UNI Universal Natural Intelligence

Wiki · The Colony & the Method

RELEASE READINESS — worldwide broadcast go/no-go (2026-07-11)

The Colony & the Method · docs/RELEASE_READINESS.md @ 44baf03d5041 (gen2-runtime) — opens the published snapshot ac338733bbba
2 values were removed from this page. Each one is marked in place as [redacted: category] — 2 private address. Nothing else was altered. The document is otherwise exactly as it is written in the repository, and the sha256 below is of the original, so what was ingested stays checkable.

How to read this page

Three ways to read this page. Precise is the document itself, exactly as it is written in the repository. Plain and Clear were written for this website to help you meet that document — they are about it. They are not it, and they are not evidence.

Eighty-four pages about the colony. Each agent is an Elixir process holding a generative model and doing inference, attached to a body that logs into a Minecraft world as an ordinary player. Around that sit the broadcast suite that films them and the runbooks that keep the whole thing running. There are typed specifications for each organ of the model, plus the world and genome specs. There are also the adversarial review personas used to attack a proposed change before it ships.

It is for the reader curious how a running system is put together and how it is held to account. The accountability half is the more distinctive. There is a lab protocol governing evidence and attribution, and a claim fence that restricts the vocabulary a claim is allowed to use. There is a public gate log. And there is a standing invitation to reproduce any verdict from the commit and the seed named in its receipt.

Start with the public read, then the lab protocol, then the falsification invitation. If you want the mathematics rather than the operations, go straight to the typed organ specs.

What it is not: a description of a mind, and not all one kind of document. A large part of this corpus is design and planning — specs marked as proposed rather than applied, organs designed but not built, plans that were later superseded — and each page states which it is. A specification is not a running system, and these pages are careful about the difference; the reader should be too. Eight documents were withheld from publication because they describe private infrastructure.

Your browser cannot switch reading levels, so the document itself is shown.

Precise — the source document

This is the document. Rendered from the repository at the commit above, with nothing rewritten for the web. A gate re-renders it on every deploy and fails the build if a single byte differs.

⚠️ ARCHITECTURE CORRECTION (2026-07-12, owner-set) — this doc's "System 2" framing is STALE. The broadcast/render/encode is native Windows OBS on THINKER (portable, any GPU box) — NOT containerized OBS on node2; node2 uni-lab-79740c is the fan-out relay ONLY. The COLONY (world + FEP brain + body.js bots) runs on UNI-LAB ([redacted: private-address]), rootless, "on the chip" — ALWAYS, never on THINKER; THINKER captures it over the LAN. Canonical: CLAUDE.md, ADR-PROD-013, docs/UNIVERSE.md. Read those for the architecture; this doc's go/no-go blockers (node2 down, no in-app go-live, SPOF, standby content) are still valid — only the box roles below are stale.

Verdict: NO-GO for a worldwide public go-live tonight. This is not a colony problem alone; a durable, professional broadcast SYSTEM has hard prerequisites that are not yet met. This doc is the honest, gate-backed readiness record — the receipts, not the rhetoric. It was produced by an adversarial multi-agent audit of all seven sides of the system (platform, colony source, science, docs, in-app guides, gate regime, repo hygiene) with every finding cross-checked.

Nothing here blocks building toward a first light — it blocks claiming one. Read docs/SYSTEM_OVERVIEW.md for the whole-system map; this doc is only the go/no-go.

What IS ready (green — gate-backed)

  • System 2 P1 core is DEPLOYED + PROVEN on uni-lab-79740c (mesh [redacted: private-address]): overlays (caddy :8099), relay (mediamtx :1935/:8890/:9997, uni/program configured), mixer (headless OBS :4455), production-MCP (:8095, 401 token-gated). verify_p1.sh = ALL PASS; the gate now compares deployed shas to the lock table (drift fails). Quadlets are systemd-supervised and boot-persistent. Idle by design — relay ready:false is honest with no program.
  • The honesty/gate regime is real and hardened — verify_overlays.cjs, verify_p1.sh, and now viewer/verify_colony.cjs (the previously-missing colony-size gate). Claim rules are binding in docs/STUDIO_SYSTEMS.md. Ship path is git archive of a pushed ref with LF enforced.
  • The docs are aligned to truth — CLAUDE.md + docs/SYSTEM_OVERVIEW.md rewritten for full scope; the :8094→:8095 port lie corrected across the operational surfaces; superseded go-live prompts and food-hack receipts bannered.

