Operator Method

Models advise. Gates decide.

Hard promotion hold. Policy outside prompts. Memory consolidates. Fail-closed invoke. External scores never promote.

Waves 2–5 · website 8.4.17

Cheap path when it meets. Command, not merge. No actuation. C4 cannot self-promote.

Wave 2 keeps the cheap routing, memory, retrieval, and cache methods when they meet acceptance. Wave 3 seats one authorized workflow each for Veloce, EngOS, VEMO, and MSP — tickets, not merged records. Wave 4 is a spatial probe, restore drills, and read-only twins. Wave 5 verifies playbooks before PEFT. Kernel stays 8.4.9 atlas-join. UAOP stays 8.4.6. C4 Recur is not shipped and cannot self-promote.

Routing · memory · retrieval · cache. Keep cheap when it meets.

HAVE

Wave 2 · ablations

Keyword primary vs overlay. Last-N vs hybrid shadow. Local pack vs portal analogue. TTL Map vs ETag. Cheap wins when pinned recall, required evidence, TTL, and tenant isolation hold.

Never: No hosted vector DB. No CDN worker claimed. Analogue ≠ native.

Open

Veloce freshness · EngOS rewrite desk · VEMO gated publish · MSP change window

HAVE

Wave 3 · four authorized workflows

One workflow each. Origin hop sits Hold until approved. skipHitl cannot open Hold. Records stay on the partner that owns them.

Never: Command, not merge. Dual-write refuse. Authors never grade themselves. Ticket close is not restore evidence.

Open

XR probe · dry-run restore · read-only origin hashes

HAVE

Wave 4 · spatial / restore / twins

Immersive-vr probe only. Restore drill stores a checksum projection. Twin writes refuse. F26–F32 / F36 / F47 will not fire.

Never: No actuation. No Vision Pro badge. Twin ≠ live origin. Live restore refused.

Open

Author ≠ approver · handshake · adapter supply check

HAVE

Wave 5 · verified playbooks → PEFT

Playbook digest + evidence + regression first. Then a recorded handshake. Then Adapter Supply Check. Promote remains F08.

Never: C4 Recur cannot self-promote. Unverified playbook cannot authorize an adapter. Silent merge refused.

Open

Residuals that stay named

C4 Recur remains exploration_not_shipped. Not a Sage tier. Not skipHitl. Cannot self-promote.
F26–F32, F36, F47 actuation are not in this kernel.
HMAC ACK analogue is not pinned A2A protocol conformance.
Public five-lens tool is ANALOGUE. Private examiner is the release gate.
M04–M16, M18, M22–M53, M55–M64 stay blank. No synthetic 0.7 / 0.9 / 2.21×.
Analogue ≠ native. Isolation Score is a local canary, not an air gap.
No ARR. No SOC 2 / ISO / HIPAA letter. Not fleet-scale system-of-record.
Kernel / app / CLI stay 8.4.9 atlas-join. Website 8.4.19 is the pack, not a kernel bump.

Wave 1 · website 8.4.16

Same denied operation. Same audit decision. Promote is F08.

A2A, CLI, and cron share pepForDoor with invoke. Author ≠ approver. Regression-backed GAP close. Public analogue ≠ private examiner. A revoked grant cannot authorize a commit. Kernel stays 8.4.9 atlas-join. UAOP stays 8.4.6. C4 Recur is not shipped.

pepForDoor on invoke · A2A · CLI · cron

HAVE

F17 · one PEP, four doors

Same denied email is a deny on every residual door, with one audit decision. Skills map onto tools so Hold patterns fire equivalently.

Never: HMAC ACK is not A2A protocol conformance. skipHitl cannot open Hold.

Open

Digest-bound promote after Hold

HAVE

F08 · PromotionDecision

Author ≠ approver. Code, dataset, policy, and evidence digests ≥ 8 chars. Stale priorDigests refuse (M19 accepted-stale = 0). Isolation refuse and eval leak block.

Never: Promote is not a Sage band. PTG2 / UCAS / promotionOk never stamp a ship.

Open

Regression-backed close · M54 recurrence

HAVE

F13 · GAP fingerprints

Close without evidenceDigest + regressionSuiteId is unverified. The same causal fingerprint reopening is recurrence, not a new vanity hole.

Never: A ticket-close count is not M54. Cap eviction must not erase closed history.

Open

Private release gate · hidden refs

HAVE

F14 · examiner depth

Hidden refs stay out of the prompt. Leak or self-grade blocks deploy. Consistency is pass^k, not a leaderboard.

Never: Public five-lens tool is ANALOGUE. pass@k is not pass^k. Authors never grade themselves.

Open

Live grant at commit · secondary-path isolation

HAVE

F21 · commit-time revocation

A revoked or expired grant cannot authorize a commit. Cache, export, trace, and backup stay tenant-bound. M20 disclosures = 0 on the declared suite.

