The Brain · TBK Labs

Purpose · Why

Every project accumulates hard-won knowledge — rules, thresholds, playbooks, lessons. The bet of The Brain is that in an era where LLMs make execution cheap, the durable advantage is whether that knowledge is actually applied at the moment of work. Not stored. Applied.

The problem: consultation, not construction

The counter-intuitive finding that reframed the whole program: a brain can be sophisticated and still be worth nothing if the model never consults it. The pilot is Maximus, Ecomma's marketing brain — a ~570-file knowledge bank, a 147-item deliverable catalog, and a ~900-line router. On paper, world-class. Measured against its own audit of real tasks, it scored (frozen 2026-07-05 "before" baseline; the pilot's current state lives on the Brain Health tab):

brain-use across audited tasks (0 of 27) under prose-instruction routing

3.9%

learning-use rate, despite learnings being injected every turn

147

deliverables in a catalog the router almost never reached

Construction was solved. Consultation was not.

Root cause — three structural failures

Prose routing the model skips. "Consult the doctrine" as an instruction is advisory; the model rushes past it.
A router that never runs live. The routing logic existed as code and docs but was never invoked on a real turn.
Non-blocking nudges nobody reads. Verifier hints were emitted but unread and unenforced.

And the sharpening nuance: learnings were already injected mechanically every turn, yet outputs still didn't cite or apply them. So injection ≠ application — putting knowledge in the context window is necessary but not sufficient. A citation contract plus blocking gates are load-bearing.

The design law that follows

Consultation must be structural — hook injection, deterministic routing, blocking gates, generated artifacts. Prose is banned as a routing mechanism. "Prose is not a router" is the first rule of the standard, and every anti-pattern is a way of violating it.

What "done" means

Files existing is never done. Done = a person can (1) inject the Brain kit into any project, (2) watch the LLM actually consult the brain on real work, with evidence, (3) see brain health live on a dashboard from any machine, and (4) run a defined uplift process on weak areas.

Who it's for

The models that consult brains across every project — the primary reader of a route card is a model, not a person.
Kit adopters — the conformance levels C0–C3 are the contract a project builds to.
Future operators — anyone (often a future session) picking a project back up needs the brain to be legible and live.

Strategy

Three interleaved tracks: prove the fix fast on a pilot, formalize it into an injectable standard, and converge on a live, measurable system.

Track 1 — Enforcement quick-win

Put structural consultation surfaces on Maximus's existing router/catalog as-is, to move the 0% baseline fast. Freeze the baseline → harden measurement → add a SessionStart digest + a per-prompt route card → then gates and nudge-consumption.

Track 2 — Standard + injectable kit

Author the normative spec, core vocabulary, template, and hub registry; extract the reference router into a reusable engine behind a byte-comparable compatibility gate; stand up the hub and a conformance fixture.

Track 3 — Convergence + dashboard

Align the pilot onto the standard manifest; deploy the live Brain Health dashboard; run a two-week "after" window; evaluate against day-30 success criteria.

The standard as moat

Anyone can generate code and content. Quality — the right knowledge, applied — is the advantage that compounds. Formalizing the brain as an injectable, measurable standard is what turns a set of one-offs into a moat that every project inherits.

Topology — one home, doors where needed ADR-0086 + ADR-0087 · ratified 2026-07-30 · migration COMPLETE — 6 of 6, fleet-wide

One canonical home. The Brain repo's git history owns the content of all seven registered brains — the whole knowledge estate browsable, greppable, and editable in one clone. Ratified 2026-07-30 (ADR-0086; scope completed same-day by ADR-0087, which resolved the open operator override by bringing OCC's tbk-arsenal in with a door at ~/projects/Organizing-Claude-Code/brain), superseding the earlier hub-for-shared-only topology (ADR-0046 lineage). The migration runs smallest-first and is underway: all six landed 2026-07-30 to 08-02 — each step gated on a consumer sweep + no-regression conformance and independently verified by a fresh-context refuter, and every machine in the fleet now carries its doors; the registry never claims a location that isn't yet true.
Where a project's machinery consumes its brain in place (Maximus, Dashboard KB, video-craft, and OCC's tbk-arsenal), the old project path becomes a door — a checkout of The Brain repo mounted there: one git history, two access points, synced on the hourly autosync cadence. Four doors in total.
Still no copying. A door is never a second copy, and duplicating brain content into a project remains a bug — no two-way copier exists anywhere in the design, because reconciliation over git working trees silently destroys real edits. (Maximus once copied ~200 files from the shared Dashboard Knowledge Bank — the cautionary tale the standard was written to prevent.) Federation mechanics are unchanged: spokes still federate hub-module manifests and read content in place; only location resolution moves.

The pilot & day-30 success criteria

Maximus carries a frozen, checksummed "before" picture and a locked ground-truth route set, so the "after" is measured, not asserted:

Metric	Target
Application rate (knowledge actually applied)	≥70%, from 0%
Dispatch-coverage rate (mechanical — cards delivered, not reads)	≥95%
Learning application	≥50%, from 3.9%
Fabricated citations	<2%
Routing quality on golden routes	split by surface: the cheap card measured by recall (≈0.38–0.48 on the current corpus); ≈0.71 was the opt-in rerank path, not the cheap card resolved — see below
Golden prompts passed	15/15
Added latency / injected overhead per turn	≤1.5s p95 / ≤2.5K tokens
Quality delta, routed vs unrouted	≥ +1.0 / 10
Safety-rule escapes	zero

An honest fork — resolved the honest way

The ≥0.8 routing gate turned out to be unreachable by the deterministic hot-path router — the golden labels are semantic judgments ("this campaign is profitable, scale it" → a margin-threshold rule), which keyword matching can't reach (best deterministic F1 ≈ 0.14; candidate ceiling ≈ 0.33). The ratified resolution split the metric by surface: the cheap deterministic card is measured by recall (a right chapter surfaces ≈38–48% of the time on the current 601-chapter corpus — and fixed-k lexical recall drifts down as the corpus grows; the ≈71% figure was the opt-in LLM rerank layer at candidate depth 10–30, not the per-prompt card), and ≥0.8 precision is reserved for a future dense-retrieval first stage rather than pretended at. The per-turn hot path stays deterministic and ~21ms. A ratified 2026-07-14 program direction moves the hot path to hybrid BM25+dense retrieval behind a shadow-mode recall gate.

How it works

Two pipelines. The consumption pipeline below answers a project's question from the brain. The production pipeline further below fills the brain with new content. They are separate jobs and they are siblings, not duplicates.

Source (bank + federated hub) → generated catalog → tiered deterministic router dispatches a card → the engine emits a read-receipt when a section is actually fetched (dispatch ≠ read ≠ application). The catalog also feeds a deterministic health scan → the live dashboard.

Production pipeline — how content arrives in the brain

The diagram above shows consumption: a project LLM reads from a brain that already has content. Production is the separate pipeline that fills the brain in the first place. It runs daily on a scheduled service and lands candidates in a Google Doc per brain; Google re-ingests the Doc into NotebookLM, where the brain's content lives.

The 10 plain-named stages of the production pipeline that runs daily to fill the brain. Steps 1–4 are deterministic and run on a CPU (no model). Steps 5–6 use paid LLM providers (one for relevance, a different vendor for ranking — never the same model grading itself). Steps 7–9 enforce capacity and observability. Step 10 is the destination: Google's auto-reingest into the brain's notebook.

Out of scope on this tab

Detailed failure modes (feed 404s, model 402s, reingest lag) live in the brain-scout docs, not on the standard overview. The standard overview shows what the pipeline is; the brain-scout docs show what to do when it breaks.

1 · Author & tag — co-located

Knowledge is version-controlled markdown. Facet tags live in the content at five granularity levels — collection, document, section, atomic, asset — plus a manifest "playbook" type. Tag maps maintained separately in code are banned: the tag and the knowledge travel together.

2 · Generate the catalog

An engine compiles the co-located tags into one canonical manifest.json (the catalog). Human-readable indexes and HTML are demoted to generated views; playbook recipes compile into the manifest. There is one source of truth — hand-maintaining a parallel index is a banned pattern, and hand-editing generated output fails the staleness check.

3 · Route — tiered, deterministic on the hot path

Tier	Mechanism	Budget
T0	SessionStart hook injects a brain digest + rules + health warnings	≤1.8K tok, ~0 latency, fail-open
T1	Catalog-guided fetch — a manifest slice guides which files to read	≤4K tok payload
T2	Coded-ID grep — a declared id prefix resolves to an exact section	≤1K tok, <1s, no LLM
T3	Deterministic facet filter → LLM rerank of a small slice → grouped picks	1 LLM call, ≤~10s
T4	Semantic / graph fallback — only on a measured recall miss	escalation only

The per-prompt hot path is deterministic only: a gate on every user prompt normalizes the ask, runs the deterministic tiers, and injects a route card — matched deliverables with a confidence, 2–5 governing paths the agent may fetch (fetching a section emits a read-receipt — dispatch ≠ read), any safety rules verbatim, and a route id. The tier-3 LLM rerank never rides the hot path; it is invoked by skills/gates. Hot-path overhead stays ≤~2.3K new tokens and ≤300ms added latency.

The structural-enforcement law

Consultation must be a structural surface. These mechanisms are non-conformant: prose instructions as the only surface; a router that exists but never runs live; "a tool the agent is supposed to remember to call" (the honor system); any surface that emits no receipt; and hand-maintained routing indexes.

No receipt, no route. Every route emits a dispatch receipt to a per-brain log — the substrate for the mechanical dispatch_coverage metric (a card was delivered, not that it was read). A proven read is a separate content-read receipt, and application a third; the operational grade O0–O3 reads all three. A raw file read that bypasses the structural surface leaves no receipt and does not count.

4 · Honesty invariants (at every tier)

Real paths only; hallucinated ids are dropped with a note.
No silent truncation; mid-file truncation is banned — injection is item-granular.
Staleness is reported, never silent.
When there is no confident route, the card says so explicitly rather than inventing one.

5 · Conformance — C0 → C3, cumulative

Level	Means
C0 · Cataloged	a brain contract + tagged bank + generated manifest + a health contract
C1 · Structured	section/atomic tags, coded IDs declared & extracted, lint green, tag coverage ≥ floor (90%)
C2 · Routed	router config + an eval suite + tier-3 operational + route receipts emitted
C3 · Federated	hub federation proven end-to-end — resolve, compose, scope filters, staleness honesty

A level claim without a passing conformance-run artifact has not been achieved. "A conformant brain = bank + catalog + router + health" — all four, at every level.

6 · Federate — hub modules, in place

Spokes pin hub modules and import their manifests (never re-parsing hub content), namespacing ids and rewriting to resolved paths. Fetches read hub files in place — no copy is written anywhere. Scope tags gate export: only knowledge marked shareable leaves a project; project- and client-confidential knowledge never federates.

7 · Health & hygiene loop

A deterministic scanner (no LLM) emits a per-brain health record plus an append-only history. Per category it tracks coverage, orphans, broken paths, duplicates, staleness against an SLA, and lint — rolled into a deterministic Hygiene score (0–100). A separate LLM-judged Quality score is cached honestly with its scored-at date. The dashboard reads these live, and an uplift process turns weak cells into playbook runs. Staleness is structurally visible — a dashboard that silently shows old numbers is a banned pattern.

Components

The individual pieces — the standard, the engine, the hub, the pilot, the conformance suite, the dashboard, and the injectable kit.

The 7 normative documents

Doc	Defines
Brain Standard	the anatomy — repo roles, per-project layout, the 4 required components, id conventions, the brain contract
Tagging Core	the 9 core facet families, per-level required-tag floors, controlled-vocabulary governance, domain packs, extension escape valves
Router Tiers	tiers T0–T4, honesty invariants, route receipts, the adaptive depth ladder, the deterministic hot path
Data Contract	21 versioned schemas, each with a commented example (was misprinted as 20 until the 2026-08-12 UX review; the Standard tab and the 2026-07-14 changelog entry are authoritative)
Hub Topology	one-home centralization with doors (ADR-0086 + ADR-0087), the registry, scope export control, staleness honesty; mirrors remain only as the legacy pre-migration form
Anti-Patterns	the 16 banned failure modes, each with real evidence and its conformant alternative
Conformance	levels C0–C3, the 38 mechanical checks, and the verdict artifact

Core vocabulary

9 facet families with seed values, per-level floors, a 90% coverage floor, and extensible-facet flags. The families include domain, audience, deliverable (the intersection axis), content-type, task-intent, maturity, source-authority, freshness, and scope (which governs federation).