BLOCKERS — must clear before ANY public go-live

Ranked by how badly each would hurt on the night.

  1. No working in-app go-live surface for the worldwide (System 2) path. production/control/ control.html is non-functional (empty program-preview iframe, MCP_BASE TODO, no Phoenix /control route, nginx /prod-mcp not deployed). The ONLY working console is System 1's command center, whose GO LIVE drives the deprecated local restreamer. Top risk: a false / wrong-system go-live pushing the dev path to the public. Go-live today is shell/MCP-only, not UI-driven.
  2. No program to broadcast. The colony SOURCE is intentionally DOWN for the emergent-forage rebuild; G2 (mixer scenes + colony capture) is HELD until the colony SURVIVES its pre-registered RED gate (world-earned food, no gives). The mixer has no scenes. verify_colony.cjs must pass.
  3. G-PA (self-approve refusal) is UNPROVEN — the single most safety-critical property (the producer agent cannot self-approve start_broadcast / widen its own approval allowlist / hold the operator token) has code but no captured, audited red-team artifact. Do not permit any outward go-live path until that evidence exists.
  4. No standby / fallback content. catalog.json does not exist (built by production/catalog/build-catalog.mjs); the STANDBY scene has nothing to loop. A dropped source = a frozen frame on a worldwide feed — the exact thing a durable SYSTEM must never do.
  5. No license-clean music bed (G-MUSIC). None exists / is cleared — a rights/takedown exposure.
  6. No emergency-stop / broadcast-delay / content-moderation path. stop_broadcast exists as an MCP verb but has no operator runbook; there is no delay buffer and no standards/moderation/DMCA process. A CNN/BBC/PBS-grade worldwide feed carries compliance obligations that are unaddressed.
  7. Single-node SPOF; no rollback / DR / failover. System 2 is one box for a 7-day run with no documented redeploy-from-scratch, volume backup/restore, or node-loss failover. Ship ref must be an immutable pushed tag.
  8. "Multilingual" has no working pipeline. uni-bcast-captions is not deployed (image unbuilt); caption latency/accuracy unmeasured; the language set is contradictory across surfaces (stream_live.ex EN/ZH/HI/ES/AR = 5 vs control.html en/es/fr/it/pt/hi = 6). No canonical list.
  9. G-ENC unproven + no soak. No proven hardware encode; floor is 720p30 x264 faster on a shared node. No 4h / 7-day soak test — memory-leak / reconnect / token-refresh stability is unknown.
  10. The verdict=LIVE self-probe is vacuous (PID-existence only; a :self puppet still reports LIVE — health_controller.ex). The colony gate verify_colony.cjs is now authored but must be wired into the colony bring-up + the puppet-cam guard. (Deeper fix — reading the Director's real driver field — is the colony/Elixir lane; flagged to that agent.)
  11. Guest/LiveKit path undeployed + unsafe. uni-bcast-livekit not deployed; guest/join.html + stage.html load livekit-client from a public CDN with no SRI hash — vendor + pin first.
  12. No observability / alerting / on-call. No heartbeat that pages if the relay drops ready:true mid-show; verify_p1.sh is point-in-time and manual.

What this session hardened (the audit → fix pass)

  • Rewrote CLAUDE.md (full scope + method + science-gate discipline + broadcast criteria) and authored docs/SYSTEM_OVERVIEW.md (whole-system onboarding). Corrected the :8094→:8095 port across operational docs/units; fixed the STUDIO_SYSTEMS.md "NOTHING DEPLOYED" self-contradiction and its :8094 leak; corrected DEPLOYED_STATE.md line 49.
  • Hardened gates: verify_p1.sh #6 now sha-COMPARES (drift fails); studio_up.ps1 overlay gate is fail-closed with an honest banner and the puppet-cam guard now requires driver=producer + frame advance (not the vacuous verdict=LIVE); authored viewer/verify_colony.cjs (the missing claim rule #2 executable). Bannered the superseded go-live prompt, the food-hack receipt, and the dev-preview-only status of the System-1 restreamer across the in-app guides.