Never: A tenant-prefixed path is not isolation. Filename is not identity.

Open

One enum · three vocabularies

Hold can fire at any C-band. Promote is F08 after Hold.

Do not use C-band and verdict as synonyms. Humans sit Steer and Hold. Recur writes the lesson after the hold, not instead of it. C4 is not in the enum.

usage-bands since 8.4.14

Operator-visible

C0 Observe
C1 Advise · Assist
C2 Steer · Act
C3 Hold

Six bands on one runtime. Not six SKUs. Not a vendor gallery.

verbs, not verdicts

Manual F21

C0 observes
C1 drafts
C2 stages for confirmation
C3 acts only inside a bounded envelope

Hold can fire at any C-band. Recur writes the lesson after the hold, not instead of it.

per-invoke verdict

decideHitl

auto
interrupt
refuse

Verdict is not a renaming of C-band. skipHitl cannot open Hold.

Honest residuals

What this pack does not claim.

C4 Recur remains exploration_not_shipped. Not a Sage tier. Not skipHitl.
F26–F32, F36, F47 actuation are not in this kernel.
HMAC ACK analogue is not pinned A2A protocol conformance.
Public five-lens tool is ANALOGUE. Private examiner is the release gate.
M04–M16, M18, M22–M53, M55–M64 stay blank. No synthetic 0.7 / 0.9 / 2.21×.
Analogue ≠ native. Isolation Score is a local canary, not an air gap.
No ARR. No SOC 2 / ISO / HIPAA letter. Not fleet-scale system-of-record.
Kernel / app / CLI stay 8.4.9 atlas-join. Website 8.4.19 is the pack, not a kernel bump.

Sage C0–C3 · six bands

Humans sit Steer and Hold. Not every hop.

Six bands on Sage C0–C3. They are not six SKUs and not a vendor gallery. HITL that queues every gated hop is a design failure. Models advise. Gates decide. Humans sit Steer and Hold. Promote is F08, not a Sage band. Manual F21: C0 observes / C1 drafts / C2 stages / C3 acts only inside a bounded envelope. decideHitl verdicts are auto|interrupt|refuse — not a renaming of C-bands.

Assisted perception. No side effect.

HAVE

C0 · Observe

Why — Scoring is not a ship stamp. Forethought names holes before expensive compound. When — Truth Gate read, Isolation Score canary, dashboards, Kernel CHECK. How — Auto. No tray. C0 observe.

Never: A green cell is not Done.

Open

Paper act. Insights, not live writes.

HAVE

C1 · Advise

Why — Advisor overlay without a consulting SKU. Simulations stay paper. When — Dream Brief, SAT Forge, TAC paper-first, draft VEMO copy on origin. How — Auto + decision log. C1 paper.

Never: Live capital. Live publish.

Open

Human does the job. TUCE speeds the cheap path.

HAVE

C1 · Assist

Why — HBR tool-as-instrument recast. The operator stays the actor. When — Route Lattice, Prompt Forge, Conductor drafts, token ledger. How — Auto if policy passes. No tray.

Never: AI as the manager of the desk.

Open

Mid-run intercept. Confidence-gated HITL.

HAVE

C2 · Steer

Why — MIT HITL recast: humans override sensitive decisions — not every hop. Exponential trays fail. When — Truth conflict, FLAG, origin hop, spend over cap, confidence below 0.65, interruptBefore nodes. How — Tray only here. Dual-authority still required on privileged.

Never: A human rubber-stamping a thousand gated tools.

Open

Automate the repetitive. Policy sat once.

HAVE

C2 · Act

Why — Deloitte automate recast. Schema-valid, same-origin, non-destructive work does not need a person. When — Gated tools after control-plane + examiner. Gate Tracer hops. Command bus. How — Auto + decision log + Afterthought writeback. Gated ≠ human.

Never: Unattended VEMO publish. Unattended live capital.

Open

The only runway that ships sits a person. Promote is F08 after Hold.

HAVE

C3 · Hold

Why — Microsoft autonomous and PwC decision-maker recast as a hold, not unattended ship. HBR manager is the seated operator, not the model. When — VEMO publish, live execMode, privileged admin, PHI-adjacent, origin merge, factory sage gate. How — Dual-authority ∩ examiner ∩ HITL. skipHitl cannot open this. Recur writes the lesson after the hold, not instead of it.

Never: Capability as a ship decision. skipHitl on Hold. Promote as a Sage band. C4 as a sixth SKU.

Open

Brass inlay of three routing stations on black marble.

Fail-closed invoke

Privileged acts do not fire on vibes.

Privileged acts run health, policy, injection, schema, and cost before they fire. Liveness is not readiness. Critical injection always blocks. Cognition menus are the operator UI over that plane — not a narrative layer over a missing runtime.

