← architecture review ← the cockpit

FleetOS cockpit / surface selection

The workbench proposals — four versions, rendered

Four voices re-selected the cockpit surface set from the full ~34-surface universe (the 31-surface public catalog + our fleet-native and external-review additions). Rather than force one winner, each proposal is rendered below exactly as its author specified it — mocks generated by Grok 4.5, the proven card generator, populated only with this build's real problem spaces. The generator renders whatever a situation needs, mixed sets included; these are catalogs to steal from, not a ballot.

Where the four agree — and where they split

unanimous in cross-agent collision map (top-3 everywhere) review-fusion board = the CodeRabbit/scanner/Homer carrier Homer = chip/strip on cards, never a face surface knob/dispatch editor closes read→write deviation + reversal merged on one timeline spine
unanimous out signoff/buy-in matrix (audience of one) merge quiz (operator truth-audit, banned) prompt tuner (harness tooling, not a face) ticket triage board (bands own the order) design-system / animation / pixel-UI family (wrong work type)
open splits granularity: 12 distinct (G) vs 6 merged (S) vs 8+feed (F) vs 5+3 drawers (U) module map: standing surface (G/S) vs wiki-derived drawer (F/U) interview: own surface (G/F) vs folded into the editor (S) vs last-resort fallback (U)

VERSION G

Grok 4.5 · 12 surfaces + receipt strip

Keeps surfaces distinct and single-purpose; merges only where one spine serves two jobs (deviation+reversal; PR+findings+quiz → Review-Fusion Board). Five face slots, everything else body.