Scaffold template

The skeleton the scaffold copies into a project: a brain contract, an example tagged doc, a project vocabulary importing core, empty hub deps, a starter router config, an eval case, health dirs. It satisfies its own C0.

The router engine

One reusable, path-parameterized engine (build-manifest, filter, rerank, route, health, eval, and more). Brains hold configuration only — a brain never vendors its own engine. Extraction was gated by reproducing the reference catalog byte-for-byte and passing its eval 75/75.

The hub & registry

A registry maps module → location + pins, and today registers a cross-domain fleet of 7 brains — spanning knowledge dashboards, presentation craft, video craft, marketing, an arsenal of curated primitives, and automotive engineering. Every one is a conformant brain, shown in full on the Brain Health tab; federation reads their manifests, never their files.

The pilot — Maximus

Ecomma's marketing brain: a frozen, checksummed "before" baseline and a locked ground-truth route table (golden prompts + deduped real tasks, with negative cases), so precision/recall is measured against fixed truth.

Conformance suite

A deterministic runner (--level C0..C3) executing 38 mechanical checks and emitting a verdict artifact — composed with an engine-backed execution pass + a hash-bound attestation so verdicts above C0 are earned, not claimed (the Dashboard Knowledge Bank earned the first live verified C2 on 2026-07-13; current claim-vs-verdict for every brain is the Brain Health tab, since a bank edit drops a brain a rung until the execution half is re-run). Its living fixture is a toy brain that federates both hub modules end-to-end.

Brain Console

The served operator surface, rebuilt 2026-08-23 (ADR-0122): a zero-dependency server reading each brain's record live at request time (no baked snapshot), now a tabbed console with five views (Fleet Health with a per-brain drawer and 30-scan history charts, Pilot & Measurement with the frozen baseline and evaluation rounds, Activity with scan-to-scan deltas and registry freshness, Fleet Map, Registry & Standard) over the two-hourly fleet bundle, polling every 60s and printing honest scan age. The Brain Health tab here is its public rollup; the served console is the operator's view — brain.tbk-labs.dev.

The injectable kit

Skills (router + ingest ship today; scaffold, curator, health, eval, learn are planned) and hooks (a SessionStart brain digest, a manifest-rebuild gate, a consult gate — planned; a repo write-guard is what's wired so far) that install into any project and cascade from one curated source.

Knowledge graph · fleet map

How The Brain's knowledge connects across the fleet, generated straight from the hub registry. The Brain (centre) is the single git owner of every registered brain; each project consumes the brain it uses in place through a door — a checkout of this repo mounted at the project's path, never a copy. Drag any node; hover for detail.

The Brain (hub owner) Brain (colour = conformance) Consuming project Companion ledger owns door (consumed in place) companion

Standard · the normative spine

Five design laws, twenty-one versioned schemas, sixteen banned anti-patterns, thirty-eight executable conformance checks — and a set of ratified decisions behind them.

The 5 invariants

Prose is not a router — consultation must be structural.
No hub-content copying — federate at the manifest level; a copy is a bug.
One canonical generated catalog — hand-maintained indexes are banned; generated output is never hand-edited.
Honesty invariants — real paths only, no silent truncation, staleness surfaced.
Health & liveness at every level — served live, scan age shown, no baked snapshots.

The 21 schemas (shapes)

brain-itembrain-manifestbrain-healthhygiene-score brain-vocabhub-depsroute-receiptbrain-contract router-configeval-casesbrain-playbookapply-ledger fleet-bundlehub-deps-lockroute-indexhealth-line hub-registryregistry-localconformanceengine-attestation content-read-receipt

Each is versioned and carries a commented example in the data contract. The hygiene score is a single deterministic formula (weights across coverage, integrity, dedup, freshness, lint, reachability), pinned by golden vectors so every brain is scored the same way.

The 18 anti-patterns

AP-1 wholesale knowledge dumps into context · AP-2 tag maps maintained in code, not co-located

AP-3 silent mid-file truncation · AP-4 a documented router that never runs live

AP-5 prose-only routing — the 0% mechanism · AP-6 per-project copies of hub content

AP-7 hand-maintained catalogs · AP-8 baked-snapshot dashboards that silently rot

AP-9 non-blocking nudges nothing reads · AP-10 a non-deterministic surface on the deterministic path

AP-11 dual health producers / builder self-scoring · AP-12 fail-open federation filters

AP-13 federating a broken module · AP-14 machine-dependent (absolute-path) content hashes

AP-15 silent transitive federation · AP-16 citation-coercing route cards (Goodhart bait)

Each anti-pattern is the negation of a stated law — a coherence gate checks that mapping mechanically.

How the standard changes

Forks go through interactive decision pages and immutable decision records (ADRs); every anti-pattern is checked against its law by a coherence gate. The dated history — what was ratified, which schemas were added, how the counts moved — lives in the Changelog tab, so this spec always reads as the current state rather than a diff.

Brain Health · live fleet

A public rollup of every registered brain's hygiene. Refreshed every 2 hours; the banner shows the scan age — if a refresh ever lapses, it turns amber rather than silently showing stale numbers (the standard's own liveness law, applied to a static page).

Roadmap · status

The standard is shipped, the engine implements every ratified bundle, the hub federates a real spoke, the fleet is 7/7 on the uniform corpus layout, and the live dashboard shows runner-verified conformance verdicts. What remains is decision-gated convergence.

What's shipped is dated in the Changelog tab. This is what remains ahead, in the order ratified on 2026-07-30 (ADR-0088) — the evidence chain and the migration both closed (2026-08-10 and 2026-08-02), leaving the medium-term commitments, now ungated. The retrieval proof itself gained a runnable corpus of record on 2026-08-21 (ADR-0120): v3 frozen on the Legion snapshot, readiness true. Its first candidate evaluation ran on 2026-08-22 and rejected the frozen v2 retriever on every gate; the abstention port and the dense-retrieval spike are the open investments, and promotion stays unauthorized. The residual context-continuation class gained a designed-and-measured architecture the same day (2026-08-22): the resolver splits gate evidence from retrieval evidence after dev measurement falsified context injection into the gate; one fresh labeled holdout gates both that build and the parked fused stage; that holdout's round-2 set (87 rows, 50/37 after the snapshot's negative side proved honestly exhausted and the operator ratified the shape) was sampled the same night and sits on the labeling page awaiting ratification. And on 2026-08-26 the program's day-30 quality-delta promise was measured for the first time: knowledge routed into context is worth +2.23/10 against the promised ≥ +1.0 (12/12 wins, p = 0.00049), while the production routers delivered the governing doctrine for 0 of 12 realistic work prompts — the delivery layer, not the knowledge, is the binding constraint. The value experiment's action plan is now underway: verbatim safety-rule injection shipped (engine 1.3.0, ADR-0165), golden-task delivery conformance is ratified as an enforced C2 check whose executor and golden sets are the next build, and an engine-level dense stage stays gated behind that check.

Open — decision-gated

The route → read → apply evidence chain — DONE 2026-08-10 ADR-0088 · D2 — closed the same session as the catalog fix above. brain.read now returns the hashed bytes to the caller atomically with its receipt, reads validate fail-closed before any content exists, section resolution never widens, and an application verdict counts only when it cites the exact read it acted on (same route, item and content hash) — the O3 join is monotonic. Proven live on the pilot: one dispatch → read → hash-bound verdict → scanner-proved join (O3, 1 joined, 1 USED). The USED-rate baseline and the Access Plane extraction are ungated by it.
Drive real pilot usage to unblock the retrieval proof ADR-0088 · D3 — the v3 one-shot evaluation ran on 2026-08-22 and rejected the frozen v2 candidate on every gate; the round-2 holdout (87 rows: 50 positive-hint / 37 negative-hint) was sampled the same night under protocol v4's double exclusion and now awaits operator ratification on the labeling page. Genuine routed Ecomma work now feeds the next round rather than a blocked evaluation.
Brain centralization migration — COMPLETE 2026-08-02 (all six landed) ADR-0086 + ADR-0087 — the ratified one-home topology (all seven brains), smallest-first: tbk-setup ✓ · tbk-logs-scoring ✓ · tbk-arsenal ✓ (first door) · video-craft ✓ · Dashboard KB ✓ · Maximus ✓ — all six, mounting single-history doors at the four in-place consumer paths (Maximus, Dashboard KB, video-craft, and OCC's ~/projects/Organizing-Claude-Code/brain) and moving the rest wholesale with their manifest source_inputs re-pointed to the host repo. Each step gates on a consumer sweep + a no-regression conformance re-run (zero broken paths), and the three safety rails (git-clean guard, door doctor, autosync roster) land with the first door. Until a step runs, that brain still sits at its pre-migration location.
More enrichment batches via the penta-gated lane — the direct-authoring lane (author → a 5-vendor panel ratifies content quality → land co-located) is the standard now and has landed two modules on the pilot; Retail Media Networks is the next scoped module, with post-cookie/clean-rooms and CTV measurement behind it.
Pilot to C2 — DONE 2026-08-02 — the pilot is now verified C2, matching its claim. Nothing turned out to be missing from the brain: its router config and nine routing eval cases were already in place and green, but the execution half had never been run at its location, so no verdict artifact existed and the runner honestly refused to certify. Running it passed every check first try — 9/9 eval cases, T0 digest 773 ≤ 1800, an honest no-route on an unanswerable brief, and a live tier-2 coded-ID route receipt (deterministic, no model call needed). It also carries the program's first read-confirmed and applied evidence: one real dispatch → read → apply chain joined by route id and content hash. The lesson generalises: a brain can hold every artifact C2 requires and still read as C1 until someone runs the tests — and because the receipt is only fresh while the content hash matches, any bank change silently drops a brain a rung until the execution half is re-run.
Hybrid retrieval — and port the abstention gate to the pilot ADR-0088 · D4 — the scope / eligibility abstention gate now ships (the router abstains on out-of-domain prompts instead of manufacturing a pick; correct-abstention 40%→100% on the shared surface) as the first retrieval component, and porting it to the pilot is a ratified commitment. The larger build ahead is a hybrid keyword+dense first stage with a calibrated abstention gate on the hot path and a 100+ prompt golden set — it attacks the ≈38% recall (now measurable behind the Access Plane) and re-tunes this gate. The residual context-continuation class that no context-free gate can read now has a designed and dev-measured architecture (2026-08-22): the gate keeps the raw prompt plus a narrow action-continuation veto, the retriever takes the resolved query, and one fresh labeled holdout gates both that build and the parked fused stage. The 2026-08-26 value experiment gave this build its acceptance gate: the bench prompts that measured +2.23/10 of knowledge value saw 0/12 governing-doctrine delivery from today's routers, so a hybrid stage must deliver the governing chapter for at least 9 of those 12 before the delivery criterion can be called met. 2026-09-05: the fork is ratified (ADR-0168) and its dense stage is live on a real maximus index through an OpenRouter lane (ADR-0183); stage-1 measured lexical 12/16 vs hybrid 13/16 on 16 golden cases, with dense winning 3/4 of the natural-language prompts. Merged to OCC main and measured on 28 cases: dense-first at cosine 0.63 reaches 18/28 against the shipped rule's 15/28, and 10 of 16 natural-language prompts are never retrieved at all, so retrieval quality is the next lever. The rerank probe then ran the same day: a one-call Flash judge over dense's top-12 lands 10 of 16 natural-language leads, and a gate on query kind (facet brief to lexical, free text to reranked dense) scores 22/28 with no facet loss and no tuned constant. Open: the ranking-rule pick (decision page served, recommendation now the gate), then the day-30 re-run with the picked rule.
Access Plane package — DONE 2026-08-10 (all three front doors live) ADR-0088 · D4 — the proven chain is now one shared runtime library reaching every front door. The runtime-neutral surface (discover → eligibility → route → read → verify → doctor) composes the attested engine with zero adapter-specific ledger logic; the doctor probe every adapter must pass is green on the live pilot (8/8). All three doors are wired and were proven live: the Claude Code adapter (a fail-open kit hook — SessionStart digest + per-prompt route card), the Codex adapter (the CLI is the adapter — --route / --read / --verify with clean exit codes), and the desktop adapter (loadBrainRoute, activated with operator permission as the fourth per-turn suffix rail — it routes the turn, reads the surfaced picks, and injects the read bytes, fail-open). The cross-door exit proof ran the same task through all three doors: each routed and read it, and every receipt landed engine-emitted in the door's log. The exit criterion is met.
USED-rate baseline — MEASURED 2026-08-10, target now ratifiable ADR-0088 · D4 — the first honest numbers are in, same session as the evidence chain that makes them provable: over a 30-day window, dispatch coverage 99.5% (the structural surface works), but read-confirmed 0.5% and USED 0.3% — and the dominant failure class is runtime non-use (378 of 380 routes delivered and never read through the structural surface). The program's design law is proven at the dispatch layer and almost entirely unproven at the read/apply layers; that gap is now a measurable number instead of an assumption. The USED target is deliberately unset — the baseline was the precondition the plan requires before a number can be ratified.
C1 climb as a standalone track ADR-0088 · D4 — the three migrated warehouse brains share the same three gaps (section/atomic depth, a coverage floor still under 90%, and a missing generated route index), so the climb is run as its own track rather than folded into each migration step. Sequencing rule recorded with it: a brain that has not migrated yet climbs after its move, or the tagging work lands at a path that is about to change.
Monthly uplift rhythm ADR-0088 · D4 — a standing monthly cadence over machinery that already exists: re-run the measurements, publish the delta, act on the regressions. Ratified as a rhythm, not a new build.
"Brain Standard v1" — the public standard-only slice ADR-0088 · D5 — publish the normative documents, the versioned schemas and the C0–C3 conformance ladder as a public TBK artifact, with retrieval numbers explicitly out of scope and that boundary stated on the artifact's face. The boundary is a precondition of shipping, because measured routing quality (micro-F1 0.126 · recall@≥1 0.429 · negative abstention 0 of 5 on the 26-row golden harness) does not support the inference a reader would otherwise draw.
Second front door — per-turn injection into the pilot's desktop runtime is mapped but not yet activated (deliberately gated).
Standard reconciliation — the router-tiers spec's NotebookLM enrichment-studio clause is superseded by the penta-gated lane and carries a pending deprecation pointer (ratification-gated, coherence-checked).

