Overview · Written article
The operator plane
Five surfaces for the human in the chair, built on one law — a read never actuates — and one file that logs its own documentation defects.
How to read this page
Three ways to read this page. Precise is the document itself, exactly as it is written in the repository. Plain and Clear were written for this website to help you meet that document — they are about it. They are not it, and they are not evidence.
These 13 pages are the only ones on this site written for this site. Everything else you can read here is a real file from a working repository, republished as it stands. These were written by hand for someone arriving with no context: an entry point, one article for each major part of the estate, and a set of practical guides for installing, running and maintaining things.
They carry one unusual discipline. Every citation in them points at a real file at a named commit, and the build resolves it there. If the file has moved, or a quoted range has run off the end of it, the build fails. It will not publish a reference that no longer lands. The wording of an article can drift out of date; what it points at cannot silently do so.
Start with "Start here". It is short, and it explains the one idea the rest of the estate is arranged around. After that, read whichever part you care about, or go to the quick start if you would rather run something than read about it.
What they are not: authoritative. An article is prose about documents, and the documents are the record. Where the two disagree, the document is right and the article is the thing to fix.
Your browser cannot switch reading levels, so the document itself is shown.
Precise — the source document
This is the article as written. Every citation and quoted block in it is resolved against the real file at the real commit when the site is built.
A research system that only a machine can read is not finished. The operator plane is the set of surfaces a person uses to see what is happening and decide what to do about it.
It is described here without any address, port, hostname or endpoint. Those are real and they are private, and a public article does not need them to explain the design.
The law
Every surface here inherits one rule: a polled read never spawns anything.
It sounds obvious until you notice how easily it breaks. A dashboard that refreshes and, in refreshing, restarts a probe, is a dashboard that changes the thing it is measuring. Watching becomes acting, and the operator can no longer tell which.
The five surfaces
The Door is mission control: admission, release, key custody, and the only place the stack starts or stops. It is the one-move entry to everything else.
Gaia is a projection of live signals with full provenance on every value. Its law is that it may never act — it does not summarise, score, rank, or author. There is a lint whose entire job is to enforce the no-summarisation rule, because a projection that starts summarising has started deciding.
The HUD is a native always-on-top widget backed by a JSON service. It polls the other surfaces, keeps bounded rings rather than a database, and — the property that matters — is built to say when it does not know. A detector that has stopped reporting must read as not reporting, never as calm.
TRACK is where the work came from, where it is, and where it is going, read live from the real artifacts on every request. It owns nothing and stores nothing; every value carries the path it came from so the operator can go and check.
The lab is a walkable room, built in graded levels so that the screenshot gate covering it could be proven to bite before there was anything to look at. The first level is an empty room on purpose.
The decision surface
Until recently, every one of these could show the operator a decision and none could record one. The operator's answers lived in a chat window, which is not an artifact: not greppable, not hash-chained, and gone when the session ends.
There is now an append-only, hash-chained ledger for exactly that, and it is careful about what it
claims. The fences prove a request came from the box, as a loopback name, with a header a cross-site
page cannot forge. None of that proves a human. The claim level is therefore presence_evident
and never authenticated, and that word is stamped into every row — because an agent on the same
machine satisfies every check.
Tamper-evident is a real property. Unforgeable is a different one. The record says which it has.
One chokepoint to air
Going live is guarded in exactly one place, required by every path that could reach it.
Measured, it refuses every path today, because nothing in the repository can mint the token it requires — and there is a gate that scans for a minter and a test that plants one to prove the scan would find it.
The file that logs its own defects
The best single argument for this subsystem is not a design decision, it is a habit. TRACK's own header corrects itself, in place, with dates and reasons:
// AND THE WRITE NOW HAS A LAW TOO, which it did not until 2026-07-28: loopback peer, `x-uni-cc: 1`,
// and a JSON content-type. Stating the read law while the single write route had no fence at all is
// exactly the shape of dishonesty this instrument exists to catch, and it survived here for months
// because nothing ever probed it. See the route itself for the full account.A source file that records where its own documentation was wrong, rather than quietly fixing the sentence, is unusual. It is also the fastest way to understand what this estate is actually for.