Cross-agent Collision Map [fleet-native] serves: blocked, approval, judgment, review_gate_failure tier: NOW
agent × path heat · WRITE=#c0392b wash · READ=#2b5d8c wash
agent \ path tests/test_cockpit_live_smoke.py console/cockpit.py console/cockpit_projection.py
codex-fleet w3 WRITE — —
cockpit-v2 V2-12 WRITE READ —
cockpit-v2 V2-11 — — WRITE · land first
claim-overlap: live_smoke WRITES · arbitrate before merge landing: V2-11 chain BEFORE fold-cap reseed
worktree: lane5 leonr · isolated kilo GLM-5.2 · isolated w3 ∩ V2-12 · SHARED write
Module / Hot-path Map [grounding] serves: blocked, falsified_assumption, judgment tier: NOW
entry
ResolutionLog
→
queue
QueueBroker
→
hot-path
projection.build()
→
touched · gate
cockpit POST
503 chain_suspect
gotcha: suspect mode denies POST residual: verify_chain sample /10 → ≤9-cycle lag files: cockpit_projection.py · cockpit.py
pkt_v211_approve · before chain_ok=True hardcoded → after real verify_chain() both logs
Corpus Semantics Map [grounding] serves: judgment, falsified_assumption, blocked tier: NOW
wiki reference
toctou-false-clear-live-repo-peek
past staleness window → suspect
↔
code / hydrate
dropped from hydrate
doctrine skew enforced
edge-case belief found
pkt_foldcap loud card always auto-opens fold _LOUD_AUTO_OPEN_CAP=3 collapses excess
unmatched agent-emitted enums acceptable TB4 supersedes · falsified_assumption → 2 cards
judges: evidence-entailment REFUSES “egress check flaky skip” · trigger-scope flags overbreadth [egress]
Approach Comparator [grounding] serves: judgment, approval tier: NOW
decision surface: V2-11 hash-chain continuity · pkt_v211_approve
A · hardcoded
shape
chain_ok=True static
pros
zero lag · cheap
cons
no real continuity
blast: false allow on break
reject
B · verify both logs
shape
verify_chain() live
pros
suspect 503 denied · banner
cons
cost on every cycle
blast: contained; 959 pass / 5 skip
recommend · ship
C · sample /10
shape
sampled large logs
pros
throughput win
cons
up to 9-cycle detection lag
blast: residual lag window
acceptable residual
Tweakable Plan / Knob Sheet [write-path] serves: approval, judgment tier: NOW
ranked by likelihood-of-tweak · mechanical work collapsed
# knob current / alt flag
1 _LOUD_AUTO_OPEN_CAP 3 / ∞ · off schema · seed 1 loud/test
2 verify_chain sample every 10th / every cycle lag residual
3 materiality floor keep floor / relax tripped thin fixtures
— collapsed: commit 43be9aa keep · 34/34 green · one-nohup-per-bash-call (memory)
Deviation & Action Timeline [memory+audit] serves: falsified_assumption, blocked, review_gate_failure tier: NOW
pkt_foldcap · falsified_assumption S2
plan-said loud card always auto-opens fold → code-did _LOUD_AUTO_OPEN_CAP=3 collapses · 2 failed / 964 passed
conservative-call seed 1 loud card per test · keep 43be9aa
fold-forward: scoped 34/34 green
pkt_dispatch_launch · blocked S1
plan-said dual nohup one bash → code-did V2-9 pid 14919 ok · fold-cap pid 14920 dead · no log
conservative-call one-nohup-per-bash-call · solo relaunch
fold-forward: idempotency dedup makes double-submit safe
pkt_v28_stall · judgment S2
plan-said 1700s timeout → code-did poller outcome=stalled returncode=null @1700.3s · git 8/8 complete · pytest 933
conservative-call reject the label · commit
pkt_materiality_gate · review_gate_failure S2
plan-said thin ok → code-did floor trips ‘w’ ‘s’ ‘d’ ‘t’ / “ships now” “delays”
fold-forward fix fixtures · keep floor · 38/38 green
Review-Fusion Board [review+external] serves: review_gate_failure, approval, unverified_hazard tier: NOW
id sev source surface[] local evidence / fp