Changelog

Everything with a version or a change lives here, so the rest of this document reads as the current state. Most recent first.

2026-09-05

The retrieval stage is merged and measured above the floor: 28 golden cases, the hybrid ranking rule quantified, and the pick handed to the operator OCC main c6f2bb046 · golden set 17→29 · dense-first@0.63 18/28 vs shipped 15/28 · retriever is the ceiling (10/16 NL not retrieved) · decision page hybrid-ranking-rule-2026-09-05. The embeddings-lane branch is merged to OCC main at merge c6f2bb046 with attestation commit 8a4b82f17: 16/16 fixture suites pass, the attestation reads engine-attestation/v1 (engine 1.4.0, pass), fixture_set_hash is unchanged, and the skill still carries no Dashboard-KB byte-compat runner (measured: none found). Above the brain's gating_floor of 25 sits the grown golden set, 17 to 29 cases with 28 golden routing cases in all (16 natural-language prompts, 12 facet briefs): the 12 new t-max-nl-* cases span 10 chapters, every key_fact verified byte-for-byte against its bank file, leads judged at document level (the runner's ancestor walk), the lexical runner passing 28/28 with conformance C2-ROUTING-DELIVERY still PASS. Measured on all 28 (bench hybrid-rank-bench.mjs under verification/2026-09-05-embeddings-lane/), the ranking question comes back split: the shipped bounded band leads 15/28 (3/16 NL, 12/12 facet), dense-first at cosine ≥0.63 leads 18/28 (6/16 NL, 12/12 facet) and is the best, RRF and weighted-sum lead 15/28 but reach 20-21/28 at top-3, lexical-only 14/28, dense-only 8/28. Dense's top-8 misses the right document for 10 of 16 natural-language prompts, so the retriever is the ceiling, not the merge, and the 0.63 threshold is tuned with only a 0.02 margin, fragile. Surfaced from the canonical template, the decision page decisions/hybrid-ranking-rule-2026-09-05.html carries R1 (ranking rule: dense-first@0.63 recommended against keep-A, RRF, and hold-and-fix-retrieval) and R2 (next measurement: rerank probe + Day-30 re-run recommended, plus stage-2 holdout, embedder comparison), served at tbk-forge-wsl:8777, HTTP 200, md5-matched, rendered and checked, and awaiting picks. Day-30 re-run has not run, because it depends on the R1 pick; spend is unchanged at $0.2552 plus cents for the 28-query benches. Later the same session the rerank probe ran: one qwen3.8-flash call on the fleet relay over dense's top-12 documents lands the right lead on 10 of 16 natural-language prompts (dense alone 6, the shipped rule 3) and is useless on facet briefs, so the rule that falls out is a gate on query kind rather than a threshold, scoring 22/28 with zero facet loss and no constant to tune; a recall-depth probe corrected the earlier ceiling claim (the document is in dense's top-8 on 12 of 16 prompts and mis-ordered on 6, none absent). The decision page's recommendation moved to the gate, with dense-first at 0.63 as the no-LLM fallback.

2026-09-05

The dense stage goes live on a real index, and the receipt says so: the embeddings lane is OpenRouter, the hybrid route ships on a branch, and stage-1 is measured ADR-0183 supersedes ADR-0177 · lane openai/text-embedding-3-small via OpenRouter · maximus index 18,997 vectors · §6 receipt fields live · D3 stage-1 16 cases · engine branch embeddings-lane 40bf53213. Every subscription the fleet holds was measured dead for embeddings, each with its own key, seven lanes in all (Qwen Token Plan, MiniMax, Xiaomi Mimo, GLM coding and GLM subscription, Xiaomi MiMo open platform, and a Coding-Plan-shaped key that turned out to be the MiniMax key), which falsified ADR-0177's premise that the Qwen entitlement could be fixed; the operator then named an OpenRouter key outright, so the lane is OpenRouter at 1024 dims and nothing was switched on the agent's judgment. The first paid build embedded all 18,997 vectors and then lost them: JSON.stringify of nineteen thousand 1024-float arrays exceeded V8's string cap, the index wrote zero bytes and the CLI exited 0, an escape now logged; vectors are stored float32+base64, and the second build produced the real maximus-marketing index (6,750 units, 18,997 vectors, bound to its manifest hash) for a total measured spend of $0.26. The ROUTER-TIERS §1 rule 7 stage is wired into the route: scope gate first, fail-open to lexical with a receipt note, and the three DATA-CONTRACT §6 fields (candidate_stage, embedding_model, embedding_index_hash) appear on a live receipt only when the stage contributed, as AP-17 demands. Stage-1 on the 16 golden routing cases: lexical leads 12/16, dense top-1 5/16, hybrid 13/16, and the split is the finding: facet briefs go lexical 12/12, while the four natural-language prompts go lexical 0/4 and dense 3/4, with the hybrid merge keeping only one because its bounded band ranks wrong lexical picks above right dense hits. Below the brain's own gating floor of 25, this is direction, not statistic; the hybrid ranking rule on 25+ cases is the next measurement, ahead of the day-30 re-run. The engine work stays on the branch until the compat gate and merge.

2026-09-05

The read gap measured at zero, and golden doctrine now rides in the card: engine 1.4.0 ships golden-eval verbatim injection engine 1.4.0 · ROUTER-TIERS §4 row (a2) · AP-18 · anti-patterns 17→18 · organic read-confirmed 0/2,300. The delivered-never-read class was instrumented for the first time on ORGANIC traffic: 2,300 prompt-routed route cards in the maximus door ledger (Aug 11–Sep 5) joined against the read ledger scored 0 read-confirmed (0.0%) — the card prints candidate paths and names no read surface, so the doctrine never reaches context; the green 98.8% joins on the Brain-side ledger were the experiment harness measuring itself. The fix extends the safety-verbatim mechanism (engine 1.3.0, ADR-0165) to golden eval doctrine: a pick named by a golden case (expected_doctrine + key_fact) gets its governing section inlined verbatim in the card, bounded by the t1 budget, every drop a receipt note, fail-open without an eval set, safety-verbatim taking precedence. The standard forked in the same change: ROUTER-TIERS §4 gained row (a2), ANTI-PATTERNS gained AP-18 (golden-governing doctrine delivered as a pointer, or dropped silently), moving the anti-pattern count to eighteen; coherence-gate totals re-pinned (18 anti-patterns, thirty-eight checks, twenty schemas). The embeddings lane was decision-paged and picked (relay subscription, qwen3.7-text-embedding at 1024 dims — ADR-0178), and the live probe then measured the picked Token Plan lane chat-only: embeddings return 404 at every path shape, so the successor lane choice returns to the operator. Adoption is the open gap: the pilot door still emits through its own router; wiring it to the engine 1.4.0 route path is next.

2026-09-04

Semantic retrieval gets a second home, and the standard says so: the A1 fork ratified as ADR-0168 ADR-0168 · ROUTER-TIERS §1 rule 7 · AP-17 · anti-patterns 16→17 · receipt gains 3 evidence fields. The operator ratified all four picks, three at recommendation and one changed. Semantic search is no longer confined to the T4 deep-search escape hatch: a dense or hybrid candidate stage may now run inside the normal route, ahead of the rerank seam, because the measured miss is systematic (0 of 12 governing-doctrine deliveries) rather than occasional, and escalating per request would pay deep-search latency on every turn for the same answer. Five guardrails are normative: the scope abstention gate runs first on the query so honest no-route is untouched, the stage fails open to the deterministic lexical path, existing hot-path budgets bind unchanged, every contributing route carries a receipt naming the candidate stage, the embedding model and the embedding index hash, and promotion is gated on the brain’s own golden delivery set plus a labeled holdout rather than on scale. The fork is coherent by construction rather than by assertion: the coherence gate caught the first draft asserting receipt fields that did not exist, so DATA-CONTRACT §6 gained candidate_stage, embedding_model and embedding_index_hash (additive, schema total stays twenty), and ANTI-PATTERNS gained AP-17 (a semantic stage that outranks the abstention gate, or fails closed) as rule 7’s negation, moving the anti-pattern count to seventeen. Scope: maximus-marketing runs the first trial, every other brain inherits the code flag-off. The lane that pays is blocked and reported rather than worked around: the picked Qwen subscription credential returns Model.AccessDenied for every embedding model and for a plain chat call on both endpoints, so nothing was silently failed over to the OpenAI key that is present. Model recommendation once entitlements exist: qwen3.7-text-embedding at 1024 dimensions.

2026-09-04

The six-step session lands the delivery gate on the runner, uplifts two coded bands, packages the value bench, and opens the retrieval-stage fork C2-ROUTING-DELIVERY merged · engine main 5a8a525fc · maximus uplift + re-pin a50bb5a4 · golden sets 9/9 + 14 · bench packaged · A1 fork open. The routed-delivery check (the conformance claim that a brain’s own doctrine arrives verbatim on its own router, ratified 2026-09-03 as ADR-0165) merged into the OCC brain-router engine main: merged-tree attestation passes 4/4, fixtures 14/14, and the merged runner is what graded today’s golden sets. Dashboard KB’s golden set grew 25→32 cases with 9 golden and now PASSES the check 9/9; deck-craft got its first 14-case golden set and scores 11/14, the three misses all in non-safety classes, with the safety bar clean. Maximus received the uplift: the payback month bands and the effective-frequency bands became coded decision rules (THR-ACQ-PAY-001, THR-FREQ-EF-001), the RULE-DIVERGE-003 duplicate resolved through the canonical-owner map, the door rebuilt with selftest 556/556, and hub/registry.yaml re-pinned to content hash sha256:a50bb5a4… with the registry check clean (0 blocks). The value bench (the arm-vs-arm experiment that measured the +2.23 knowledge delta) is packaged as pilot/value-experiment/bench.mjs: one doctrine source, measured timings, and a doctor probe that passes with no key; its quarterly cadence placement waits on the operator’s spend-lane choice. Fleet-visible: the Brain Health publisher’s exec-refresh validator now accepts a superset of expected checks instead of rejecting every bundle that carries the new seventh check (fix 61d2e02). The forced publisher re-cycle after the fix took the all-brain “refresh failed” warnings from 8 to 5: execution refresh now passes every scanned brain except Dashboard KB; four conformance-verdict refresh failures remain (Dashboard KB, video-craft, maximus-marketing, deck-craft), under diagnosis the same session. The retrieval-stage fork (dense/hybrid semantic reranking: hot-path vs the T4 answer surface, embeddings lane, promotion gate, scope) is surfaced as a four-decision page, awaiting picks.

