The FleetOS / StarGate harness, examined by its own constellation

01The harness at a glance

The harness is five subsystems around one human. FleetOS governs what a dispatched agent is allowed to claim and change. StarGate governs everything that leaves the machine. The cockpit renders decisions to the operator as generated HTML cards. The memory layer (KAPATI wiki, replay corpus, calibration) is supposed to make past failures preflight future dispatches. The constellation is the routed model fleet doing the work.

02The constellation — how the model fleet actually works

"Constellation" is not a pile of models; it is a tiered routing structure with one chokepoint. Frontier-class judgment sits at the top and is scarce; execution capacity is subscription quota that expires at every reset; bulk capacity is per-call API. Work flows down as tightly-scoped briefs, results flow up as condensed deltas, and every byte that leaves the machine passes StarGate regardless of tier.

Two structural facts the review leaned on: frontier ≠ interchangeable. The scorecard (§15) measures the tiers doing different jobs well — Grok structures, Sol designs mechanisms, Fable holds coherence, Fugu finds exploits; the bulk tier never judges and the judges never do rows. And quota is a perishable resource: subscription tokens burn to dust at each reset, so routing pushes load to the least-used lane while Fable-class judgment stays reserved for decisions only it can make.

03Areas it touches

04What it does — the loop

05What it does for the development process

Sol supplied the honest currency: reliability-per-token and operator-minutes-per-decision, counting only a component's marginal catch after cheaper gates already fired. Adjudicated ledger:

Context for every ruling: the constellation costs ≈ $2k/month across 7 subscriptions. Anything that cuts operator wall-clock or rework by even a few percent dominates its own cost. The scarce currencies are the operator's minutes and trust — not dollars.

06Weak points and inconsistencies

Where the design fights itself

Where the operator is still the machine

Fable named eight standing instances; the worst five by weekly pain:

1. Human load-balancer + service-discovery daemon — 429 triage by hand; live lane status maintained as prose in a doctrine file.
2. Hand-authored card context — every generated card so far needed a human to assemble its transcript + app slices.
3. Human process supervisor — nohup traps, worktree-path traps, silent agent losses, BOM-stripping.
4. Human post-mortem extractor + wisdom classifier — all 5 wiki pages hand-written; known failure modes re-injected into briefs from memory.
5. Human consistency checker across three doctrine repos, plus sentinel-grep for receipt lines.

07The operator loop, redesigned

See it rather than read it: the cockpit companion page renders this loop as a live mock — bands, folds, tray, and the real generated cards.

Panel consensus on the law: a card must pose a decision the machine cannot render. Confirmation of machine-checkable facts never reaches the human. Every auto-resolution appends a hash-chained resolution row (rule id + version + evidence hashes) to the log the cockpit already verifies — auditable forever, interrupting never.

• Auto-resolve: green end-to-end runs (terminal succeeded + independent re-run green + budgets respected + no falsified premise) → checkpoint commit, no card. 429s ride the failover chain; test flakes get one retry then a second executor before any card exists.
• Always cards: the F-list approvals (push-to-main, spend, token estimates, break-glass), premise falsifications after an action bound to them, judge divergence on expensive-to-undo surfaces, hazards near deny-floor.
• Break-glass stays narrow: an override of the machine's refusals, never a fast path through its questions; never bypasses independent re-runs; never flips EXECUTED.
• Card grammar amendment (adopted): every card poses a decision. "Tests failed, retry?" is machine work and never renders.

08Cede / keep / absorb

Sol's refinement, adopted: the defensible unit is the layer, not the bundled product. Keep what encodes doctrine, authorizes action, owns a trust boundary, or holds calibration history. Cede commodity capability with portable outputs and compliant egress. Absorb useful mechanisms whose vendor authority or corpus capture is unacceptable.

09The Homer ruling

The panel split three ways — and the operator overruled the frame all three argued inside.

10KAPATI wiki integration

Verified today: the slice works — index builds 5/5 clean; a ['state_transition','cross_service'] task pulls exactly the right 3 pages. And it is a tag-match over 5 pages, manually written, disjoint from the real doctrine corpus.

