Entry gate
Deploy’s exit: context matching BOM hashes, monitoring live, obligations registered with the silence watchdog, kill switch tested.Standard work
Five permanent duties:- Telemetry return. All trajectories return to storage; a daily loop mines sessions for lessons and reflects improvements back into the repo. Audit data and eval data are the same data viewed through different lenses — production traces become eval cases.
- Per-run learning, with the graduation rule. A lesson appearing across multiple run files gets baked into the standard work — a germline change, full gates — and the learning files that taught it are retired.
- Re-certification on expiry or trigger. A model swap reopens every certificate that binds that model; the BOM makes this a query, not an investigation.
- Recall. Kill switch, root cause via Five Whys — reserved for escaped defects, where the investigation earns its cost — fix applied to the die (germline), not the unit, then re-issue.
- Silence monitoring (Thesis 3): starvation alarms, effect watchdogs, expected-artifact monitors — the second andon wire, live at all times.
Exit gate
None — that is this station’s definition. The only way off the line is deliberate decommission: access retired, obligations deregistered, lessons folded back into standard work. A unit that merely stops being talked about is not decommissioned; it is a ghost, and the watchdog files it as one.Escalation
Silence escalates itself. A missed artifact, a starved queue, an effect that failed to appear — each rings the andon at the same volume as an explicit error, opens an issue against a named owner, and stays open until the artifact returns. An already-ringing andon is still a violation: the light stays on.Enforcement
Two rows of the compilation table land here:- Row 10 — the silence andon:
watchdog/silence-watchdog.py, the effect watchdog. It never asks whether a process ran, only whether the artifact the process was obligated to leave behind exists and is fresh — a cron that ran is not a cron that worked. Each declared obligation carries a name, an owner, what its silence means, and an artifact or probe with a maximum age. Fail closed: an obligation the watchdog cannot evaluate is a violation, not a skip. - Row 11 — staleness and re-certification: the expiry sweeper — flags lapsed certificates; a model-swap trigger reopens affected BOMs. Scheduled in the construction plan; the certificate expiry fields it sweeps are already the standard.