TB4 S1 security-scan terminal markers · agent-visible CONFIRMED (FP’d 3×) W2a · trusted emitters only
SEC-2 S2 security-scan error-path tokens · PostToolUse miss CONFIRMED W0b→W3 shared scrubber
CR-1 S3 coderabbit _keep_single_loud dup · smoke+cli pending drift risk · dedup_n=1
fusion SPLIT Grok+Codex+Fable consent-slice filter bypass invite NOT / stale-only local proof-query seeded
6-q self-check: authority never EXECUTE · vendor seeds local only · fingerprints enforced · · illustrative silence on remaining 3
Blast-radius Interview [write-path] serves: approval, judgment, unverified_hazard tier: SOON
ranked Q stack (damage-ordered)
Q1 Concurrent writers on cockpit_projection.py / live_smoke?
Q2 Raw transcript tokens egress if prototype graduates?
Q3 Chain detection lag (≤9 cycles) acceptable on large logs?
Q4 Materiality floor vs thin fixture policy? · illustrative
decisions
Q1arbitrate w3 vs V2-12 before merge
Q2pkt_secret_hazard scrub before spike
Q3sample residual owned · ship B
paste-ready dispatch brief
land V2-11 chain first · forbid dual-WRITE live_smoke · scrub pre-egress (W0b) · seed 1 loud/test · keep materiality floor
Dependency-Warning Dispatch Editor [write-path editor] serves: approval, blocked tier: SOON
landing order group
V2-11 chain land BEFORE fold-cap reseed
one-nohup-per-bash-call
dual-nohup same call · off
prereq warnings
RED · reverse land order invalidates fold-cap asserts (chain-verified projection)
RED · w3 + V2-12 both WRITE live_smoke · block merge
OK · premises: chain verify green · collision readset clear · envelope CAS fresh
export keys (changed only): land_order=V2-11>foldcap nohup_policy=solo arbitrate=live_smoke
Wiki Claim-Diff / Corpus Delta [memory+audit] serves: falsified_assumption, judgment tier: SOON
wiki_page_id before → after attribution demotion
toctou-false-clear-live-repo-peek hydrate-valid → past staleness · dropped doctrine skew scanner suspect · demoted
TB4 / agent-emitted enums “enums acceptable” → supersede: trusted-side only retraction log → 2 consuming cards falsified_assumption
egress check flaky, skip on retry candidate claim → split refuse/flag entailment REFUSES · scope overbreadth judgment card
fold-cap loud-auto always open → cap=3 intended pkt_foldcap · commit 43be9aa corrected
Blindspot Pass [grounding] serves: unverified_hazard, blocked tier: SOON
S1 · unverified_hazard
token egress graduate
pkt_secret_hazard risk 0 today · raw transcripts w/ tokens if grads
PROOF: scrub before spike; scrubbing passes 0
S1 · security
agent-controlled enums
TB4 terminal-state markers from agent-visible text
PROOF: only trusted-side emitters emit markers
S2 · residual
9-cycle detection lag
verify_chain sampled every 10th on large logs
PROOF: inject break; assert detect ≤9 cycles
S2 · error-path
PostToolUse never on errors
SEC-2 unscrubbed tokens on error output
PROOF: force tool error; assert pre-egress scrub
S3 · · illustrative
dual WRITE race window
w3 × V2-12 on test_cockpit_live_smoke.py
PROOF: collision map readset empty before merge
Completion-gate Receipt Strip [review+external · frame] serves: approval, review_gate_failure tier: NOW
frame strip · never blocks card face · Homer CL + done-ledger
staging deploy · CL=0.99 ALLOW · receipt_hash · page-text evidence · ledger: retries=1 · materiality=y
facts-lookup · CL=0.96 ALLOW · receipt_hash · · illustrative · ledger: retries=0 · materiality=n
soak claim · CL=0.90 ALLOW · 96/96 soak · ~20s/card · 980 tests green
staging claim (prior) · CL=0.76→0.79 BLOCK · demanded visual + page-text · fix → allow 0.99