2026-09-03

A brain's own doctrine arriving on its own router becomes an enforced conformance claim: A2 ratified, ADR-0165, and the anchor fix it licensed moved the dose gate from 1-of-3 to 2-of-3 the same day ADR-0165 · C2-ROUTING-DELIVERY · engine 1.3.0 · checks 37→38. The operator ratified all five A2 picks at recommendation. ROUTING-DELIVERY verifies BOTH properties: the governing item picked AND the golden case's key_fact arriving verbatim in the delivered payload. Golden sets live in each brain's eval.cases.json (floor ≥8 cases, ≥1 per intent), extended with expected_doctrine and key_fact. The bar is two-tier: 100% on safety-classed cases, ≥70% overall, so a single safety miss fails the check outright. The dose fix belongs in the engine, not the doctrine, and the check is C2-ROUTING-DELIVERY, execution class. The standard gained the check (conformance 37→38), the eval-case fields, and the ROUTER-TIERS §4 anchor clause; the coherence gate re-pinned clean. Engine 1.3.0 resolves document-declared coded IDs to their containing section anchors at emit time: whole sections arrive in the card, not the one-line rule index the same morning's gate had caught it delivering. Re-running that gate on the fixed engine: T-MAX-CRITIQUE 6.65→9.25 PASS, T-MAX-PRODUCE 5.50→8.75 with zero errors and zero fabricated cites (the residual sits in uncoded section prose: content uplift, not delivery), T-DECK-CITE 9.5 PASS. The declaration-site diagnosis is confirmed; the remaining work is golden-set authoring per brain and the executor that runs the new check.

2026-09-03

The route card now carries safety-classed rules verbatim — and the first minimal-dose measurement proved that one rule is enough while a rule index is not engine 1.2.0 · A4 · decisions/a2-routing-delivery-2026-09-03.html. The engine's access plane now enforces ROUTER-TIERS §4 row (a) at emit time: when a routed pick's item carries coded IDs classed safety in the brain's own BRAIN.md, the whole rule section arrives verbatim inside the card, the receipt records depth=verbatim without carrying the rule text, and every budget drop is a receipt note, never silence. The card path gained its first fixture assertions (7 new, all 15 engine fixture files green), the engine version moved 1.1.0 to 1.2.0 with its attestation regenerated, and the DeSlop fleet closed: all five nodes refreshed to the retagged corpus with byte-identical installed bundles and identical runtime readback (295 rules, llm-judge 2, reviewer-manual 30), the hub registry re-pinned to the rebuilt deterministic projection (sha256:07bb685d), C1 re-verified, strix's local-only smoke-check record preserved and union-rebased rather than discarded. The action plan's dose gate then ran with the August experiment's own instruments (same arm model, same rubric and answer keys, two-vendor blind grading over a seeded shuffle, with the recorded full-chapter arm re-graded inside the same package as a comparator): deck-craft's self-contained KILL-CITE-001 rule scored 9.25 on the card alone — minimal effective dose, achieved — while maximus's threshold doctrine scored 6.65 and 5.50 with 3-4 numeric errors. The cause is not delivery, it is declaration: maximus codes its THR IDs on the document item, so the card carries the one-line rule index while the graded bands live in the section prose. The fix fork (engine section-anchor resolution, doctrine authoring, or the §4 row (b) inline-budget escalation) is bundled with the ROUTING-DELIVERY conformance-check design (what counts as delivered, where golden sets live, which pass bar, which tier gates the claim) into a five-decision page on the operator's desk; its picks decide whether a brain's own doctrine arriving on its own router becomes an enforced conformance claim.

2026-09-02

The DeSlop module stops claiming judges it does not run: 14 rules retagged llm-judge → reviewer-manual, and the corpus gate gained the sensor that would have caught it DeSlop ADR-0019. Module #9's own audit found only SE-008 of 16 llm-judge rules wired, and the follow-up trace showed the gap is structural: the hook worker judges whole documents against a hardcoded category schema and never reads a rule definition, so 14 rules (DC-001..004, FR-011..015, RG-001/003, SL-036/037, CD-006) claimed an enforcement nothing ran. The operator picked reclassify over building 14 judges. Reviewer-manual is the accurate class and changes no behavior: it files as the same pending-judgment disposition in every gate, so no pending list, coverage count, or auto-apply exclusion moved; verified end state llm-judge 2 / reviewer-manual 30 of 295 rules, build.sh green, brain conformance C1 unchanged, registry re-pinned sha256:5bc7944f. Fixed at the cause, not the label: check-enforcement-truth now fails the build on any llm-judge claim whose id has no wired judge, probed in both directions. A future build decision keeps its measurement path: rule-judge.mjs --validate carries the retagged prose rules to a model over the corpus's labeled cases.

2026-09-02

The pilot gains its 18th discipline (seo-and-geo), and a federated build is execution-certified for the first time maximus-marketing · engine 1.1.0 — the SEO station's missing brain home is built: 21 chapters authored on the full house spine (00 OS through 28 migrations, decision spine at 23-25, 53 coded rules) and the geo-01..12 series moved in from marketing-ops-and-martech (content unchanged, six cross-discipline references re-pointed). Certifying it surfaced a real engine defect: write-back spokes compose federation INTO dist/manifest.json, and any consumer composing live over that file double-merged and tripped the kb_id-collision guard — which is why the 2026-08-25 federated build could never be execution-certified. The engine's federateManifest now strips a declared module's previously composed items before re-composing (the idempotency the spoke contract documented but the engine never implemented); the federation-safety fixture keeps the collision throw for foreign items and pins same-module re-compose as idempotent, and the engine attestation re-ran green (fixture_set_hash f11451dd). Pilot state after the rebuild: 554 routable chapters across 18 disciplines, 7,389 items at the door (7,037 project + 352 federated deck-craft), 563 coded IDs resolving exactly once, eval 13/13 green (three GEO cases re-pointed, one SEO case added), conformance-exec green against the composed hash — the first execution-certified federated build of this brain, closing the receipt-pending caveat the 2026-08-25 entry carried. The station-side half (the seo mapping plus a drift guard that fails the build if a station ever maps to a chapterless discipline again) lives in the Ecomma repo.

2026-09-02

DeSlop brain audited, challenged, and federated as hub module #9 — zero-move at runner-verified C1, full-corpus routing from day one ADR-0160 · decisions/deslop-federation-2026-09-02.html — the operator-requested audit found the Deslop rule corpus NOT stale (248→295 rule ids in four weeks, 21 of 33 families touched in September) but its value exchange broken: 29 recorded runs with zero accepted operator decisions, a judge tier running degraded rather than down (a later re-read of the full 1,071-row telemetry found paid verdicts on each of the eight days 08-26 to 09-02, correcting the audit's own first claim), today's new discourse family bundled yet routed by no gate, and growth audit-driven with the ingest loop built-but-empty. The operator's challenge ("why not move it into the brain?") flipped the session's own standalone recommendation on pressure-testing — the stated reason was a sequencing claim, not a dependency — and the ratification page picked the shape: register zero-move (corpus stays canonical in the DeSlop repo, The Brain points at it), route the FULL corpus from day one (overriding the checker-first recommendation), start in parallel with the landscape program. Executed the same session: a manifest-over-corpus brain at DeSlop's brain/ (334 items, 298 coded ids across 35 prefixes) verified C1 by the conformance runner (broken_paths 0, hygiene 97, coverage 99.7%), registry module #9 appended with the manifest_hash pin (check-registry 0 BLOCK), companion ADR-0160 in the vault log and mirrored. The fleet's most active knowledge asset is now routable by every project; its staleness and growth questions have structural answers (health scan, console, history) instead of audits. Post-ratification the same session closed the ghost IF/VD rule ids at their root (a dispatch scanner blind to the object form), which added three rules and exposed a brain-coverage facet the projection builder had never emitted; the facet is emitted now, two hardcoded builder counts became derived cross-checks, and the registry is re-pinned to sha256:af9c5fba. DeSlop's build.sh and its 396-test suite are both green.

2026-08-26

First measurement of the day-30 quality-delta promise — the knowledge is worth +2.23/10 against a promised ≥ +1.0; production delivery is 0/12 and is the binding constraint pilot/value-experiment-2026-08-26 — the plan's pilot success criterion "quality delta ≥ +1.0/10 routed vs unrouted" had never been instrumented since it was written (2026-07-05); this session ran the measurement instead of describing it. Pre-registered design, frozen before any run: 3 brains with live routing surfaces (maximus-marketing C2, dashboards C2, deck-craft C1) × 4 task types (DECIDE / CRITIQUE / PRODUCE / CITE) = 12 tasks with doctrine-verified answer keys; two arms on the same model, closed book, zero tools — the task alone, and the task plus the brain's real route card verbatim plus the governing chapters injected whole (the Layer-1/D6 delivery model); two independent vendors (deepseek-v4-pro, kimi-k3) graded blind on shuffled labels and were unblinded after scoring; exact Wilcoxon by full enumeration of 2¹². Result: mean quality 7.19 → 9.42, +2.23 (median +1.25), 12 wins / 0 losses / 0 ties, p = 0.00049 — the promise met at 2.2× the bar. Doctrine errors 16 → 0, rework verdicts 6/12 → 0/12, wrong-or-fabricated citations 11 → 0, decision time neutral (199 s both arms). Per brain: dashboards +3.13, maximus-marketing +2.69, deck-craft +0.88 (the base model already knows deck craft; the brain's value there rides anti-folklore and citations). The value-chain decomposition is the audit's core finding: knowledge bench +2.23 × routing delivery 0/12 (1 partial, 2 honest abstentions — BM25 returns adjacent chapters, facet postings surface gallery collections ahead of doctrine, free text abstains) × organic read 0.5% — the courier, not the knowledge, is broken. Contamination control held (6/6 receipt sinks restored byte-identical, zero experiment receipts in any log). The companion ACTION-PLAN names five root causes (lexical routing vs semantic work; index granularity ranking containers over doctrine; no routing→outcome loop; the bench never instrumented; injection priority misaligned with where value concentrates) and six actions — verbatim KILL/THR injection in route cards first, a golden-task ROUTING-DELIVERY conformance check next (a standard fork, decision page + ADR owed when it lands), the engine-level dense/hybrid stage gated by that eval, and no new knowledge uplift until delivery reaches ≥ 50%.

2026-08-23

brain.tbk-labs.dev becomes the Brain Console — five live views and a per-brain drawer, ratified on a rule-20 page ADR-0122 · decisions/brain-console-v1-2026-08-23.html — the operator judged the old page a weak dashboard under the aesthetic floor, and the ratification took the larger scope: five decisions, two changed from recommendation (all five views ship in v1, and the pilot evidence renders in full on the page rather than as a headline). The console is one tabbed page: Fleet Health (the health table made deep, click a row for the drawer: 30-scan history chart, category breakdown, conformance checks, warnings), Pilot & Measurement (the frozen 0% baseline of 2026-07-05 against 99.5% dispatch coverage, ten success criteria as met/gap/open, the failure classes of the 30-day window, and the three evaluation rounds with their delivery verdicts), Activity (scan-to-scan deltas plus the registry freshness report, which the old page never linked), Fleet Map (the same graph, nodes now open the drawer), and Registry & Standard (modules, the four doors, all 34 decision pages with ratified status, the seven standard docs). Data plumbing: three new prompt-free bundle sections (pilot, freshness, registry) produced on Strix by build-fleet-bundle.mjs each two-hour cycle and exposed on /api/fleet; conversation content cannot cross into them by construction. Scans stay two-hourly; the page polls every 60s and prints the true age of every scan. Walked 17/17 in a private chromium with zero console errors; the live site picks it up on the Coolify redeploy and the new bundle sections on the next Strix cycle.