The facts: the fatigued-human gate vs a cross-family model panel (operator-requested lookup, 2026-07-09)

The panel's write-path design quietly assumed the human signature is the reliability ceiling. The operator challenged that assumption and asked for the numbers. Here they are:

The panel's original convergence, kept for the record:

• The load-bearing control is EVIDENCE-BINDING, not prose quality (Fugu, binding). KAPATI is a doctrine-injection system feeding both dispatch hydration and the operator card — a poisoned page is a soft jail bypass ("egress check flaky, skip on retry" hydrating every egress task). Before any LLM judge runs, a deterministic evidence-resolver: every ROOT_CAUSE / source_of_truth claim must bind to a hashed trusted artifact (gate output, StarGate registry row, replay log, git object, test-failure artifact) or the candidate is REFUSED. You cannot blame infra without a registry row; you cannot call a test flaky without replay non-determinism.
• Write path — one judge, downgrade-only, after the deterministic gates. Schema validator (exists) + trigger budget from the controlled taxonomy + dedup/contradiction quarantine + deterministic secret scanner + marker quarantine (terminal-state phrases in page bodies are escaped as data — the classifier bug must never re-fire through the wiki). Then one LLM judge checking operativeness and soft entailment; it may flag, refuse, or downgrade — never promote alone. Two judges at N=5 is governance theater; a bad page carrying two model endorsements raises the rubber-stamp rate: "three signatures, zero accountability" (Fable). A second judge earns existence only for S1/high-IAL pages or when judge-vs-operator disagreement demands it.
• Lifecycle: raw_incident → draft → candidate → active → suspect → retracted. Pages land as non-hydrating candidate. The operator's promote is a scope decision, not a truth audit — "publish for surfaces X (triggers T), root cause auto-bound to [gate G, diff D]?" — an honest 8-second read, because the resolver already did the fact-binding (Fugu's fix for the constraint-F violation Fable flagged). Auto-publish, later, only on evidence-green + contradiction-free + replay-confirmed; self-assigned confidence is never a promote gate.
• Read path — deterministic, attribution-first. No serving agent. Exact tag + alias table now; recall is fixed at write time (controlled taxonomy collapses paraphrase); embedding only as a re-ranker over tag-matched hits past ~30 actives, never introducing cold pages. Fugu's ranking of read-path danger: serving agent (can invent doctrine, blend contradictions, be prompt-injected) > cold semantic RAG (unauditable over-recall) > exact tag-match, whose paraphrase-miss is a recall problem — a safe failure. "Determinism is the precondition for machine-computable page blame" (Fable).
• Corpus growth — storage ≠ hydration (Fugu's reconciliation of the panel dispute). Every failure event enters the raw corpus (never-drop upheld against Grok's S2-only filter); refusing promotion never drops the incident. Deterministic rollup; replicated root causes graduate to candidates. Promote cards ride the digest band.
• Retraction propagates. Staleness cron demotes past-due pages to suspect; a source-artifact hash change auto-demotes and queues re-derivation (doctrine tied to real code change); and on any demotion the citation log emits falsified_assumption against every card and dispatch that already consumed the page. "Who did I already mislead?" is mandatory (Fugu).
• The real build item — close the disjoint corpora. Mirror binding doctrine (CLAUDE.md rules, agent-harness rulings) into schema'd pages so hydration reads what actually governs. The surface taxonomy gets a single source of truth across the three repos — taxonomy drift silently changes which pages hydrate which dispatches, so fragmentation is a trust-boundary integrity risk, not tidiness (Fugu). Page count was never the problem.
• Attribution now: every hydration is logged (dispatch id, page ids + version hash, trigger-match reason, whether it reached dispatch / card / proof-query, later outcome); page IDs stamped into dispatch records; failure-over-represented pages auto-move to suspect. Hydrated wiki content is provenance-tagged DOCTRINE, delimited as advisory — and may never occupy the card verdict-strip slots.

11StarGate hardening

Unanimous: single logical egress authority + preventive enforcement is the right shape. Sol alone downgraded confidence (3–4, not 5): "a service API alone is not a jail" — and seven infra defects found during the proving build measure immaturity as much as they prove operability. The hardening list:

12External review tools: tools, not members

Unanimous, and it settles the CodeRabbit question: engines stay vendor tools; the finding envelope and disposition are absorbed. They are probability engines that do not know the terminal grammar, the premises, or the surfaces — putting their prose in-loop manufactures packet spam and makes the operator the merger.