VERSION S

GPT 5.6 Sol @ max · 6 merged workbenches

Compresses hard: each workbench fuses 3-5 catalog items into one pane with typed rows (Grounding Map, Knob Dispatch, Collision+Landing, Review Fusion & Completion, two SOON ledgers).

Architecture Grounding Map [grounding] serves: judgment, falsified_assumption, blocked, unverified_hazard tier: NOW
source / wiki / reference
wiki: toctou-false-clear-live-repo-peek stale
TB4: agent-emitted enums acceptable superseded
_LOUD_AUTO_OPEN_CAP=3 (intended)
→
decision premises
commit V2-11: chain verify green
no concurrent writer on cockpit_projection.py
envelope CAS fresh
→
repo modules · hot path
ResolutionLog + QueueBroker → projection.build() → POST gate
503 on chain_suspect · console/cockpit.py
supported split judges stale edge
unresolved proof-query status note
egress check flaky, skip on retry SPLIT entailment REFUSES · scope flags [egress]
consent-slice filter bypass SPLIT Grok flag · Codex not repro · Fable stale only
loud card always auto-opens fold FALSIFIED pkt_foldcap · CAP=3 collapses excess
Blast-Radius Plan & Knob Dispatch [write-path editor] serves: judgment, approval, blocked tier: NOW
knob (blast) option dependency warning plan steps
BLOCKING chain verify real verify_chain() hardcode · off must land V2-11 before fold-cap reseed pkt_v211_approve · both logs
CONSEQUENTIAL fold-cap CAP=3 seed 1 loud/test asserts chain-verified projection pkt_foldcap · keep 43be9aa
DIGEST materiality floor keep floor thin fixtures 'w','s','d','t' pkt_materiality_gate · fix fixtures
BLOCKING dispatch launch one-nohup-per-bash pid 14920 dead · no dispatch_fold_cap.log pkt_dispatch_launch · solo relaunch
preview · typed PlanPatch / ActionIntent → CAS dispatch
PlanPatch{ pkt_v211_approve: enable verify_chain(); suspect→503; files:[console/cockpit_projection.py, console/cockpit.py] } · ActionIntent{ relaunch fold-cap solo; idempotency dedup }
Dispatch via CAS · illustrative
Fleet Collision & Landing Map [fleet-native] serves: blocked, review_gate_failure, unverified_hazard, approval tier: NOW
codex-fleet w3
WRITE tests/test_cockpit_live_smoke.py
↘
cockpit-v2 V2-12
WRITE same test file + READ console/cockpit.py
↗
lane5 leonr
Fable reserve · no touch set
·
kilo / deepseek
GLM-5.2 · v4 · idle on shared artifacts
·
shared-artifact node
tests/test_cockpit_live_smoke.py
overlap WRITES · arbitrate before merge
readset
console/cockpit.py
stale-readset? · check hydrate
doctrine / schema
wiki toctou-false-clear…
past staleness · dropped
landing order: 1 · V2-11 (chain) → 2 · fold-cap test reseed → 3 · smoke WRITES · after arbitrate
Review Fusion & Completion Workbench [review+external] serves: review_gate_failure, unverified_hazard, approval, blocked tier: NOW
target cockpit-v2 V2-11/V2-12
tests 980 green · 959/5 skip on chain
band focus BLOCKING · CONSEQUENTIAL
finding · fingerprint finder authority local repro fix / dispatch
TB4 S1 · terminal-state markers from agent text security-scan trusted emitters only CONFIRMED FP'd 3x W2a
SEC-2 S2 · error-path unscrubbed tokens security-scan PostToolUse skips errors CONFIRMED W0b→W3 scrubber
CR-1 S3 · _keep_single_loud duplicated coderabbit drift risk pending dedupe helpers
fusion consent-slice filter bypass Grok SPLIT Codex no · Fable stale seeded local proof-query
governed-dispatch Dispatch W2a + W0b scrub Hold CR-1 · repro pending
Homer receipt allow CL=0.90 soak allow CL=0.96 facts block CL=0.76→0.79 staging allow CL=0.99 after page-text
Deviation, Assumption & Reversal Ledger [memory+audit] serves: falsified_assumption, blocked, review_gate_failure, approval tier: SOON
plan baseline
V2-11 hash-chain continuity + fold-cap reseed + materiality floor; one-nohup dispatch discipline; 96/96 soak · ~20s/card · $20.78 governed
t-0 · belief
falsified_assumption · pkt_foldcap: loud card always auto-opens · CAP=3 collapses · 2 failed/964 pass · seed 1 loud
dispatch
blocked · pkt_dispatch_launch: dual nohup · V2-9 pid 14919 ok · fold-cap 14920 dead · solo relaunch
EXECUTED
approval · pkt_v211_approve: verify_chain() · 503 chain_suspect · 959 pass · residual 9-cycle lag
reversal
judgment · pkt_v28_stall: poller stalled @1700.3s · git 8/8 complete · pytest 933 · reject label, commit · blast: projection only · successor: keep floor fixtures fixed
Knowledge Delta & Retraction Map [memory+audit] serves: falsified_assumption, unverified_hazard, review_gate_failure tier: SOON
claim before → after affected judge / evidence state
agent-emitted enums acceptable
→ TB4: trusted-side emitters only
 2 consuming cards · W2a citation log falsified_assumption retracted
loud card always auto-opens
→ CAP=3 collapses excess folds
 pkt_foldcap · commit 43be9aa 2/964 fail · 34/34 scoped green demoted
chain_ok=True hardcoded
→ real verify_chain() both logs
 cockpit_projection · POST gate pytest proof · residual lag 9c propagated
egress check flaky, skip on retry
→ judgment card to operator
 hydrate doctrine · premises SPLIT entailment refuse · scope [egress] split pending
retraction propagation TB4 page → 2 cards → pkt_secret_hazard scrub-before-spike → wiki toctou… dropped from hydrate

VERSION F

Fable 5 · 8 surfaces + queue feed + chip

Face-ledger discipline: only collision map and fusion board earn face slots beside the three queue bands; wiki splits arrive as ordinary judgment cards; Homer is a one-line chip; module map rejected as standing chrome (wiki-derived on demand).