2026-08-22

Round-2 holdout sampled under protocol v4; labeling page delivered with thread context on every card verification/2026-08-22-evidence-holdout-round2 — the v3 holdout is consumed, so round 2 re-samples from the same immutable Legion snapshot with double exclusion: the 176 v1-era rows plus the 100 rows labeled on 2026-08-21, carried as a prompt-free signature union of 276 rows (conversation hash + prompt hash + uni/bigrams, near-duplicate Jaccard ≥ 0.72, ≤2 rows per conversation). The collector failed closed on an honest negative exhaustion — 37 selectable negative hints against the 50 target — and the operator ratified the 50/37 shape, so 87 rows (EH-001..EH-087) sampled with readiness true, the independent verifier green, and the self-test 6/6 including both exclusion arms. The labeling page shows the conversation thread on every card because a fragment's right answer lives in its conversation; two cards (EH-041, EH-073) have no recoverable referent and are proposed abstention for exactly that reason. Proposals come from one independent semantic read — the five-reviewer panel was unavailable at the relay weekly cap, disclosed on the page. Picks export as prompt-free JSON; the one-shot evaluation of any future candidate runs exactly once on the ratified set, and promotion stays unauthorized.

2026-08-22

Thread-aware referent resolution for the residual fragment class — designed, then revised by its own dev measurement before anything was built verification/2026-08-22-thread-resolution. All 175 dev rows were re-joined to their live Strix conversations with exact anchor verification (175/175), so the calibration partition's thread context is now recoverable for future rounds. The design puts a resolver at the consultation surface, wrapping the frozen gate and retriever without editing them. Its first draft's core move — sending the resolved query to the applicability gate — was falsified on dev: any context injection into the v4 gate regresses abstention on the fragment subset from 0/47 to 14/47 (0.298) false asserts, because marketing threads are saturated with topical vocabulary (a topical referent sits in the window for 21/47 negatives vs 1/4 positives — presence is noise, not signal). The revised architecture splits the consumers: the gate keeps the raw prompt plus one narrow structural veto (acknowledgement of an action proposal → abstain), and the retriever takes the resolved query. Retrieval on fragment positives is not context-bound on dev (hit@5 3/4 on raw, resolved and full-window oracle alike; the one miss belongs to the retrieval climb), and the residual false-assert class does not occur on dev at all — so dev measured the veto's safety (0 of 4 positives lost) and the regression risk. Its effect, like the parked fused dense+lexical stage, waits on one fresh labeled holdout; a single labeling round can judge both. Nothing wired live; frozen modules and the consumed holdout untouched.

2026-08-22

First candidate evaluation on the frozen v3 holdout ran and rejected the v2 retriever; both named investments started verification/2026-08-21-evidence-holdout-v3. The 100 sampled rows were labeled (17 routing labels reviewed by the operator, 83 abstention labels accepted as proposed by his chat instruction, provenance carried per row) and the one-shot evaluation of the frozen v2 candidate failed every gate: top-5 recall-at-least-one 0.059 vs 0.85, negative abstention 0.819 vs 0.95, positive retention 0.529 vs 0.95, combined score 0.047; candidate rejected, promotion unauthorized. This is the same 0% baseline finding, now on a current ratified answer key: the router matches words, not meaning, and stays silent too late. Both investment tracks named at rejection moved. The abstention port (maximus_abstention_v4.py) wraps the frozen gate with three widened one-directional classes and closed on the dev distribution: abstention 0.873 to 1.000, retention unchanged at 0.844, zero new drops, self-test 6/6 with the frozen module hash-verified untouched; the named residual is context-continuation fragments, unfixable by any context-free gate. The dense-retrieval spike embedded 572 chapters (text-embedding-3-small, cache out of git) and scored the 96 dev positives at recall@30: lexical 0.938, dense 0.760, union 0.969; dense alone is weaker on this easy distribution, and the fused stage stays parked until a fresh labeled holdout can judge it on the operational one. A dev-set measurement the same day settled the residual design direction: 59 of 175 dev rows are fragment-shaped and 11 of those are legitimate routed knowledge prompts, so shape-based abstention is ruled out and the context-continuation class needs thread-aware referent resolution, a design track, not regexes. The delivery cleared the independent verification gate on its fourth attempt; the three failures were instructional (catalog-token categories, and a 60KB evidence bundle whose truncated middle was fixed with a digest at the bundle head).

2026-08-21

Corpus of record ratified and frozen — the retrieval proof is runnable for the first time ADR-0120 — the blocked fork from 2026-07-30 (which conversation database the retrieval proof samples its frozen test set from) went through a rule-20 decision page on 2026-08-20 and was ratified at recommendation: bind protocol v3 to the Legion live store (where real usage accrues, fully disjoint from every consumed holdout), carry the consumed-prompt exclusion as a committed prompt-free signature artefact (176 rows / 108 conversations, derived on Strix from the two prompt-bearing files that stay out of git), and bind the freeze to an immutable consistent snapshot instead of a moving file. Re-measured facts underneath: Strix is back online; the live stores moved to ~/.maximus/data/repository-index.db; Strix holds 205 conversations of which 108 are the consumed ones; Legion holds 157, all fresh and still growing; the v2 freeze is permanently stale against the current router, so a re-freeze was unavoidable on any corpus. The signature artefact passed an equivalence proof (v3 inventory from signatures alone is identical to v2 from the prompt files), the self-test suite is 5/5 red-then-green, the verifier runs green in artifact-only mode on all three machines, and the readiness run on the Legion snapshot reports ready: true, 588 positive / 243 negative eligible hints against the 50/50 target — first time any corpus clears the 100-row bar. Companion ADR-0120 supersedes the corpus premise of ADR-0088; the ADR-0088 Windows-vault mirror that had been pending since 07-30 landed with it (sha-identical). A post-ratification measurement correction (key derivation) is recorded in the page and the RATIFIED record. Next: the labeling surface for the 100 sampled rows, then one evaluation of the v2 candidate.

2026-08-19

Production pipeline now visible on the canonical HTML — two diagrams on the "How it works" tab decisions/canonical-html-consumption-vs-production-2026-08-19.html — the tab previously showed only the consumption pipeline (Source → Generate → Route → Consult). It now also shows the production pipeline (Find candidates → Quick reject → Read page → De-duplicate → AI: relevant? → AI: rank → Pool → Append to Doc → Log → NotebookLM), the same 10 plain-named stages that run daily on a scheduled service to fill the brain. Steps 1–4 are deterministic (no model, no cost); steps 5–6 use two different LLM vendors so the relevance filter never grades itself; steps 7–9 enforce capacity + observability; step 10 is Google's auto-reingest into the brain's notebook. Detailed failure modes (feed 404s, model 402s, reingest lag) are explicitly out of scope on this tab — they live in the brain-scout docs. Picks ratified per rule 20: layout = two diagrams on the same tab (recommended kept); content = 10 plain-named stages only (sibling framing + file refs turned off); out-of-scope = detailed failure modes only (pricing + rotation off, not on the tab). Companion ADR-0118 to follow.

2026-08-19

Phase 2 lands — three deterministic improvements auto-applied; judged-quality work stays queued plan/CHAIN-HARDENING-PHASE-2.md — workstream 2 of the brief now has shipped code against the measurement + auto-apply contract (see the 2026-08-18 entry above for the contract itself). 2a — probe idempotency cache (scripts/verify_reingest.py): a per-(brain, notebook_id) cache at $BRAIN_CHAIN_HOME/reingest-state.json records the last notebook lastModified the probe verified. On the next probe, when the cached value still matches what notebooklm returned AND no fresh Drive write landed after the cached drive_at, the probe short-circuits to reason="unchanged-since-last-probe" and skips the tripwire comparison. The cache is fail-open (missing, unreadable, or corrupt state ⇒ live path runs unchanged) and the write is atomic (write-temp + rename) so a crash mid-write never produces a half-written cache that could skip a real tripwire. Four new tests cover cache hit, cache invalidated by moved lastModified, cache invalidated by a fresh Drive write, and corrupt cache fails open. 2b — brain-skip shortcut path (scripts/measure_chain.sh): a new --shortcut flag partitions brains into (a) skip — whose last snapshot was within --shortcut-window (default 1h) AND whose router verdict was ok; (b) run — everything else. Skipped brains reuse their previous snapshot's per-stage evidence so the totals reflect the WHOLE chain. The shortcut cache lives at $CHAIN_HOME/shortcut-cache.json, keyed by brain, and is updated atomically each non-shortcut run; the cache is fail-open and a brain with router_ok=False is never skipped. 2c — probe firing-minute alignment: verified live on Strix that yatagarasu-scout-probe.timer already carries OnCalendar=hourly, Persistent=true, and RandomizedDelaySec=5min (commit d6a6e864) — no edit needed. Queued proposals (2d/2e/2f) remain deferred until the baseline lands: Drive retry tuning needs 7+ days of journal data; filter and judge chain micro-tuning sit on calibrated boundaries and are operator-only. End-to-end measurement on Strix (the second run with --shortcut): 7 brains, 6 skipped because their router verdicts were ok within the 1h window; 1 brain (maximus-learnings) ran the full path because its router verdict was manifest-missing — the tripwire the runner surfaces honestly was carried forward and the brain correctly stayed in the run set. The chain-wide picture stayed whole: the snapshot's totals include both skipped and ran brains. Tests: brain-scout test_verify_reingest 16/16 (+4 new). The 14 pre-existing failures in test_runner and test_search were carried forward from Session 49 and are unchanged by this commit; they are a Session-51 task, not a Phase-2 task.

2026-08-18

Phase 2 plan lands — the measurement + auto-apply contract, with deterministic gates plan/CHAIN-HARDENING-PHASE-2.md — workstream 2 of the brief lands as a plan doc rather than shipped code, on purpose: a chain has to be measured before it is optimised, and the receipts + journal plumbing from Phase 1 (handover: Session-49 row below) is what the measurement runs against. The plan lays out a single contract: a change auto-applies only when it is deterministic, has a bounded blast radius, its impact is verified against the hand-written ~/.brain-chain/baseline.json, it is fail-open, and the receipts contract catches a regression. Anything touching judging quality is proposed with evidence and lands when the operator approves — never applied silently. Three deterministic improvements are named for the day the operator-installed timers on Strix have produced 7+ days of receipts: 2a a probe idempotency cache in scripts/verify_reingest.py so a steady-state notebook's lastModified skips the tripwire comparison; 2b a brain-skip shortcut path in scripts/measure_chain.sh for brains whose last measurement was within SLA; 2c a probe cron firing-minute alignment so the hourly probe does not land on the same minute as the daily main timer or the 4×/day autosync. Three queued proposals are named for after the baseline exists: 2d Drive retry tuning, anchored to journal latency; 2e filter chain micro-tuning; 2f judge chain ordering — the last two are operator-only because they sit on a calibrated boundary. Operator actions deferred from Phase 1 (now landed): the four new systemd timers (probe + onfailure) are installed and enabled on Strix; the cron has fired the reingest probe once and the onfailure check is armed for 07:21 local tomorrow. The first end-to-end measurement on Strix showed the same tripwire shape as the Forge run — 7 brains, 6 fresh, 1 real tripwire (maximus-learnings flagged manifest-missing). The first baseline.json is deliberately not written today: every last_drive reads none because the receipts journal was installed today and the daily run predates the install, so this scaffold snapshot is not representative. The right baseline averages over 7 days of probe + onfailure firings, after which scripts/measure_chain.sh --baseline-write is a one-shot review of that average. Phase 3 (the unified controller + role seams — Context.dev at source, Convex at live mirror, Devin at orchestration) is a separate architectural lift, sequenced against the hardened-and-measured chain, not on top of fresh changes.