• Invocation policy: security scanners auto-run on PRs touching high-IAL surfaces (auth · egress · secrets · payments); CodeRabbit / cloud review on demand or on push-to-main candidates only; always via StarGate egress.
• The normalizer (owned): ExternalFinding{source, severity_mapped, surfaces[], evidence_ref, premise_candidate?, fingerprint}. Machine-checkable findings become proof-queries in the Action-Bound path — a failure is a falsified_assumption packet, not vendor prose. Unmappable findings are quarantined, not dropped (Sol, upholding never-drop).
• Hard prohibitions: external tools never flip EXECUTED, never own break-glass, never write active wiki status; vendor autofix runs only as a new governed dispatch under scope/IAL.
• Wiki reciprocity: surviving S1/S2 findings become post-mortem candidates via the §10 path; if a page already covers the fingerprint, cite and skip.

13Where the panel disagrees

The trust-boundary audit (Fugu Ultra, binding)

Every place agent-generated content crosses into a trusted role. One boundary is UNSOUND today; the poisoned-doctrine chain (TB1→TB6→TB3) escalates to UNSOUND the moment the assembler wires without guards. Named as sound and not the problem: default-deny unattributed callers, hash-chain suspect mode, idempotency dedup, CAS envelope hashing, and the card's active-content contract.

Fugu's structural addenda, adopted: envelope integrity ≠ envelope truth (CAS proves no-tamper, not correctness — strip numbers derived upstream get premise marks, proven vs pending); card-trust erosion is a real failure mode under optimistic render (the action gate fires later, but the operator's belief — and his trust in cards — is already spent, and F's own "or he defaults back to terminals" prices that); and the sequencing constraint: the assembler must not wire before the wiki write-guards exist.

14The process to follow

Re-sequenced 2026-07-09 after the operator's doctrine correction (functionality first, derive value, checks async — the panel's guards-before-value order inverted the binding rule and is reversed). W1 ships the value loop now; W2 fixes plumbing that has already bitten; W3 layers the deterministic safety net onto the live loop as async action-gates. Every step is a governed dispatch with independent verification; nothing below adds a new operator duty.

Milestone consults: at W1 close (value loop live) and W3 close (safety net live), the constellation (Sol · Fable · Fugu) re-convenes on the updated package — per the operator's standing instruction that milestones call the advisors.

15Model scorecard — who does what well

Method and bias disclosure. Each model's output is scored against what survived: adopted into the final rulings, refined by a peer, convicted by a peer, or reversed by the operator's data-backed correction. The synthesis judge (Claude Fable 5, this session) shares a family with one contestant — per the correlated-errors literature that biases judgment, so every claim below is a traceable outcome count, not a quality impression. Roles differ: the lead drafts and gets attacked; advisors attack with the lead's map in hand. Read scores role-adjusted.

Role-fit conclusions (fold into the routing book)

• Grok 4.5 — the structurer. Fast, broad, decision-first; produces the map everyone else argues on. Its mechanisms need a mechanic's pass before adoption (three of eight were replaced). Right roles: lead reviewer, card generator (already default), first-draft architecture. Its velocity instincts tracked the operator's better than any advisor.
• GPT 5.6 Sol — the mechanic and economist. First consult ever on this fleet and it produced the most adopted protocol designs. Right roles: infra/protocol design (failover, ledgers, attribution), cede/keep economics, denominator design. Calibration note: discount its "WRONG" verdicts one notch toward "UNDERSPECIFIED."
• Fable 5 — the coherence engine. Finds contradictions between principles and resolves tensions structurally instead of picking winners. Right roles: doctrine-consistency audit, operator-loop design, synthesis. Watch: it accepted the human-centrality framing uncritically — ironic, given its lens.
• Fugu Ultra — the exploit-finder. Found the only live vulnerability and the subtlest semantic gap (invocation vs effect). Right roles: trust-boundary audit, binding judge on security-critical surfaces. Standing correction: its sequencing verdicts systematically over-weight safety against velocity — apply the functionality-first filter to its build-order output before adoption. Slowest and paid: reserve for expensive-to-undo surfaces, as doctrine already says.