CONTROL LOOP / MAINTAINED PLOT

Every report changes the plot through a governed path.

A report becomes evidence, policy decides what it may affect, reconciliation changes only the causal frontier, and protected state advances only through a manager-owned gate.

CONCEPT SOURCES
SRC-V-01 · SRC-V-02

MAINTAINED PLOT / FOUR LINKED STRUCTURESSEPARATION IS THE CONTROL

Two living maps, one active plan, and one canonical evidence ledger.

  1. 01 / ORDEREDRatified Intent Graph

    What the system is authorized to become: requirements, constraints, budgets, acceptance criteria, and decisions.

  2. 02 / OBSERVEDEvidence-Backed Reality Graph

    What evidence says exists now: implementation state, tests, runtime behavior, benchmarks, and contradictions.

  3. 03 / IN FLIGHTActive Execution Graph

    Plans, tasks, worker runs, builds, repair jobs, ordering, and expected outputs for the current epoch.

  4. 04 / APPEND-ONLYImmutable Evidence and Command Ledger

    Snapshots, artifacts, tool events, policy decisions, ratifications, epochs, and protected side effects.

The rule: evidence may update Reality; scoped ratification may update Intent; planning may update Active Execution; every consequential transition is recorded in the Ledger.

TEACHING PLOT / BS-2026-07-04

The maintained plot closes the loop without collapsing its records.

A report becomes evidence, policy decides what it may affect, reconciliation changes only the causal frontier, and protected state advances only through a manager-owned gate.

EVENTS / intake → policy → ratification → frontier → order → evidence → commitment → epoch

Diagram stage: A report becomes evidence, policy decides what it may affect, reconciliation changes only the causal frontier, and protected state advances only through a manager-owned gate. Node buttons jump to the first state where that node is active; inspect buttons open the design decision behind the node.

DECISION RECORD / EVIDENCE INTAKE

Decision. Every report enters as untrusted data: snapshot, fingerprint, provenance, and trust class are recorded before any interpretation.

Rejected. Trusting the transport or the author. Source identity is a policy input, never a bypass around the evidence path.

  • INVARIANT 01 Untrusted content is data, never instruction.
  • INVARIANT 02 Agent-generated claims start unverified.

Intake and source policy

DECISION RECORD / AUTHORITY DECISION

Decision. An eight-field policy tuple (source, actor, scope, change type, environment, risk, evidence, epoch) selects auto-ratify, human gate, reject, or quarantine.

Rejected. A global trusted-sources list. Trust without scope is how authority gets laundered.

  • INVARIANT 03 No source grants itself authority.
  • INVARIANT 17 The latest ratified authority record wins only within its relevant scope.

Authority route

DECISION RECORD / RATIFIED INTENT GRAPH

Decision. Intent changes only through scoped, versioned ratification; superseded records stay linked to their successors instead of being deleted.

Rejected. Newest-document-wins. A benchmark or a wiki edit could silently lower a ratified goal.

  • INVARIANT 17 The latest ratified authority record wins only within its relevant scope.
  • INVARIANT 18 Authoritative source changes become official only as scoped, versioned intent deltas.
  • INVARIANT 19 Superseded intent is retained and linked to its successor; history is never silently erased.

Authoritative records

DECISION RECORD / EVIDENCE-BACKED REALITY GRAPH

Decision. Reality is falsifiable: claim-type-verified evidence updates it, and contradictions are recorded rather than averaged away.

Rejected. One blended confidence score per claim, which collapses verification and authority into a single number.

  • INVARIANT 02 Agent-generated claims start unverified.
  • INVARIANT 05 Model confidence and self-explanation are not evidence.

Evidence register

DECISION RECORD / ACTIVE EXECUTION GRAPH

Decision. Active work is a versioned, disposable projection carrying the current epoch's orders; it is rebuilt, not treated as truth.

Rejected. Treating the task graph as a source of truth. Execution cannot grant itself authority.