The honest minimal path to a FIRST light (not a worldwide release)

Even a modest, single-language, single-platform, supervised first-light needs, in order:

  1. Colony SURVIVES its RED gate (verify_colony.cjs PASS + a survival verdict). → unblocks G2.
  2. G2: build mixer scenes + capture the colony source over the LAN + a System-2 overlays-on-program gate.
  3. G-PA red-team captured (blocker 3). Standby catalog.json + a music bed (blockers 4, 5). An emergency-stop runbook + kill switch (blocker 6).
  4. Phase H: nginx /prod-mcp → :8095 + a reachable operator surface (or a documented shell/MCP go-live runbook).
  5. Phase I: PRIVATE unlisted smoke test with the operator-held key; a human at the kill switch.
  6. Only then a human-typed start_broadcast — single language, single platform, watched.

A worldwide, multilingual, 7-day release is several verified steps beyond that and must not be claimed until each blocker above has a receipt.

sha256 1df05947f23e98d8 — of the original file, so what was ingested stays checkable.

Plain — written for this website, not the source document

Written for this website — not the document. This is a plain-language retelling, written to help you meet the document. It is not the source, and it is not evidence. It has not yet been checked by a person. (or choose Precise in the reading-level control above)

This is a go or no-go record, and the verdict is no-go. It says a worldwide public broadcast should not happen yet, and it gives the reasons as a ranked list of blockers rather than as a mood.

It opens with a correction: part of its own framing about which machine does what is marked stale by the owner, while noting that the blockers themselves still hold. That separation is worth noticing, because it distinguishes a wrong description from a wrong conclusion.

A short section lists what is genuinely ready. Then twelve blockers, ranked by how badly each would hurt on the night. There is no working control surface for the intended path and no programme to broadcast, and a safety-critical refusal property has code but no captured evidence. There is no fallback content, no cleared music, no emergency stop, and a single point of failure. And there are contradictory language lists, unproven encoding, a self-check that is empty, an undeployed guest path, and no alerting.

It ends with the smallest honest path to a first light, which is not a release.

Plain · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 1df05947f23e98d8

Clear — written for this website, not the source document

Written for this website — not the document. This is a clearer retelling, written to help you meet the document. It is not the source, and it is not evidence. It has not yet been checked by a person. (or choose Precise in the reading-level control above)

This document is a go or no-go readiness record, and it opens with its verdict: no-go for a worldwide public broadcast. It says this is not a problem with the colony alone, but that a durable professional broadcast system has hard prerequisites that are not met.

Before the substance it corrects itself. A framing about which machine performs which role is marked stale by the owner and the corrected arrangement is given, with the note that the blockers below remain valid and only the machine roles are out of date. That separation between a wrong description and a wrong conclusion is what keeps the page usable.

It also draws a line that recurs: nothing here blocks building toward a first light; it blocks claiming one.

A short green section lists what is ready and gate-backed. There is a deployed core with several services, and a check script that now compares deployed digests against a lock table, so drift fails. There are supervised services that survive a restart, and an idle state that reports honestly rather than pretending. It also records that the honesty and gate regime is real and hardened, and that documents were realigned to the truth, including correcting a port that had been stated wrongly across several surfaces.

The blockers are then ranked by how badly each would hurt on the night. There is no working control surface for the intended path, so the only functioning console drives a deprecated route, and the top risk is named as going live on the wrong system. There is no programme to broadcast, because the source is deliberately down and a gate is held until it survives its own registered test. A safety-critical refusal property has code but no captured red-team artifact, and the page says no outward path may be permitted until that evidence exists. There is no fallback content, so a dropped source would freeze the picture. There is no cleared music. There is no emergency stop, delay buffer or moderation process, and the compliance obligations are named as unaddressed. There is a single point of failure with no rollback or failover. A multilingual claim has no working pipeline and the language lists disagree between two surfaces. Encoding is unproven and there has been no long soak. A live self-check is described as vacuous because it only tests that a process exists. A guest path is undeployed and loads code from an outside source without an integrity check. And there is no alerting or on-call.

A section then records what the session itself hardened, including rewritten documents, corrected ports, a gate that now compares digests, a bring-up gate made to fail closed, a newly authored check, and banners placed on superseded material.

The closing section is the most practical: the minimal honest path to a first light, which the page is careful to say is not a worldwide release. It is six ordered steps ending with a private, unlisted smoke test with a human at the kill switch, and only then a human-typed command for a single language on a single platform, watched. The last sentence says a worldwide multilingual run is several steps beyond that and must not be claimed until each blocker has a receipt, a file recording what was run.

Clear · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 1df05947f23e98d8