Decision card + verdict strip [grounding] serves: all 6 kinds tier: NOW
question
Approve V2-11 hash-chain continuity?
do
Land real verify_chain() both logs; suspect mode 503
worst-risk
Up to 9-cycle detection lag on sampled large logs
key-number
959
passed / 5 skip
evidence · before → after
chain_ok=True hardcoded → real verify_chain()
files: console/cockpit_projection.py · console/cockpit.py · 3 tests
evidence · residual
sampled every 10th cycle → max 9-cycle lag
Homer CL=0.99 · staging deploy · allow · done-ledger ok
pkt_v211_approve · approval S3 · landing before fold-cap reseed
Cross-agent collision map [fleet-native] serves: blocked, unverified_hazard, approval tier: NOW
agent lane tests/test_cockpit_live_smoke.py console/cockpit.py console/cockpit_projection.py
codex-fleet w3
Codex gpt-5.5 xhigh
 WRITE — —
cockpit-v2 V2-12
Codex
 WRITE READ —
cockpit-v2 V2-11
chain
 — — WRITE · land first
lane5 leonr
Fable reserve
 idle idle idle
edges: same-file · w3 ↔ V2-12 on test_cockpit_live_smoke.py gate contention · POST gate chain_suspect doctrine skew · toctou page past staleness · dropped click → two briefs side by side · illustrative
Review fusion board [review+external] serves: review_gate_failure, judgment, unverified_hazard tier: NOW
finding finder authority local-repro
TB4 S1 · terminal-state markers from agent-visible text
security-scan · seeded: trusted-side emitters only
 CONFIRM CONFIRM CONFIRMED · FP'd 3x
SEC-2 S2 · error-path may carry unscrubbed tokens
PostToolUse never fires on errors · W0b→W3 scrubber
 CONFIRM CONFIRM CONFIRMED
CR-1 S3 · _keep_single_loud helper duplicated
test_cockpit_live_smoke.py · test_fleet_cli.py · drift risk
 FLAG MISS pending
consent-slice filter bypass
invite path · Grok finder
 FLAG SPLIT · Codex not repro · Fable stale only proof-query seeded
Dispatch knob-sheet editor [write-path editor] serves: approval, blocked tier: NOW
pkt_dispatch_launch · blocked S1 · knobs by tweak-likelihood
#1 nohup_per_bash solo=1 ⚠ dep: double nohup killed fold-cap pid 14920
#2 relaunch_mode solo·relaunch idempotency dedup makes double-submit safe
#3 log_path dispatch_fold_cap.log missing · dead process wrote nothing
#4 landing_order V2-11 → fold-cap tests assert chain-verified projection
unknowns · why pid 14919 fine / 14920 dead in same bash · needs solo relaunch proof
diff footer · changed-keys only: − nohup_batch=2 + nohup_per_bash=1 + relaunch=solo · dispatch delta ready
Wiki judge-split feed [memory+audit] serves: judgment tier: NOW · feed
queue band: DIGEST · judgment-kind cards only (splits + S1 + scope)
judgment · split egress check flaky, skip on retry page scope · [egress]
judge A · evidence-entailment
REFUSES
no registry row
↔
judge B · trigger-scope
FLAG overbreadth
trigger [egress] too wide
retraction note: TB4 page supersedes “agent-emitted enums acceptable” → falsified_assumption to 2 consuming cards
Deviation ledger [memory+audit] serves: falsified_assumption, judgment tier: SOON
run / pkt planned actual call fold → attempt-2
pkt_foldcap
falsified_assumption S2
 loud card always auto-opens fold _LOUD_AUTO_OPEN_CAP=3 collapses excess keep intended · seed 1 loud commit 43be9aa · 34/34 green
pkt_v28_stall
judgment S2
 outcome=stalled at 1700.3s 8/8 files complete · pytest 933 pass reject label · commit returncode=null ≠ failed work
pkt_materiality_gate
review_gate_failure S2
 thin fixtures pass floor tripped 3 thin ('w','s','d','t'…) fix fixtures · keep floor 38/38 scoped green
pkt_dispatch_launch
blocked S1
 two nohups one bash V2-9 ok · fold-cap dead one-nohup-per-bash memory solo relaunch next
Blast-radius interview [write-path editor] serves: upstream of approval/judgment tier: SOON
single-question modal · Q3 of blast
If raw transcripts graduate, do tokens egress to remote model?
yes · contain scrub first no · risk stays 0
pkt_secret_hazard · unverified_hazard S1
answered-decisions table
Q1 today inputs hand-written? yes · risk 0
Q2 prototype graduate path? possible
Q3 scrub before spike? answering…
dispatch preview: contain: scrub before spike scrubbing passes 0 · governed export on complete
Corpus semantics map [grounding] serves: approval (reference-port / doctrine-heavy) tier: SOON
pre-flight evidence · module hot path: ResolutionLog + QueueBroker → projection.build() → cockpit POST gate
MATCH
hash-chain continuity
repo: console/cockpit_projection.py · verify_chain() both logs
gotcha: sample every 10th → 9-cycle lag
MATCH
POST gate 503 on chain_suspect
repo: console/cockpit.py · hot path touched node
gotcha: before was hardcoded chain_ok=True
MATCH
loud-card fold cap
_LOUD_AUTO_OPEN_CAP=3 · seed 1 loud per test
2 failed / 964 passed · intended
UNMATCHED
toctou-false-clear-live-repo-peek
wiki past staleness window → suspect, dropped from hydrate
doctrine skew · red flag
Merge brief [review+external] serves: approval (code-bearing merges) tier: LATER
motivation
V2-11 hash-chain continuity — stop hardcoding chain_ok; deny suspects with 503 + rust banner
before
chain_ok=True hardcoded
after
real verify_chain() both logs · suspect=503
file why tour · margin note sev
console/cockpit_projection.py wire verify_chain into projection.build() S1
console/cockpit.py POST gate returns 503 denied:chain_suspect + rust banner S1
3 test files 959 passed / 5 skipped · sample lag residual noted S3
Homer receipt chip [review+external · element of #1] serves: approval, review_gate_failure tier: NOW
Homer CL=0.99 | done-ledger: task · CL · allow · retries=0 · materiality n | allow staging deploy · page-text evidence
Homer CL=0.76→0.79 | done-ledger: staging claim · retries · block-fix-materiality y | block demanded visual + page-text → then allow 0.99
Homer CL=0.90 soak · 0.96 facts-lookup | allow render never gates on chip