2026-08-18

Chain hardening phase 1 landed — every hop has a receipt and a tripwire plan/CHAIN-HARDENING-PHASE-1.md — five sub-goals across the source-to-bank-to-router chain. Receipts (1a): a new brain_scout.chain.receipts module writes an append-only JSONL at ~/.brain-chain/receipts.jsonl with a fallback .fail.jsonl, so silence is no longer proof — every hop on the chain leaves evidence that downstream stages can assert landed. Drive retry (1b): every Docs batchUpdate and the files().create call now go through _call_with_retry, with bounded exponential backoff (1s/2s/4s, three retries) on HTTP 429 / 5xx / network timeouts only; 4xx and the existing "no replies" guard raise immediately. Shelf queue (1c): two new shelf columns — next_eligible_at and consecutive_failures. A failed Drive append now hides the candidate for 5 minutes (no stampede) and demotes it to state='evicted' after 5 consecutive failures (the run stops spending quota on it); a successful record_delivery clears both. Reingest probe (1d): a new yatagarasu-scout-probe.{service,timer} fires hourly on the half hour and runs scripts/verify_reingest.py --all, tripping notebook_reingest_lagging if Drive writes within the last 24h have not been ingested within 30 min. Cron self-recovery (1e): a daily 07:15 yatagarasu-scout-onfailure unit runs scripts/cron_self_recovery.py, which re-fires the daily service if the journal shows no successful Drive receipt in the last 18 hours, with a 30-minute follow-up check that writes cron_self_recovery_succeeded or cron_self_recovery_failed so a human sees both halves. Ratify freshness stamp (1g): brain-ingest's ingest.mjs ratify writes bank/.ratify-stamp after every successful batch, and brain-router's build-manifest.mjs folds it into manifest.counts.last_ratified_at so a "ratified but never rebuilt" brain surfaces as a tripwire. Router-freshness probe (1f): scripts/check_router_freshness.mjs compares manifest.built_at against the bank dir's newest mtime, with --strict (exit 1 on stale) and --auto-rebuild. Chain-measurement runner (1h): scripts/measure_chain.sh orchestrates end-to-end across every registered brain and writes ~/.brain-chain/measurement-<ts>.json, comparing against the hand-written baseline.json (rule 5: never invent numbers) and printing CHAIN_SLOWER on a >25% regression. Tests: brain-scout full suite 347/347 (was 283; +64 tests across receipts, retry, shelf-queue, reingest-probe, self-recovery); brain-ingest selftest 17/17. First chain walk on Forge: 7 brains, 6 fresh, 1 (maximus-learnings) flagged manifest-missing — a real tripwire the runner is surfacing honestly. Operator action queued: Strix-side install of the four new systemd timers and first ~/.brain-chain/baseline.json write. Workstreams 2 + 3 remain (process / unified pipeline); phase 1 is the foundation they layer on.

2026-08-12

Product UX review across both surfaces — 18 findings, all fixed audits/product-ux-review-2026-08-12 — a full UX audit of the served dashboard and this page scored the pair 38/80 against the measurement-tool bar and every finding landed the same day. The two pages now agree with each other: one issues formula (orphans + broken + dupes + volatile-overdue + never-routed) with the composition printed inline instead of hidden in a tooltip; the same band-scaled sparkline; and the public rollup now carries the claim-vs-verdict badges the dashboard already showed, retiring the "claims, not verified verdicts" scar. Both banners answer two questions in one sentence — is the data fresh (SLA, not cadence, now labelled correctly) and is the fleet healthy (below-floor count plus fleet-wide attention events). The dead ends closed: dashboard rows link to each brain's repo and hub mount and to this page, this page links back to the dashboard, every expanded row states what red/amber means and what to do about it, and the 20→21 schema misprint is corrected with as-of dates on the frozen pilot figures. Keyboard and screen-reader parity landed end to end (focusable rows and graph nodes, real tab semantics with arrow keys, skip links, focus rings, reduced-motion guard), loading states stopped pretending to be green, error states reach every region with a retry, and the rollup now names the scanning host. On the pipeline side, verdict-refresh failures that used to ship as silent success now surface as per-brain warnings on both pages, and a crashed ship service fires an OnFailure alert into the attention channel.

2026-08-12

The fleet map goes visual — a knowledge graph, generated from the registry Graph tab — a new Graph tab renders how The Brain's knowledge connects across the fleet as a node-and-line map, built straight from hub/registry.yaml (no hand-drawn diagram to drift). The Brain sits at the centre as the single git owner of all seven registered brains; each brain is coloured by its recorded conformance verdict; the four projects that consume a brain in place — Ecomma Agent, the Dashboard Knowledge Bank, tbk-vids and OCC — hang off it through a door (a checkout of this repo, never a copy), drawn as a dashed link; and the Maximus learnings ledger shows as a companion. Node size and the hover detail (items, hygiene, broken paths, operational grade) come from the same every-2h fleet scan the Brain Health tab uses, so the map carries live weight, not just topology. It is produced by a small standalone exporter that emits standard D3 node-link JSON plus a self-contained offline HTML, and it re-derives on any registry change — a migration, a new door, a flipped verdict — so the picture cannot silently fall out of step with the estate. Origin: a Fleet Deck decision approved on the tablet.

2026-08-11

The third front door opens — the Access Plane is complete, and the exit proof ran through all three ADR-0088 · D4 done — with the operator's permission, the desktop's loadBrainRoute — mapped in the plan since July but never activated — is now live. It is the fourth per-turn suffix rail in the desktop host: when a turn is real work, it routes the turn through the brain, reads the surfaced picks, and injects the read bytes — the same Access Plane machinery the Claude Code hook and the Codex CLI use, so the desktop adds zero ledger logic of its own and fails open (a route failure is a quieter turn, never a broken one; the full-brain behavior and the lean core's backstop are untouched). Typecheck green, 32 brain tests passing, and a live round-trip on the door landed its receipt. Then the cross-door exit proof: one task run through all three front doors — Claude Code hook, bare Codex CLI, and the desktop rail — each routed and read it, and all four receipts landed engine-emitted in the door's log. That was the exit criterion the plan set for the Access Plane extraction, and it is met: one machinery, three doors, one set of ledgers, no adapter allowed to write them.

2026-08-10

Two front doors open — the Claude Code and Codex adapters reach the same proven machinery ADR-0088 · D4 steps 3–4 — the Access Plane now has two of its three front doors wired, and both were proven live on the pilot. The Claude Code adapter is a fail-open kit hook: at session start it injects the brain's budget-bounded digest, and on every prompt it runs a dispatch and injects a route card — the engine emits the receipt, so the consultation floor counts it; an honest no-route injects nothing, and any failure exits silently rather than wedging the session. The Codex adapter is the other shape an adapter can take: Codex shells, so the Access Plane CLI is the adapter — --route, --read, --verify with clean exit codes (0 routed, 3 honest no-route, 1 refused) and an AGENTS.md snippet a project pastes in. Live proof on the pilot: a real hook round-trip injected a coded-id route card and landed its receipt in the door's log, and the doctor probe passed through the bare CLI with no hook in the loop. The design law held end to end — zero adapter-specific ledger logic; both doors reach the same engine surfaces, and a fixture asserts the hook appends nothing itself. What remains: the desktop shim (its activation is deliberately an operator call) and the cross-door exit proof, which will read 2 of 3 doors until the desktop is activated.

2026-08-10

The Access Plane starts — one runtime-neutral surface, and a doctor probe already green on the live pilot ADR-0088 · D4 started — the Access Plane extraction was gated on the evidence chain closing on one live task; that gate opened the same day, so the first increment landed. One runtime-neutral surface — discover → eligibility → route → read → verify → doctor — now composes the attested engine surfaces with zero new ledger logic: the route, read and apply ledgers keep their single producers, and the verify surface validates an application verdict against the monotonic join without ever appending to a ledger itself (an adapter that wrote ledgers would be a defect, not an adapter). The doctor probe is the acceptance check every adapter must pass — manifest/index hash match, a deterministic dispatch, an atomic read, the join reproduced, ledger sinks writable, the engine attestation on file, and the scanner above its floor — and it passed the live pilot 8 of 8 steps, including a real coded-id dispatch and a 25,383-byte atomic read. A companion scanner fix (2.6.0) also landed: read/apply evidence split across a door's two ledger locations is now merged instead of half-dropped — the exact defect the day's USE baseline caught. Remaining: the three front-door adapters and the cross-door exit proof; desktop activation stays an operator call, so that proof will read 2 of 3 doors until then.

2026-08-10

The evidence chain is closed — the program can now prove a brain was USED, not just delivered ADR-0088 · D2 closed — the next big rock, ratified as the first priority on 2026-07-30, is landed. Until today the pilot could prove a card was delivered (820 dispatches) but not that it was read (1) or used (0) — the read surface hashed the bytes but never handed them to the calling model, and an application verdict could earn the top operational grade with no read behind it at all. Five findings (F1–F5) from the 07-14 audit are now engine law, in brain-router 1.1.0 / scanner 2.5.0: brain.read returns the content and its receipt atomically — a successful receipt can never exist without the same operation delivering the hashed bytes to the caller; every read is validated fail-closed before any content exists (a fake route, an un-dispatched pick, a stale manifest or a stale dispatch is refused and recorded, never waved through); section resolution never silently widens to the whole file; and a verdict counts only when it cites the specific read it acted on — same route, same item, same content hash — with unjoined verdicts reported, never counted. The exit criterion was met live on the pilot the same day: one real dispatch → read returned 25,383 exact bytes to the model → the delivery cited that read's identity and hash → the scanner proved the full join (grade O3, one joined verdict, one USED). The pilot's C2 verdict held through the engine bump. Honest boundary, stated on the record: the proving verdict was judged by the session that built the chain — the first independently-judged USED row arrives with the next real delivery that routes and reads. Two gates open on the strength of it: the USED-rate baseline and the Access Plane extraction, whose start was gated on exactly this.

2026-08-10

First USED-rate baseline — the read/apply gap becomes a number ADR-0088 · D4 — with the evidence chain live, the USED-rate baseline (the commitment that needed it) was measured the same day by a new deterministic digest over the pilot's three ledgers. Over a 30-day window: dispatch coverage 99.5% — the structural surface dispatches on nearly every substantive turn. But read-confirmed is 0.5% (2 of 380 routes) against a ≥90% target, and USED is 0.3% (1 of 380 — the proof event itself). Splitting the four failure classes the plan names, the dominant one is runtime non-use: 378 of 380 routes were delivered and never read through the structural surface — the model did its work by other means. That is the program's founding 0% problem, now measurable per class instead of in aggregate. Two classes (retrieval-miss, missing-knowledge) are honestly reported as not enumerable from ledgers alone — named with proxies, never fake-precise. The USED target stays deliberately unset: the plan requires this baseline to exist before a number can be ratified, and now it does.

2026-08-10

The pilot's catalog now matches its corpus — the last audit blocker is closed, and the blind sensor is dead ADR-0088 · D1 closed — the third of the three sub-hour fixes, blocked since 2026-07-30 on an operator call, is landed. The pilot's manifest still listed 33 chapters whose files were deliberately cut by the excellence loop's Pass 4 (2026-07-28) and deleted the next day, so the live router could still offer chapters that fetch nothing, and the pilot was held registered-not-federable over it. The fix turned out smaller than scoped: the chapter index had already been re-generated after the deletions (re-indexed 08-03 and 08-07, proven byte-identical to fresh generator output) — the only stale artifact was the derived manifest. Rebuilding the derived chain at the canonical mount and at the door produced 6,677 items (521 documents + 6,015 sections + 141 atomics), zero dead paths, byte-identical across both mounts. The pilot's health, scanned by the real engine: hygiene 79 → 84 (the 33 dead paths were worth exactly the five points predicted), broken paths 33 → 0 legitimately — nothing was restored, nothing lost; the catalog simply stopped offering what no longer exists. The retrofit health builder — a second producer that reported hygiene 100 / broken 0 by construction and arrived in the same commit as the drift it could not see — is deleted, and the pilot's gate now invokes the engine scanner, closing the recorded contradiction where the gate asserted one health writer and summoned another. The execution half was re-pinned against the new content hash off a live tier-3 receipt: the pilot still verifies C2, matching its claim, and the registry now clears it as federable. Its health also now carries the operational axis (grade O3, dispatch, read and apply joined) that the retrofit could never emit — and the evidence chain it waited on closed the same day (see the entry above).

