An automated check earns blocking power only by measured agreement with human ground truth: N ≥ 25 observations, zero missed violations — one miss resets the count — and at most 2 false alarms. The ladder is written up as field note #3.
Every ceremony carries its own removal condition. The pattern is written up as field note #1.
The write-ups landed as field notes, both captured 2026-07-30: ledger-isolation and calibration-earned promotion.