The gates
These surfaces are not covered by unit tests in the usual sense. They are covered by executable gates registered in a registry, run by a runner that asserts an exit-code-implies-verdict law and its own registry completeness — so a gate file that exists but is unregistered fails the whole run.
What is not established
Two of these five surfaces have no canonical document anywhere in the estate. The Door, Gaia and the HUD each have one; TRACK and the lab have only their source headers. This article is the first written description of either, which means it is also the least cross-checked thing on this site.
And the honest limit on the decision ledger: it makes a record tamper-evident. It does not make it authentic, and no amount of fencing on a loopback interface will.
Plain — written for this website, not the source document
Somebody has to watch this system and decide what to do about it, and these are the surfaces built for that person. Not one address, port or hostname appears here, on purpose: they are real, they are private, and the design can be explained without them.
One rule runs through all of them. Looking at something must never start it. A dashboard that restarts a probe by refreshing has changed the thing it was watching, and after that, looking and acting can no longer be told apart.
Five surfaces follow. Mission control is the only place the stack starts or stops. A projection of live signals may never act or summarise. A small always-on-top widget is built to say when it does not know. A live view shows where the work came from and where it is going. And a set of rooms is where the project tests its own instruments.
It ends with two admissions. Two of the five have no written description anywhere except this article. And the new record of the operator's decisions can show that a request came from the machine, but not that a human made it.
Plain · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 2952825a919d0abe
Clear — written for this website, not the source document
Nobody can run a system they cannot see, so this article walks through the surfaces built for the person in the chair. Every address, port and hostname is left out: they are real, they are private, and a public page can explain the design without them.
One rule is handed down to all of them: reading something must never start it. That sounds too plain to need saying, until you picture the failure. A screen refreshes, and the refresh quietly kicks off the probe it reports on. Now it alters the very thing it claims to be watching.
Then the surfaces. Mission control handles who gets in, what gets released and who holds the keys, and nothing else may bring the stack up or take it down. A second surface projects live signals and is forbidden to do anything with them — no ranking, no scoring, no tidy summary. A small automated check exists solely to keep it that way, on the reasoning that a projection which starts condensing has quietly begun to choose. A third is a window that sits above everything else. It polls its neighbours, keeps a short rolling buffer instead of a database, and is written so that ignorance shows as ignorance: an instrument that has gone quiet must appear quiet, never calm. A fourth answers where the work came from, where it stands and where it is headed. It rereads the underlying files each time it is asked, holds nothing of its own, and prints beside each value where that value came from. The fifth is a room you can walk through, built in stages so the picture check guarding it could be shown to bite while there was still nothing to photograph. Its opening stage is bare on purpose.
Something was missing until recently. Each of these could display a ruling to the operator, and not one could write it down. Answers that live in a chat window vanish with the session and cannot be searched. A record now exists for that, added to only at the end and linked hash to hash, and it is scrupulous about the size of its own claim. Its checks show that the request arrived from this machine, under a loopback name, carrying a header a page on another site could not fake. A human being is nowhere in that list. So every row is stamped with the weaker word, since any program running locally would clear the same bar.
Reaching air passes through a single guard, and every route that could get there must go through it. As things stand it turns all of them away, because no file in the codebase can issue the credential it asks for.
Ordinary unit tests do not cover these surfaces. Runnable checks do, listed in a register, and whatever runs them audits the register too: a check on disk that nobody listed brings the whole run down.
The article's favourite piece of evidence is a habit rather than a clever choice. One source file keeps a running correction of its own header, dated and reasoned, so the record of having been wrong survives the fix.
It closes on two limits. Two of the five have never been written up anywhere else in the estate, so this article is their first description and therefore the thinnest-checked writing on the site. And the decision record, honestly bounded: it can show that a row has been disturbed. It cannot show the row is genuine, and no further fencing on a local interface is going to change that.
Clear · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 2952825a919d0abe