2026-07-30

Deep audit ratified — the working order for the next stretch, and two of three sub-hour fixes land ADR-0088 — a deep audit of the whole program (gaps G1–G8) went through a decision page; five decisions were ratified, three changed from the recommendation. This sets execution posture only — it amends no part of the standard and does not supersede the centralization topology (ADR-0086/0087).

The next big rock is the evidence chain, not the migration (D2). Closing route → read → apply comes first: brain.read hands the hashed bytes back to the caller, applied verdicts bind to the content_hash they acted on, and the scanner refuses to grade O3 without a confirmed O2. The migration pauses between steps, it does not stop — registry entries flip one brain at a time and every completed step was gate-verified, so the paused state (3 of 6) is internally consistent. Access Plane extraction is now scheduled (D4) but its start stays gated on that chain closing on one live task — two separate audits say extracting first would fossilize an incomplete evidence contract, so "scheduled" and "started" are recorded as different things on purpose. Four more medium-term commitments join the roadmap: a USED-rate baseline, porting the abstention gate to the pilot, a monthly uplift rhythm, and the C1 climb as a standalone track.

The retrieval proof gets unblocked by real work, not by waiting (D3). The one-shot holdout evaluation is short 97 rows — 49 positive-hint, 48 negative-hint, and its frozen, hash-bound protocol screens out synthetic, duplicated and near-duplicate rows (Jaccard ≥ 0.72, two rows per conversation max). So the deficit closes only by routing genuine Ecomma marketing work through the pilot; padding it is worthless at best and destroys the evaluation's credibility at worst. One thing this leaves open and worth naming: nothing yet reports when the deficit has been met, so eligibility is counted by hand until a readout exists.

"Brain Standard v1" gets published as a standard-only slice (D5) — the normative documents, the versioned schemas and the C0–C3 conformance ladder — with retrieval numbers explicitly out of scope, stated on the artifact's face. That boundary is a publication precondition, not a footnote: measured routing quality on the 26-row golden harness is micro-F1 0.126 · recall@≥1 0.429 · negative abstention 0 of 5, and a reader who infers "published standard ⇒ working retrieval" has been misled. Publishing with the boundary stated is what was ratified; publishing without it is the failure.

Of the three sub-hour fixes (D1), two landed verified and one is honestly blocked. Done: the pilot's excellence-loop driver is now serialized with a whole-driver lock — the root cause was subtler than recorded, because the documented stop command killed the driver and left the writing pass alive and reparented, so a restart quietly ran a second writer against the same corpus; the lock is taken before any work and inherited by the pass, and the stop procedure was corrected in the same change (sensor proven: a second launch refuses, an orphaned pass still holds the lock, a missing lock tool reports a bad environment rather than a false lockout). Done: the conformance runner's C2-RECEIPT instruction named the wrong receipt emitter — it pointed at a read-only CLI that cannot write a receipt at all — repointed to the one surface that does, and the corrected instruction was executed end to end before shipping. Blocked, and left blocked: putting the current engine scanner (2.4.0) on the pilot. The pilot is scored by a local retrofit builder — a second health producer, which is a banned anti-pattern (AP-11) — that reports hygiene 100 with zero broken paths; the real engine measures 79 with 33 on the pilot corpus as it stands after the excellence loop. The honest numbers are the engine's, but swapping them flips a live acceptance check in the pilot's own loop and overrides a prior on-record review, so it is an operator call rather than a fix. Nothing in the pilot was changed; the pre-image was restored hash-for-hash and the measurement was taken non-destructively.

2026-08-02

The Brain Health rollup gets one publisher, and stops faking work when it cannot ship operations — the every-2h job that produces the-brain-fleet.json was enabled on two machines at once. That file is a fleet-wide rollup: one document describing all seven brains, with no host field, written to the same path by whoever runs. So the second machine did not add data, it fought for the file. Both rebuilt the whole rollup from their own resolved brain set, committed about twenty seconds apart, and the loser died in a rebase conflict every cycle and kept the commit. One machine reached ten unpushable commits in roughly eighteen hours, growing every two hours, while its dashboard read normally. Three things changed. One publisher: the runner now checks the host before it builds anything and refuses everywhere else, so a stray enable fails loudly instead of accumulating dead commits. No commit it cannot push: on a failed push the job now rolls its own commit back, guarded so it can only ever drop the commit it just made, leaving the tree exactly as it was. A commit into a repo you cannot push is a no-op that looks like work, and it poisons the next cycle. The same defect was hunted across the fleet: three other timed jobs push to the same shared repo and all three carried it, one of them writing git push > /dev/null 2>&1 with the exit code unchecked, so a failed push had been invisible for sixty-five commits. All three now log real outcomes and roll back. Two of them were also committing without a pathspec, which in a shared worktree sweeps another job's staged files into your commit.

Fixing this surfaced a quieter one. The machine-local registry overrides on both workstations still pointed at the pre-centralization brain paths, stale since the migrations above, so the publisher had been scanning legacy doors and shipping a 5 of 7 rollup to this page and to the live dashboard. Repointing the four that moved took the publisher to 6 of 7, and the second workstation to 7 of 7. One honest caveat, recorded rather than smoothed over: dashboards was deliberately left on its old path, because the central mount carries the bank content but no generator and no dist/, so repointing it turned a passing scan into a failure. That was tried, caught by watching a real cycle, and reverted within the session. The publisher's remaining gap is not a registry problem at all: the Maximus brain's generated output simply is not present on that machine.

2026-08-02

Every brain now matches the level it claims zero overclaims — the fleet's last mismatch is closed. The pilot said it was routed-grade while only proving structured, and the fix was not construction: everything C2 requires was already present and correct — config, nine routing cases, all green — but the execution half had never been run at that location, so the runner had no evidence and honestly declined to certify. The same was true of the Dashboard KB on a second machine. Running the tests took minutes and both passed on the first attempt. All seven brains now read claim == verdict: two routed, one structured, four cataloged. The durable lesson is a maintenance rule rather than a milestone: a recorded proof is bound to a hash of the content it was produced against, so editing a brain silently drops it a rung until the execution half is re-run — the honest failure mode, but only if someone re-runs it.

2026-08-02

Centralization complete — Maximus lands, and the fleet's most-used brain loses nothing ADR-0086 step 6 — the last and largest brain moved with every figure identical to its pre-move scan: manifest hash unchanged, 6,686 items, and — the one that mattered — 820 routed queries in the window and operational grade O3, because this is the brain in genuine daily use. That number survived only because the scan runs at the door: this brain's receipts live one level above its root, so a scan at the central mount would have reported it as nearly idle. Three failure modes surfaced here that the previous five never showed, each of which would have caused quiet damage: a build input hidden inside the generated directory (which a directory-level ignore rule made impossible to re-include from within), a nested repository that the first commit captured as a content-free reference, and receipts living outside the brain root. All three are fixed and written into the registry so they cannot recur. The doors are now live on every machine, and the rollout's own hazard — a machine pulling the removal before it has a door — was met with the same discipline throughout: before any deletion, each machine's copy was compared against the canonical one and its unique history merged in rather than dropped. Across the fleet that rescued 90 scan records and 7 log entries that a faster migration would have silently discarded.

2026-08-01

The doors go fleet-wide — and the rollout's own breakage gets cleaned up ADR-0086 rollout — every machine now carries its brain doors, verified by the doctor on each. Getting there surfaced the predictable cost of a migration that removes content: once the removal commits were pushed, other machines pulled them and lost bank/ with no door yet to replace it — the Dashboard KB was already broken on two workstations. That is now a scripted, safe operation: door-bootstrap reads the registry, clones the sparse door and links the declared mount, and refuses to touch any path still holding real content. Its first dry run caught a defect in itself before it did damage — it had guessed the mount and would have repointed a live door at the wrong tree, which is why mounts are now declared, never inferred. Four repos across two machines were also jammed on the same modify/delete conflict (local health-history edits versus an upstream deletion), some for nearly a week; each was unjammed only after proving the canonical copy was a strict superset of what the machine held — 90 scan lines were unioned in rather than dropped, and every feature commit survived. Two housekeeping truths came out of it: the fleet's sync runs four times a day, not hourly (changed deliberately in July after an hourly cycle committed mid-refactor work), so a door's worst-case lag is ~6 hours; and a conformance check that looked like a regression was really a brain being graded at its hub mount while its receipts are produced at the door — the runner now looks in both places, without ever letting one brain's receipts vouch for another.

2026-07-31

The Dashboard KB lands — after one halt and one refutation ADR-0086 step 5 — the fleet’s largest brain (6,227 items) moved to hub/dashboards/, and the process caught more than the migration. Attempt 1 halted at the build gate: two corpus files linked out of the bank into the product repo, which only resolves while the brain root is the product root — repointed to canonical URLs, with item-level proof that nothing else moved (0 items added or removed, exactly 1 changed). Attempt 2 was refuted by the independent verifier for a real false-done: two of the three doors had never been created — they were still tracked files, so the brain’s health history had already begun diverging into two copies. The check that fooled the executor is worth naming: git check-ignore exits 0 if any argument matches and silently skips tracked paths, and reading a file proves nothing about whether it is a symlink. Fixed by proving the hub history was a strict superset before untracking anything. The same pass closed a subtler defect: under centralization every hub module shares hub/ as its parent, and the conformance runner’s parent-directory fallback was crediting one brain with another brain’s route receipts — a false green, now impossible. One verifier finding did not survive scrutiny either: its C1-vs-C0 claim compared a fresh build against a stale artifact; with both mounts rebuilt the gap lists are identical. Final state: 1,803 of 1,804 blobs byte-identical (the one delta strictly append-only), the generic engine and the KB’s own builder producing the same item-set hash, and the full product chain — build, derived-check, 70/70 eval, UI data, head-to-head — green through the door.

2026-07-30

video-craft lands — and the door shape turns out to be per-project ADR-0086 step 4 — the tbk-vids brain moved to hub/video-craft/ (verifier CONFIRMED 10/10). Two findings worth keeping: (1) its corpus had to be nested under bank/, because the pre-migration brain root was itself named bank — C0-BANK passed there by naming alone, and the conformance runner honestly refused to verify C0 at the new mount until the restructure (source_hash unchanged, so byte-identical corpus). (2) The tbk-arsenal door shape does not generalise: Docker cannot follow a symlink out of its build context, so this door’s sparse clone lives inside the tbk-vids tree. That was established by testing before migrating, and the real deployed path was then proven — a two-stage COPY --from=build /app/bank lands the corpus as real files in the runtime image, reproduced independently. The rails also caught two of their own defects: the door doctor false-failed a door mounting a corpus subtree, and could not see a stale door — its first run with the new offline staleness check found both live doors silently behind. Door shape is now a per-project decision, made by test, not by precedent.

2026-07-30

Migration underway — first three brains land, rails live ADR-0086/0087 execution — tbk-setup (verifier CONFIRMED 6/6) and tbk-logs-scoring (CONFIRMED 8/8; the stale tbk-2-scoring mount retired en route) moved wholesale with their builders’ source_inputs re-pointed absolute (env overrides TBK_SETUP_RULES / TBK_LOGS_REPO); tbk-arsenal (CONFIRMED 8/8) became the first door: content at hub/tbk-arsenal/, and the OCC brain path now a host-git-ignored symlink into a 2.7M sparse blob-less clone at ~/projects/.brain-doors/tbk-arsenal — the clone lives outside the host tree, so a stray git clean can at most cost a recreate-in-seconds symlink. All three D5 rails landed sensor-proven first: the door doctor (fail-closed, writes the guard’s brain-doors.json roster), the global door-clean-guard hook (blocks double--f git clean over doors; git’s own single--f nested-repo refusal proven on git 2.43.0), and the autosync door roster. The rails earned their keep immediately: the doctor’s first live run exposed a wrong-target resolution defect, fixed and re-proven same session. Every gate held: conformance C0/match, hygiene 95, broken paths 0, registry 0 BLOCK on all three.