Station

Health

Liveness ≠ readiness. Alive is not ready to promote.

A heartbeat is not a ship stamp. Fail-closed if readiness is missing.

Play Readiness Lens

Highest-leverage home: Truth Gates + Agent OS + the tools bus. Protocol UAOP 8.4.6. Not a fourteenth product called Control Plane.

Nine-station cognitive loop

Promotion is a gate.

Hard promotion hold is the default. Refuse is first-class. A completion verifier rejects bare “Done.” Press a station.

Station

Routing

Pick the path. Cheap first. Compound when residual risk demands.

API and open-source models are traffic. Framework-agnostic: your graph can sit underneath. TUCE governs which lane is allowed to run — not which library you wrote the graph in.

Play Route Lattice

Private examiner

The suite is the definition of correct.

The private examiner captures a trajectory as an incident. The suite becomes the definition of correct. Models can swap. External scores never promote.

The floor explains itself: inline help, journeys, protocol. Operators are not dropped into a mute board.

MCP ≠ Skills ≠ promote

MCP is how TUCE talks to doors. Optional. Tenant-bound. Same isolation, budgets, dual-authority, and policy as native invoke. Skills are how TUCE remembers how a job is done. Playbooks, not a public GMV marketplace, not Claude Skills, not Linear. Neither MCP nor Skills bypasses promotion hold. Models advise. Gates decide. The 6-step massive-document rewrite is an EngOS/VEMO playbook, not a shipped TUCE compiler, not a SNARK. Family-wide live MCP is not claimed. Veloce has an MCP analogue.

Doctrine

Models advise. Gates decide. Capability is compounded by multi-model routing and truth-layer consensus. Action is gated. Isolation is the default. Refuse is not a failure — it is the product working. Hard promotion hold is the default. Refuse is first-class. A completion verifier rejects bare “Done.”

Where it sits

Above the developer’s graphs and below the enterprise security boundary. Framework-agnostic. LangGraph and CrewAI can sit underneath. TUCE governs what they are allowed to promote.

Dual-authority

Privileged acts require the human or session principal and the agent identity to independently authorize. Missing either fails closed. Confused-deputy is a deny, not a log line. A-BOM attaches to the run.

Policy-as-code

Policy lives outside the prompt. RBAC/ABAC on every tool. Authorize every request. Guard-before-privileged: named policy packs run before mesh / Agent OS privileged acts. On-behalf-of audit: human + agent + tenant on every privileged act.

Memory consolidates

AutoMem / CoALA. Afterthought writes lessons back to memory, routing, and Flywheel. History is not a feature if it is not distilled. Token-pressure GC, branch-scoped routing, checkpoint hydration.

Partial coverage

Partial-coverage honesty. The unified index does not pretend it saw the whole world, and it does not permanently dump the open web.

Foundation under the kernel

A durable tenant store, isolation, and metering sit under the kernel so promotion physics cannot be bypassed by a missing organization id.

Gates

A gate is a check that must pass before work leaves the floor: Steer/Hold, consent, spend, origin isolation. Observe/Advise/Assist/Act do not mint a tray. Chat cannot self-approve a publish on VEMO. Authors never grade themselves on EngOS.

Refuse

The factory will refuse a bad send. Kill maps, twin confirm, spend caps, TCPA and consent default-denied live on the VEMO origin. TUCE records the refuse as writeback, not as a silent skip.

HITL

Human-in-the-loop is Steer and Hold — not every gated hop. Observe, Advise, Assist, and Act auto-run under policy-as-code and write a decision log. skipHitl cannot open Hold (publish, live capital, privileged admin). If no operator is seated, Hold stays closed. Exponential approval queues are a design failure.

Paper-first markets

Paper-first markets. Live capital is denied by default. Clear water only. Not a trading bot. Not investment advice.

Resilience

Token-bucket → pattern breakers → fallback chain → session snapshot / rollback. Fail smaller: cheaper model, cache, or reduced scope. Not a crash.

Origin isolation

Isolated origins. Shared command. No silent data merge. PHI, raw trading advice, tenant records, and wholesale orders stay on the partner that owns them.

Engines, not certificates

STRIDE and Statement of Applicability are engines on this origin — Threat Weave and Applicability Map. They are aligning work, not ISO or SOC 2 certificates. Cost × latency Pareto is Efficiency Front. None of these are visitor-count proofs.

Localization

English-first. Localization is a method note, not a shipped locale pack.

Atmosphere

Dark-only v1. No light mode yet. Hormone bands on the UAOP floor are operator atmosphere — not a medical device, not a clinical signal. Protocol UAOP 8.4.6.

Simulation vs live

Marketing stills and maps are labeled analogue. The console on this origin is the live floor. Sibling partners are live on their hosts. Tools that analogue a kernel, vendor feed, or SNARK say so in-tab.