VERSION U

Fugu Ultra · 5 faces + 3 drawers + ID substrate

Trust-boundary first: every surface joins on canonical ids (target_id / finding_fingerprint / action_intent_id); no vendor row without a scrubber receipt; autofix only as a new governed dispatch; drawers open per-target, never standing dashboards.

Pinned Decision Packet Queue/Card [fleet-native] serves: all six kinds tier: NOW
pkt_foldcap falsified_assumption S2 agent: cockpit-v2 · worktree fold-cap
verdict keep commit 43be9aa · seed 1 loud card
evidence · 2 failed / 964 passed evidence · scoped 34/34 green scope tests split none
CommitFix HoldSeed
pkt_dispatch_launch blocked S1
V2-9 pid 14919 ok · fold-cap pid 14920 dead
verdict · solo relaunch
RelaunchSolo IdempotentSubmit
pkt_v211_approve approval S3
verify_chain() · 959 pass / 5 skip
verdict · land before fold-cap
ApproveLand SuspectBanner
Review-Fusion Gate Board [review+external] serves: review_gate_failure, unverified_hazard, approval, falsified_assumption tier: NOW
target / finding sev map local-repro finder vs authority action
TB4 terminal-state markers · agent enums S1 security CONFIRMED · FP’d 3× seed: trusted-side emitters only → AGREE W2a
SEC-2 error-path unscrubbed tokens S2 security CONFIRMED PostToolUse skip on errors → AGREE W0b→W3
CR-1 _keep_single_loud dup drift S3 coderabbit pending test_cockpit_live_smoke.py vs test_fleet_cli.py dedupe helper
Grok consent-slice filter · invite path fusion seeded proof-query Codex NOT repro · Fable stale-only → SPLIT local proof
Homer receipt strip allow CL=0.90 soak allow CL=0.96 facts-lookup block CL=0.76→0.79 staging allow CL=0.99 after page-text
Fleet Collision + Dependency/Doctrine Map [fleet-native] serves: blocked, approval, judgment, review_gate_failure tier: NOW
lanes / worktrees codex-fleet w3 WRITE cockpit-v2 V2-12 W+R V2-11 chain (landing) lane5 leonr / kilo / deepseek tests/test_cockpit_live_smoke.py COLLISION both WRITE console/cockpit.py READ POST gate (chain_suspect 503) projection.build() hot path wiki toctou-false-clear… STALE ResolutionLog + QueueBroker cockpit_projection.py CAS doctrine dropped from hydrate red edge readset
arbitrate before both merge serialize: V2-11 → fold-cap reseed stale-CAS badge · wiki suspect
ActionIntent Dispatch / Knob Editor [write-path editor] serves: approval, judgment, blocked tier: NOW
blast-radius knobs ↓
BLOCKING land V2-11 chain on
CONSEQUENTIAL solo relaunch fold-cap on
DIGEST floor stay · fix fixtures only opt
suspect mode 503 denied:chain_suspect armed
⚠ dep: wait collision ticket on test_cockpit_live_smoke.py
generated dispatch diff
+ verify_chain() both logs
+ rust banner on suspect
− chain_ok=True hardcoded
+ one-nohup-per-bash-call relaunch
~ residual: sample every 10th cycle
target_id · pkt_v211_approve action_intent_id · ai_land_v211_chain CAS / readset · cockpit_projection.py · no concurrent writer
