Wiki · Architecture & Decisions
ADR-0003 — The Control Plane is the lab; the room and the machinery are one body
How to read this page
Three ways to read this page. Precise is the document itself, exactly as it is written in the repository. Plain and Clear were written for this website to help you meet that document — they are about it. They are not it, and they are not evidence.
This is the design record of the part of the estate whose job is to stop the rest of it claiming more than it has measured. It runs to architecture notes, numbered decision records, phase plans, and the results written after each phase ran.
It is for anyone curious how a decision was actually reached — what was considered, what was refused, and what the refusal cost. The decision records are the most durable part: each names one choice, the alternatives, and the consequence accepted in exchange. The failure-modes page is worth the detour, because it states each refusal as something you could go and test rather than as a promise.
Read the architecture page first. It opens by declaring itself part design and part built, which sets the tone for the whole section. Then the first decision record, then whichever phase interests you — read as a pair, the plan and the results page written afterwards, including the phases where a premise turned out to be wrong and the receipt says so.
What it is not: a description of running software, and not a complete record. Three documents from this area were withheld from publication, because they describe private infrastructure or the operator declined them; they are listed as withheld rather than quietly dropped, so you can see that they exist.
Your browser cannot switch reading levels, so the document itself is shown.
Precise — the source document
This is the document. Rendered from the repository at the commit above, with nothing rewritten for the web. A gate re-renders it on every deploy and fails the build if a single byte differs.
- Status: Accepted
- Date: 2026-07-25
- Deciders: Michael, Veritas, Custos
Context
Every existing surface either shows one world to an audience (the colony's control center, Director cam, /stream, /broadcast), or shows a machine's own state (the HUD), or shows signals (Gaia). None is a place to work across every project at once.
The operator's requirement: a UI "a bit like a video game, that brings me and the world into the lab from a visuals and rendering perspective — this must be an immersive experience."
A follow-on correction ruled out the easy answer: UNI.Minecraft's Overlooker is the colony's god-view of its own world, not the lab. The lab view does not exist and must be built.
Decision
The Control Plane is the lab. Its user interface is an immersive rendered environment, not a dashboard, and it is a container inside the Control Plane rather than a separate body.
You author a verdict by standing at the thing you are ruling on. The run under way renders mid-room at the scale of a thing you can walk around, its pre-registered gate and falsifier beside it, before the run has an answer.
Rooms (green, clean, sterile) are volumes with two-key airlocks. Projects are portals: look through to that world's own view, step through to work in it. A portal never re-derives its world's state and never reimplements its renderer. Gaia is the sky — always in view, never enterable.
Consequences
Positive. No split between "the tool that decides" and "the screen that shows deciding", so there is no state to synchronise between them and no second address. Spatial affordances carry epistemic meaning: a room that will not open is the refusal, with no dialog needed.
Negative. A rendered surface is heavier to build and test than a form. Mitigated by borrowing the platform's proven technique — a server pushing a compact scene per tick into a THREE renderer — rather than inventing one. Screenshot-based acceptance tests are required (see the render contract in ARCHITECTURE.md §8.2).
Neutral. The lab is watched by Gaia like anything else and gets no privileged view of itself.
Alternatives considered
A dashboard. Rejected by the operator, and it fails the requirement: dashboards report, this body decides.
Reuse the Overlooker as the lab. Rejected explicitly by the operator. It is one world's view of itself; the lab spans every project and holds rooms, airlocks and authorship the Overlooker has no concept of.
Lab view as a fifth body. Rejected: it would put the room and its command path on opposite sides of a network boundary, re-creating exactly the split this decision removes.
Falsifier
If the lab view can display a state the Control Plane's command path did not produce, or if authoring a verdict requires leaving the room, this decision has been violated.
sha256 10ef88e41447da5f — of the original file, so what was ingested stays checkable.
Plain — written for this website, not the source document
Where the work happens is what this dated record settles. It records a choice, not a finished thing: at the time of writing, the lab view did not exist and had to be built.
The choice is that the part of the platform which runs the science is the lab. Its interface is meant to be an immersive rendered environment rather than a dashboard, and it lives inside that same part rather than being a separate service.
The picture it describes is spatial. You author a judgement by standing at the thing you are ruling on. A run under way appears mid-room at a size you could walk around — its gate written down before the run started, and beside it the result that would show the claim wrong, all before there is an answer. Rooms have airlocks that need two keys. Projects are doorways into their own worlds. The signal-reporting part is the sky: always in view, never enterable.
The record admits the cost. A rendered surface is heavier to build and test than a form, and screenshot-based acceptance tests are required.
Plain · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 10ef88e41447da5f
Clear — written for this website, not the source document
A decision record whose subject was not yet built when it was written: it says the lab view does not exist and must be built.
The context is that every surface the platform already had either showed one world to an audience, or showed a machine's own state, or showed signals. None of them was a place to work across every project at once. The operator asked for something closer to a video game — an immersive experience that brings a person and the world into the lab. A follow-on correction ruled out the obvious shortcut: an existing god-view belongs to one world and is that world's view of itself, not a lab.
The decision is that the body which runs the science is the lab, that its interface is an immersive rendered environment rather than a dashboard, and that this environment is a container inside that body rather than a separate one.
The design is described in spatial terms and each spatial idea carries a meaning. You author a verdict by standing at the thing you are ruling on. The run under way renders mid-room at a scale you could walk around. Beside it stand the gate, written down before the run began, and the result that would show the claim wrong — all before the run has an answer. Rooms are volumes with two-key airlocks. Projects are portals: you look through to a world's own view, or step through to work in it, and a portal never re-derives that world's state or reimplements its renderer. The signal-reporting body is the sky — always in view, never enterable.
The consequences are stated both ways. In favour: there is no split between the tool that decides and the screen that shows deciding, so no state has to be kept in step between them. A room that will not open is itself the refusal, needing no dialog. Against: a rendered surface is heavier to build and test than a form, which is why screenshot-based acceptance tests are required; the record says the risk is reduced by borrowing an existing technique rather than inventing one. Neutrally, the lab is watched like anything else and gets no privileged view of itself.
Two alternatives were rejected by the operator: a dashboard, and reusing the existing god-view. A third — making the lab view a separate body — was rejected because it would put the room and its command path on opposite sides of a network boundary.
What would show this wrong is named at the end: if the lab view can display a state the command path did not produce, or if authoring a verdict requires leaving the room, the decision has been violated.
Clear · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 10ef88e41447da5f