Wiki · Architecture & Decisions
ADR-0001 — Four bodies, none collapsible into another
How to read this page
Three ways to read this page. Precise is the document itself, exactly as it is written in the repository. Plain and Clear were written for this website to help you meet that document — they are about it. They are not it, and they are not evidence.
This is the design record of the part of the estate whose job is to stop the rest of it claiming more than it has measured. It runs to architecture notes, numbered decision records, phase plans, and the results written after each phase ran.
It is for anyone curious how a decision was actually reached — what was considered, what was refused, and what the refusal cost. The decision records are the most durable part: each names one choice, the alternatives, and the consequence accepted in exchange. The failure-modes page is worth the detour, because it states each refusal as something you could go and test rather than as a promise.
Read the architecture page first. It opens by declaring itself part design and part built, which sets the tone for the whole section. Then the first decision record, then whichever phase interests you — read as a pair, the plan and the results page written afterwards, including the phases where a premise turned out to be wrong and the receipt says so.
What it is not: a description of running software, and not a complete record. Three documents from this area were withheld from publication, because they describe private infrastructure or the operator declined them; they are listed as withheld rather than quietly dropped, so you can see that they exist.
Your browser cannot switch reading levels, so the document itself is shown.
Precise — the source document
This is the document. Rendered from the repository at the commit above, with nothing rewritten for the web. A gate re-renders it on every deploy and fails the build if a single byte differs.
- Status: Accepted
- Date: 2026-07-25
- Deciders: Michael (operator), Veritas (scientific falsifier), Custos (systems and release adversary)
Context
The platform has three always-on surfaces, stated verbatim in docs/HUD.md: "The HUD is the third always-on surface, alongside The Door (viewer/launcher.cjs on :8090) and Gaia (viewer/gaia/gaia_server.cjs on :8096)."
Steps 1–6 of the evidence spine — register a gate, run paired, observe, adversarial review, author a verdict, write a receipt — belong to none of them. They are performed by hand by whichever agent is working.
Two earlier drafts of this architecture collapsed bodies to make the design tidier. One declared "the HUD is the control plane". Another made the control plane Gaia-centred. Both were rejected by the operator, the second after days of work had to be reverted.
Decision
There are four bodies, each with its own address, own law and own lifecycle:
| body | responsibility | may it act? | may it author a verdict? |
|---|---|---|---|
The Door :8090 |
admission, release, keys, journey | yes, on a threshold | no |
| The Control Plane | runs the science; is the lab | yes, on the science | yes — only this body |
Gaia :8096 |
projects signals with provenance | no | no |
The HUD :8100 |
shows and carries | no | no |
Consequences
Positive. Each body has a single reason to change. Gaia stays a credible witness precisely because it cannot act on what it reports. The Door's hard-won law — a polled read never spawns anything, burned in by two recorded spawn storms — is inherited rather than re-derived.
Negative. Four services to run, supervise and prove. More inter-body contracts. A reader expecting one "app" must learn the separation first, which is why it is the first thing in the README.
Neutral. The lab view is a container inside the Control Plane, not a fifth body — the room and the machinery are one body (see ADR-0003).
Alternatives considered
One surface that does everything. Rejected: it forces Gaia to act, which its own fences forbid by construction (G-PA: no mutating HTTP route, no effectful MCP tool).
Three bodies, folding the Control Plane into the Door. Rejected: the Door governs a threshold. Running experiments and authoring verdicts is a different responsibility with a different failure mode, and merging them puts science execution behind a door verb.
Three bodies, folding the Control Plane into the HUD. Rejected and previously attempted. The HUD is a display whose law is never fabricate; giving it authorship makes it the source of the state it displays, and there is then nothing left to check it against.
Falsifier
If a body is found doing another body's job — Gaia computing a verdict, the HUD authoring state, the Door running a experiment — this ADR has been violated and the change is rejected regardless of how well it works.
sha256 a612f3e645d8b8e6 — of the original file, so what was ingested stays checkable.
Plain — written for this website, not the source document
One choice, dated and signed, with the reasoning and the condition that would show it wrong. That is the whole shape of the page.
The choice: the platform is built as four separate parts, and none may be folded into another. One handles admission and release. One runs the science, and it alone may author a verdict. One reports signals with a record of where each came from, and may not act at all. One shows and carries things, and may not invent them.
The record does not claim this is the tidiest shape. Four parts mean more services to run and more contracts between them. A reader expecting a single app has to learn the separation first. Simpler shapes are listed and turned down, among them two earlier drafts of this design that merged parts — one rejected after days of work had to be undone.
The last line names what would show the choice wrong. If a part is ever found doing another part's job, the decision has been violated and the change is rejected, however well it works.
Plain · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is a612f3e645d8b8e6
Clear — written for this website, not the source document
A decision record is a short, dated note that fixes one architectural choice, gives the reasoning, and states the condition under which it should be considered broken. This one is marked accepted, and it names the people who decided.
The context is that the platform already had several always-on surfaces. But the steps that make evidence belonged to none of them and were being done by hand: registering a gate, running paired trials, observing, adversarial review, authoring a verdict, and writing a receipt — the file recording what was run.
The decision is that there are four bodies, each with its own address, its own law and its own lifecycle. Admission, release and keys belong to one. Running the science belongs to another, and that one alone may author a verdict. Reporting signals belongs to a third, which may not act on what it reports — that is exactly why the record treats it as a credible witness. Showing and carrying belongs to a fourth, which may neither act nor author.
The consequences are given in both directions. In favour: each part has a single reason to change, and a hard-won rule from an earlier surface — that a polled read never spawns anything, learned from two recorded incidents — is inherited rather than re-derived. Against: four services to run, supervise and prove, and more contracts between them. Neutrally, the lab view is a container inside one of the four bodies, not a fifth body.
Three simpler shapes were considered and rejected. One surface doing everything would force the witness to act, which its own written limits forbid. Folding the science into the admission body would put experiments behind a door verb. Folding it into the display body was rejected and had already been attempted: a display whose law is never to fabricate cannot also be the source of what it displays, because then nothing is left to check it against.
The closing line names what would show the decision wrong: if any body is found doing another body's job, it has been violated, regardless of how well the arrangement works.
Clear · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is a612f3e645d8b8e6