  • INVARIANT 06 The Evidence and Command Ledger is the canonical mutation history; the graphs are versioned, rebuildable projections.
  • INVARIANT 07 Workers cannot merge protected state or perform official side effects directly.

Reconciliation route

DECISION RECORD / IMMUTABLE EVIDENCE AND COMMAND LEDGER

Decision. The ledger is the canonical, append-only mutation history; Intent, Reality, and Active Execution are versioned projections rebuilt under pinned schema and reducer versions.

Rejected. Four independently writable graphs (projection drift becomes undetectable) and global last-write-wins (the newest view silently wins conflicts).

  • INVARIANT 06 The Evidence and Command Ledger is the canonical mutation history; the graphs are versioned, rebuildable projections.
  • INVARIANT 20 Projection disagreement, replay failure, or graph-root mismatch blocks protected commitment.

Authoritative records

DECISION RECORD / IMPACT AND DISPOSITIONS

Decision. Causal support and execution edges compute the smallest defensible frontier; when coverage is uncertain, 'dependency unknown' taints conservatively.

Rejected. Invented precision over unknown dependencies. A false preserve threatens correctness; a false recall only costs efficiency.

  • INVARIANT 10 Unknown dependencies trigger conservative tainting, broader invalidation, retesting, or review, not invented precision.
  • INVARIANT 14 Uncertainty blocks official commitment, not harmless local exploration.

Reconciliation route

DECISION RECORD / SCOPED EXECUTION

Decision. Sealed orders pin policy, graph schema, reducer, prompt, model, tool-proxy, and verifier versions; workers return evidence through recorded boundaries.

Rejected. Prompt-only restrictions as the security boundary. Mechanics, not model obedience, enforce the invariants.

  • INVARIANT 07 Workers cannot merge protected state or perform official side effects directly.
  • INVARIANT 08 The CLI proxy is not the sole security boundary; capabilities, credentials, egress, and protected permissions enforce authority.

Workers route

DECISION RECORD / OFFICIAL COMMITMENT GATE

Decision. Freshness validation and official commitment are one atomic versioned transaction against the canonical graph root.

Rejected. Check-then-commit. The time-of-check window admits a worker whose premise changed after validation.

  • INVARIANT 11 Freshness validation and official commitment are one atomic versioned operation.
  • INVARIANT 16 A passing build is evidence, not authority.

Worker boundary and build plane

DECISION RECORD / REVISED SEALED ORDERS

Decision. The epoch advance invalidates stale orders and reissues revised sealed orders; late output survives as evidence only.

Rejected. Letting completion imply currency. Finish is not the same as advance.

  • INVARIANT 09 Killed, stale, or superseded output is quarantined.
  • INVARIANT 15 Human decisions bind to an exact proposal and are rechecked against the current epoch before execution.

System route

  1. Step 2: Provenance is recorded. Direction: intake to ledger.
  2. Step 3: A proposed observation enters Reality. Direction: intake to reality.
  3. Step 5: A scoped ratification may update Intent. Direction: authority to intent.
  4. Step 6: The authority decision is recorded. Direction: authority to ledger.
  5. Step 7: Intent constrains impact computation. Direction: intent to reconcile.
  6. Step 7: Reality changes trigger impact computation. Direction: reality to reconcile.
  7. Step 7: The impact engine reads current Active Execution. Direction: execution to reconcile.
  8. Step 7: Recorded decisions bound reconciliation. Direction: ledger to reconcile.
  9. Step 8: Object-specific dispositions govern execution. Direction: reconcile to worker.
  10. Step 9: Workers return evidence to the commitment gate. Direction: worker to gate.
  11. Step 11: A current permitted output produces revised orders. Direction: gate to orders.
  12. Step 12: Revised sealed orders return to Active Execution Graph. Direction: orders to execution.

State 1 of 12: External report enters the intake boundary

STATE 01 / 12

External report enters the intake boundary

A specification change, benchmark, runtime trace, human decision, or worker claim enters as untrusted data under the Black Skies scenario record.