Done-Ledger / Deviation / Reversal Timeline [memory+audit] serves: falsified_assumption, blocked, review_gate_failure, approval tier: SOON
planned
staging deploy claim
→
observed
CL=0.76 then 0.79 block
→
deviated
demanded visual + page-text
→
failed-check
block-fix-materiality y
→
retracted
weak staging claim
→
replacement
allow CL=0.99 dispatch
EXECUTED link / taskCLA/Bretriesmat. y/n
staging deploy · page-text proof0.99allow2y
soak claim0.90allow0n
facts-lookup0.96allow0n
pkt_v28_stall reject label · commit—judgment0n
Reference + Module Semantics Drawer [grounding] serves: judgment, approval, blocked, falsified_assumption tier: SOON
ResolutionLog
→
QueueBroker
→
projection.build()
→
POST gate 503 chain_suspect
matched reference excerpt
Fold loudness capped by _LOUD_AUTO_OPEN_CAP=3; excess folds collapse (intended, not defect).
gotcha · auto-open ≠ always edge · multi-loud tests
local symbols
verify_chain() · _keep_single_loud · console/cockpit_projection.py · console/cockpit.py
reveal-source ▸ commit 43be9aa · files: 3 test files + projection
Action-Bound Premise / Wiki Delta Drawer [grounding] serves: falsified_assumption, unverified_hazard, judgment, approval tier: SOON
claim_fingerprint / page judge state S / split / scope impacted retraction
TB4 supersedes agent-emitted enums OK
page_id · terminal-state markers · evidence_ref seeded		 falsified S1 2 consuming cards trigger fire
“egress check flaky, skip on retry”
candidate page · no registry row		 entailment REFUSES · scope flags overbreadth SPLIT [egress] judgment card → op hold
premise · commit V2-11 chain verify green
proof: pytest run id · collision map readset		 held S3 scope land pkt_v211_approve —
wiki “toctou-false-clear-live-repo-peek”
past staleness window		 suspect dropped hydrate exclude doctrine nodes auto drop
Highest-Blast-Radius Question Fallback [write-path editor] serves: blocked, judgment, unverified_hazard tier: LATER
no safe ActionIntent · single architecture question
When prototype graduates, must raw transcript tokens be scrubbed before any remote-model spike, or is today risk=0 hand-written inputs sufficient containment?
A · scrub-before-spike
dispatch W0b→W3 scrubber; binds pkt_secret_hazard
B · contain under risk-0 only
no graduate path; keeps hand-written inputs
C · dual path + gate
scrubbing passes=0 until egress gate green
// consequence branch A → prompt delta
+ Contain: scrub before spike; shared pre-egress scrubber
+ action_intent: sec2_scrubber_W0b_W3
− raw transcripts to remote model
Send-back A reject interview flow · illustrative
canonical ids target_id · pkt_v211_approve · pkt_foldcap · pkt_dispatch_launch · pkt_secret_hazard surface_id · face1…face5 + drawer6…8 finding_fingerprint · TB4 · SEC-2 · CR-1 action_intent_id · ai_land_v211_chain · sec2_scrubber_W0b_W3 egress_scrub_receipt_ref · scrubbing passes 0 · W0b→W3