Entry gate
Deploy’s exit: context matching BOM hashes, monitoring live, obligations registered with the silence watchdog, kill switch tested.Standard work
Five permanent duties:- Telemetry return. All trajectories return to storage; a daily loop mines sessions for lessons and reflects improvements back into the repo. Audit data and eval data are the same data viewed through different lenses — production traces become eval cases.
- Per-run learning, with the graduation rule. A lesson appearing across multiple run files gets baked into the standard work — a germline change, full gates — and the learning files that taught it are retired.
- Re-certification on expiry or trigger. A model swap reopens every certificate that binds that model; the BOM makes this a query, not an investigation.
- Recall. Kill switch, root cause via Five Whys — reserved for escaped defects, where the investigation earns its cost — fix applied to the die (germline), not the unit, then re-issue.
- Silence monitoring (Thesis 3): starvation alarms, effect watchdogs, expected-artifact monitors — the second andon wire, live at all times.
Exit gate
None — that is this station’s definition. The only way off the line is deliberate decommission: access retired, obligations deregistered, lessons folded back into standard work. A unit that merely stops being talked about is not decommissioned; it is a ghost, and the watchdog files it as one.Escalation
Silence escalates itself. A missed artifact, a starved queue, an effect that failed to appear — each rings the andon at the same volume as an explicit error, opens an issue against a named owner, and stays open until the artifact returns. An already-ringing andon is still a violation: the light stays on.Enforcement
Two rows of the compilation table land here:- Row 10 — the silence andon:
watchdog/silence-watchdog.py, the effect watchdog. It never asks whether a process ran, only whether the artifact the process was obligated to leave behind exists and is fresh — a cron that ran is not a cron that worked. Each declared obligation carries a name, an owner, what its silence means, and an artifact or probe with a maximum age. Fail closed: an obligation the watchdog cannot evaluate is a violation, not a skip. - Row 11 — staleness and re-certification: the expiry sweeper — flags lapsed certificates; a model-swap trigger reopens affected BOMs. Scheduled in the construction plan; the certificate expiry fields it sweeps are already the standard.
Self-audit
| Claim | Source |
|---|---|
| No exit gate because no exit; the five duties (telemetry, learning, re-cert, recall, silence) | docs/factory-design.md:154–160 |
| Audit data and eval data are the same data; traces become eval cases | docs/factory-design.md:156 |
| Graduation rule: repeated lesson → germline change, learning files retired | docs/factory-design.md:157 |
| Model swap reopens every binding certificate — query, not investigation | docs/factory-design.md:158 |
| Five Whys reserved for escaped defects; fix the die, not the unit | docs/factory-design.md:159 |
| Rows 10–11 of the compilation table | docs/factory-design.md:203–204 |
| Watchdog mechanics: effects not executions, owner per obligation, fail closed, light stays on | watchdog/silence-watchdog.py (module docstring) |