Overview · Written article
The control plane
An append-only hash-chained ledger with exactly one writer, five verdict words, and a room whose override does not exist.
How to read this page
Three ways to read this page. Precise is the document itself, exactly as it is written in the repository. Plain and Clear were written for this website to help you meet that document — they are about it. They are not it, and they are not evidence.
These 13 pages are the only ones on this site written for this site. Everything else you can read here is a real file from a working repository, republished as it stands. These were written by hand for someone arriving with no context: an entry point, one article for each major part of the estate, and a set of practical guides for installing, running and maintaining things.
They carry one unusual discipline. Every citation in them points at a real file at a named commit, and the build resolves it there. If the file has moved, or a quoted range has run off the end of it, the build fails. It will not publish a reference that no longer lands. The wording of an article can drift out of date; what it points at cannot silently do so.
Start with "Start here". It is short, and it explains the one idea the rest of the estate is arranged around. After that, read whichever part you care about, or go to the quick start if you would rather run something than read about it.
What they are not: authoritative. An article is prose about documents, and the documents are the record. Where the two disagree, the document is right and the article is the thing to fix.
Your browser cannot switch reading levels, so the document itself is shown.
Precise — the source document
This is the article as written. Every citation and quoted block in it is resolved against the real file at the real commit when the site is built.
The control plane is the body that runs the lab and authors every verdict. It is the part of this estate that exists to make the rest of it accountable, and it is the best-documented subsystem here by a wide margin — 16 modules, roughly a third of them explanatory prose, against 51 test files.
Test lines outnumber source lines more than two to one.
First, the name collision
Two different things in this system are called "the control plane" and the module says so itself before it says anything else:
@moduledoc """
The **science's** control plane — the body that runs the lab, authors every
verdict, and is the only writer of the evidence record.
Not to be confused with `SP.Producer`, which its own moduledoc calls "the live
show-running control plane". That is the **show's** control plane: cameras,
narration, broadcast. This one is gates, runs, receipts and verdicts. Both
names are correct in their own domain; the disambiguation is ADR-0006 in
`docs/control-plane/decisions/` (UNI-FLAGELLUM). `SP.Lab` is a third distinct
thing — the hard-science physical models — and is untouched by this namespace.That file is 44 lines long, of which 40 are that docstring. It exists to explain a namespace and prevent a confusion. It is worth noticing that someone thought the confusion serious enough to spend a file on.
One writer
Every mutation to the evidence record goes through a single module, and that is enforced by the type system rather than by convention: the writer requires a token that only the command path can mint.
Every entry records who acted, in what role, under what authority, and what the state was before and after. Two distinct parties are required where two are required — the co-signer cannot be the proposer, and there is a test named exactly that.
The chain, and what it cannot do
The ledger is append-only and hash-chained. Each entry carries the hash of the one before it, so a row cannot be quietly altered after the fact without breaking every hash downstream.
But a hash chain cannot detect truncation of its own tail. Lop off the last N entries and what remains is a perfectly valid chain. The system's response to that is the part worth reading: it does not hide the limitation, it holds the head and length outside the chain as an anchor, and it has a test that performs the truncation attack and asserts it succeeds — so the limit stays visible rather than being quietly assumed away.
There is a further honesty here that is easy to miss. Corroboration requires a custodian the writer
cannot reach. Measured, the current witness accepts the writer's own key — so the anchor is
tamper_evident and explicitly not unforgeable, and the code refuses to claim the stronger word.
Five words, never a percentage
A verdict is one of PASS, PARTIAL, FAIL, WITHHELD, PENDING. There is no score.
A percentage invites averaging, and averaging is how a broken root gets hidden under a healthy crown.
WITHHELD and PENDING exist because "we did not look" and "we looked and could not tell" are
different states, and collapsing either into a pass is the failure this whole apparatus is built
against.
A gate must be registered before its run, so a check cannot be invented after seeing the result.
Comparing like with like
A comparison between two runs is refused at construction unless exactly one variable differs. Not warned about — refused.
Relatedly: a run's identity hashes in its planned sample size and its stopping rule, so relabelling a run changes which run it is. You cannot decide the stopping rule after seeing the width.
The door with no handle
Releasing something to the world requires passing through a room: green, then clean, then sterile, with two keys from distinct parties.
The interesting design decision is what happens when you want to skip it:
Not "an override is refused" — there is nothing to call. A refused control still
teaches that the door exists, and a control that exists gets used on the night
it matters. The same reasoning as the render contract's *refusals are absent,There is no override function. Not a refused one — an absent one. The reasoning is that a control which merely refuses still teaches the operator that the door exists, and a door that exists gets used on the night it matters most.
What is not established
The ledger has recorded no verdict about a real scientific claim yet. The apparatus is built and tested; what it has mostly adjudicated so far is its own construction.
And the honest state of the witness above is the one to carry away: tamper-evident is a real property and unforgeable is a different one, and this system is careful about which word it uses.
Plain — written for this website, not the source document
This page describes the part of the system that keeps the science honest. It records every judgement the project makes about its own work, and it is built so that the record cannot be quietly tidied up later. Entries are only ever added, never changed, and each one carries a fingerprint of the entry before it, so altering an old row breaks everything after it. Only one component may write to it, and that is enforced by the code rather than by good manners.
A judgement is one of five words, never a percentage, because a percentage invites averaging and averaging hides a broken part under a healthy total.
The page is unusually open about the limits of its own design. A chain of fingerprints cannot notice that its own tail was cut off, and the outside witness that would make the record hard to forge currently accepts the writer's own key. So the record is called tamper-evident and explicitly not unforgeable. It also says no judgement about a real scientific claim has been recorded yet.
Plain · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is c947e289bda23919
Clear — written for this website, not the source document
This article describes the body that runs the lab and authors every verdict — the part of the estate that exists to make the rest of it accountable. It is the best-documented subsystem on the site, with test lines outnumbering source lines.
It opens with a warning about a name collision. Two different things in this system are called the control plane, and one source file exists almost entirely to explain that and prevent the confusion.
Then the design. Every change to the evidence record goes through a single writer, and that is enforced by the type system rather than by convention: the writer needs a token only one path can mint. Every entry records who acted, in what role, under what authority, and the state before and after. Where two distinct parties are required, the co-signer cannot be the proposer.
The record is append-only and hash-chained, so a row cannot be quietly altered later without breaking every hash downstream. The article then does the thing that makes it worth reading: it names what that cannot do. A hash chain cannot detect truncation of its own tail — lop off the last entries and what remains is a valid chain. The response is not to hide the limitation but to hold the head and length outside the chain, and to keep a test that performs the attack and asserts it succeeds. There is a further limit: corroboration needs a custodian the writer cannot reach, and as measured the current witness accepts the writer's own key, so the anchor is described as tamper-evident and explicitly not unforgeable.
A verdict is one of five words and there is no score. Two of those words exist so that "we did not look" and "we looked and could not tell" do not collapse into a pass. A check must be registered before it runs, so it cannot be invented after seeing the result. A comparison between two runs is refused at construction unless exactly one variable differs — refused, not warned about. And a run's identity includes its planned sample size and its stopping rule, so relabelling a run changes which run it is.
Releasing anything to the world requires passing through a room with two keys from distinct parties. There is no override function — not a refused one, an absent one. The reasoning is that a control which merely refuses still teaches the operator that the door exists.
It ends honestly: nothing has yet been adjudicated about a real scientific claim. What the record has mostly judged so far is its own construction.
Clear · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is c947e289bda23919