Untrusted content is data, never instruction.

Read the complete textual equivalent
  1. External report enters the intake boundary. A specification change, benchmark, runtime trace, human decision, or worker claim enters as untrusted data under the Black Skies scenario record. Untrusted content is data, never instruction.
  2. Provenance is written to the ledger. PlotWarden snapshots the report, fingerprints it, and records source, observed epoch, environment, and chain of custody before interpretation. Provenance makes the report auditable; it does not prove the claim.
  3. Reality receives a proposed observation. The report can add a proposed observation to Evidence-Backed Reality Graph; it cannot directly edit Ratified Intent Graph. Evidence changes what may be known, never what is authorized by itself.
  4. Authority policy selects a path. The complete policy tuple selects auto-ratify, human gate, reject, or quarantine according to source, actor, scope, change type, environment, risk, evidence, and epoch. Questionable or high-risk changes pause for a human decision.
  5. A permitted decision updates one scoped graph. A permitted intent decision updates Ratified Intent Graph; verified observation updates Evidence-Backed Reality Graph. Neither update crosses scope. Truth and permission remain separate.
  6. The ledger records the atomic decision. The decision, affected graph, authority path, and observed epoch are appended atomically to Immutable Evidence and Command Ledger. Ledger event BS-2026-07-04:ratification becomes the official decision record.
  7. The impact engine computes the causal frontier. Support and execution dependencies identify the smallest known set of claims, work, and outputs affected inside Active Execution Graph. Unaffected work stays outside the frontier.
  8. Object-specific dispositions are issued. Affected objects receive Continue, Retain & retest, Conditional repair, Recall & re-plan, quarantine, block, or verification work according to dependency and risk. Selective reconciliation preserves valid work.
  9. Workers return evidence. Scoped local and remote workers execute sealed orders through mediated tools, then return logs, artifacts, claims, hashes, and cited support in an immutable envelope. Workers produce evidence, never authority.
  10. Claims are evaluated. Returned claims enter Evidence-Backed Reality Graph as proposals and receive claim-type-specific verification, contradiction tracing, and consumer fan-out. A passing tool result is evidence, not an official side effect.
  11. The official commitment gate checks current outputs. The manager validates evidence, authority, allowed paths, policy, poison state, cancellation state, and current epoch, and commits in one atomic versioned transaction; there is no separate check-then-advance window. Stale or unpermitted output is retained as evidence and denied commitment.
  12. Epoch N+1: revised sealed orders issued. The official ledger decision advances Epoch N+1, invalidates stale orders, and issues revised current sealed orders back to Active Execution Graph. The return edge closes the maintained-plot loop without creating a worker-to-official-state or evidence-to-intent shortcut.

Epoch N+1: revised sealed orders issued

Ratified Intent Graph.

Requirements, constraints, goals, budgets, acceptance criteria, and decisions that have authority for a defined scope. A wiki edit can propose intent without ratifying it; a source policy determines whether a human gate is required.

Evidence-Backed Reality Graph.

Current implementation state, tests, runtime behavior, benchmarks, source snapshots, contradictions, and confidence. Every consequential claim retains support records and can be disputed or poisoned without rewriting history.

Active Execution Graph.

Plans, tasks, worker runs, builds, repair work, merge ordering, and dispositions for the current epoch. It is a versioned, rebuildable projection over the ledger; it cannot grant itself authority.

Immutable Evidence and Command Ledger.

Artifacts, tool events, manifests, decisions, ratifications, side-effect records, and epochs explain why the plot changed. The ledger is the canonical mutation history: Ratified Intent, Evidence-Backed Reality, and Active Execution are versioned, rebuildable projections over it, each carrying the schema and reducer version used to build it. If a projection disagrees with the canonical sequence or with another projection, official commitment pauses until the projections are rebuilt and their graph roots agree; the newest view does not win. The ledger makes supersession inspectable instead of destructive.

The latest ratified authority record wins only within its relevant scope; earlier records remain legible.