2026-07-30

OCC's tbk-arsenal joins centralization — scope now seven brains, four doors ADR-0087 — the operator resolved the override ADR-0086 had explicitly left open: OCC's tbk-arsenal brain gets the same treatment as Maximus — its content migrates into The Brain repo and ~/projects/Organizing-Claude-Code/brain becomes a door (a checkout of The Brain repo mounted there, ignored by OCC's git, on the hourly autosync roster). The collective estate is now complete: all seven registered brains, four doors. Verified before accepting: the tbk-arsenal builder projects from the vault's oracle index via an absolute path, so the build is location-independent and works identically at the door mount. Migration order re-slots by size — tbk-setup → tbk-logs → tbk-arsenal → video-craft → Dashboard KB → Maximus — same per-step gates; still pending execution. Every other ADR-0086 provision (doors, no-copier, gating, rails) stands unchanged and simply applies to one more brain.

2026-07-30

Brain centralization ratified — one home, doors where needed ADR-0086 — The Brain repo's git history becomes the single canonical home of six of the seven registered brains' content (OCC's tbk-arsenal stays in OCC by operator instruction, registered by pointer), superseding the hub-for-shared-only federation topology (ADR-0046 lineage). Where a project consumes its brain in place — Maximus, Dashboard KB, video-craft — the old project path becomes a door: a checkout of The Brain repo mounted there, one git history, never a second copy, so identity holds by construction and the silent-overwrite failure class of a two-way copier can't exist. The migration is ratified but pending execution: smallest-first (tbk-setup → tbk-logs → video-craft → Dashboard KB → Maximus), each step gated on consumer sweeps + a no-regression conformance re-run, with three safety rails (a git-clean guard, a per-machine door doctor, door checkouts on the hourly autosync roster) landing with the first door. (Scope widened same-day by ADR-0087 — OCC's tbk-arsenal joins with a door; see the entry above.)

2026-07-30

The pilot's quality-elevation loop finishes — the work queue is exhausted, and the gate proves it. The Maximus Marketing Brain — the program's original measured 0%-brain-use subject — completed its long-running excellence loop: an external driver relaunched a fresh grading session per pass, and the run ended only when the seven-check gate exited 0 and the queue read empty (QUEUE_REMAINING=0), never on the model's say-so. Final state: 91 done / 34 blocked / 0 todo across the six tracks — the 84-chapter cut sweep (moved, never deleted), the ~80-chapter cross-reference renumber repair, brand canonicalization, 19 thin chapters re-authored at the 7.9 quality bar, and the verified C2 conformance claim held throughout. One measured finding worth keeping: the bare-figure penalty had been over-applied — 360 of 454 flagged chapters (79%) were already correctly sourced under conventions the scanner missed, so 122 chapters were re-scored and the remaining 253 genuinely-unsourced chapters are surfaced as standing debt awaiting a panel-ratified sourcing pass, not silently closed. The loop's stop condition was hit twice — the first production run found a transient-API failure could kill the driver, so the driver gained a retry wrapper (three attempts, backoff) and crash-proof launch, both proven live when later passes hit real API overloads and recovered cleanly. Thirty-four blocked items remain by design — client-scope separations and editorial judgments a machine shouldn't make alone.

2026-07-14

The router learns to say "not my domain" — the scope / eligibility abstention gate ADR-0060 — the first retrieval component landed. The deterministic router used to mark a prompt "routed" the moment any word matched the index — including a generic word like review, report, or dashboard that merely happens to be a facet value — so off-topic prompts got confident-looking picks (measured on the shared route surface: 9 of 15 off-domain probes routed, correct-abstention just 40%). The fix: a query is in-scope only if it hits a real topic signal — a coded-ID, a trigger phrase, an explicit facet, or the brain's declared topic axis (scope_facets, default domain) — otherwise the router abstains with an honest no-route. Correct-abstention went 40% → 100% with in-domain retention unchanged (82%), zero real routes dropped. Four forks were ratified (one changed from reco: scope_facets is promoted into the builder + data contract + conformance so every brain declares its topic axes explicitly, builder-validated). This finally implements a rule the standard had required since day one but no engine had built. Schemas stay 21; conformance checks stay 37; all seven fleet verdicts held live (the C2 brain and the pilot's C1 both unchanged). The next build — hybrid keyword+dense retrieval — re-tunes this gate on the hot path.

2026-07-14

The measurement chain goes live — first proof the Brain was read, not just dispatched ADR-0059 — a re-audit confirmed ADR-0058 made the score honest but nothing operational had moved: the live scanner still emitted the old metric, no read or application evidence existed anywhere, and live usability was unchanged. Five forks were ratified (0 changed from reco): adopt a small Brain Access Plane — one receipt-aware brain.read boundary every runtime calls — prove one real chain first, pull a scope/abstention gate forward, and land the full exit gate. Implemented and live this session: the health scanner now computes dispatch_coverage + the O0–O3 operational grade; the dashboard renders each brain as Cn / Om with absent read/apply shown amber, never green; and brain.read hashes the bytes it returns, so a read cannot be faked in prose. The pilot's first real dispatch → read → application chain (joined by route id + content hash) took it to a live C1 / O3 — read-confirmed and applied evidence at last — with a truthful 0% used-rate, because the O-grade measures evidence depth, not effectiveness. Retrieval quality (≈38% recall) is the next build, now measurable behind the plane.

2026-07-14

Measurement integrity — dispatch, reading, and application are now separated ADR-0058 — a process-reliability audit found the dashboard was measuring dispatch and calling it consultation: the router writes its receipt from its own picks before the model reads anything, so 100% "consultation" was possible while nothing was read. Eight forks were ratified (0 changed from reco) and codified into the standard: the metric is renamed dispatch_coverage (it counts cards delivered, not reads); a new content-read-receipt event (schema #21) proves a specific section was fetched, closing the dispatch → read → application chain of custody; a separate operational grade O0–O3 now measures observed use alongside the C0–C3 capability ladder, so an absent application-ledger reads as unknown, never as success (without hardening any structural check); and JSONL ledgers must skip-and-quarantine corrupt lines. Two directions were also ratified: fix hot-path retrieval before growing the corpus (measured recall is ≈38% on today's 601-chapter index, down from ≈48% as fixed-k lexical retrieval dilutes with growth), and govern runtime coverage so a front door counts as "active" only after a real route-and-fetch probe. Schemas 20 → 21; conformance checks stay 37.

2026-07-13

The pilot reaches verified C1 — the first brain to earn it, from the 0% baseline ADR-0055 Stage 2 — the depth build landed: the builder now derives 6,856 heading-split section items (each resolving its body from disk; short/navigational headings are dropped below a noise floor) and 131 coded-ID atomics from the same corpus, growing the pilot manifest from 601 to 7,588 items. The coded IDs stay declared on their documents so each still resolves to exactly one item; the depth is manifest-only, so the routing index is byte-unchanged and routing cannot regress. Every C1 gate passes and the conformance runner independently verified C1 = claim (match) — the claim was flipped to C1 only after the verdict, never before. The pilot — the program's original measured 0%-brain-use subject — is now the fleet's first verified C1 brain, and federable.

2026-07-13

Pilot crosses the C1 coverage floor — task-intent tagging landed live ADR-0055 Stage 1 — the pilot's C1 coverage lever is done: 505 chapters were retrofitted with a per-chapter task-intent facet, each derived from that chapter's role (varied across all six values — plan/draft/design/review/measure/produce, deliberately not a blanket default), lifting authored task-intent from 40 to 545 of 601 chapters and coverage from 84.4% to 98.4%. The change is routing-neutral — the router indexes a front-matter-stripped lead, verified by reading the indexer before editing and measured after (identical top-3 across a 10-query probe) — and byte-stable. The C1-COVERAGE gate flipped fail → pass; the pilot stays honestly C0 because one C1 gate remains, the depth build (heading-split sections + coded-ID atomics). Live on the Brain Health tab at 601 chapters, hygiene 85.

2026-07-13

Penta-gated enrichment lane becomes the standard; NotebookLM enrichment deprecated ADR-0057 — enrichment is now author → a 5-vendor panel ratifies content quality → land co-located, replacing the NotebookLM ingest lane (whose hosted auth kept expiring — roughly seven forced re-logins in one day — and which had delivered zero routing value across three runs). The operator delegated content-quality ratification to the panel. Two knowledge modules landed on the pilot this way, each panel-ratified over three adversarial review cycles: a 12-chapter Generative Engine Optimization module and a 12-chapter Agentic Marketing & Agentic Commerce module (every load-bearing figure URL-sourced with a provenance tier + access date). The panel caught real errors that would have shipped — a fabricated arXiv id, a mis-cited CVE, an un-checkable derived dollar figure, a mistyped protocol date — none a single reviewer catches reliably. Pilot corpus 574 → 601 chapters; NotebookLM's T4 semantic-query role is untouched.

2026-07-13

Executable C2/C3 verdicts + the first live verified C2 ADR-0054 — conformance verdicts above C0 are now earned by execution, not claimed: a real cl100k_base tokenizer (byte-exact vs the reference), a T0 digest renderer, a T2 coded-ID resolve surface, a fail-closed Tier-A money/compliance gate, and a hash-bound engine attestation (schema #20) — composed into the conformance verdict. The Dashboard Knowledge Bank earned the fleet's first runner-verified C2 on the live dashboard, via a real T3 route receipt. Schemas 19 → 20; checks stay 37; anti-patterns stay 16.

2026-07-13

Pilot C1 mechanism + fleet renames ADR-0055 — the pilot's builder now reads each chapter's co-located front-matter facets and lifts them into the manifest, so authoring/tagging actually moves the coverage metric (pilot coverage 50% → 84%); the exact remaining path to C1 is a task-intent tagging campaign to ≥90% coverage plus a depth build. The log-scoring brain was renamed to “TBK Logs.”

2026-07-12

NotebookLM decision re-adjudicated + lane cleared for activation ADR-0052 — a five-vendor deep review (five frontier models from five labs, adversarial pipeline) UPHELD the studio-plus-T4 role 5-0, and a fresh six-month tooling audit confirmed the pinned export engine is current and the ecosystem is consolidating around it. A time-boxed, supervised account waiver was ratified; the first live enrichment run is the next step.

2026-07-12

Uniform corpus layout across the whole fleet ADR-0050 · ADR-0051 — every brain's corpus now lives in a directory named bank/, including both retrofit outliers: the marketing pilot (574 chapters, live product, zero broken paths after the move) and the video brain (migrated via a dedicated PR with an atomic prod cutover and an idempotent volume migration; full suite green). Both verdicts flipped from none to verified C0 on the live dashboard.

2026-07-12

Engine regression caught and reversed. A background sync had blind-committed a working-tree revert of the router engine (silently dropping two ratified bundles). Root-caused via git forensics, restored from the intact commit, every gate re-run green — and the sync now honors pause files with auto-expiry so mid-refactor work can never be blind-committed again.

2026-07-08

Hot-path contract implemented + fleet verdicts go live ADR-0048 — the lean route-index, the deterministic T1 fetch surface (proven to resolve with the full catalog deleted), abstention-first route cards (the citation-coercion pattern is now banned as AP-16), and skip-receipt heartbeats so a quiet session is distinguishable from a dead hook. The conformance runner extended up the ladder; the registry now records runner VERDICTS, not claims, and the live dashboard renders claim-vs-verdict badges. The program's first real spoke federated the hub (9 project + 6,234 hub items) — and its first compose caught a real exporter defect, fixed at the root.

2026-07-07

Live dashboard at brain.tbk-labs.dev + federation safety codified ADR-0045 · ADR-0046 · ADR-0047 — the fleet dashboard went live with a verified 2-hour freshness loop; the measurement contract (projection-aware scoring, single health writer, versioned history) and the federation-safety contract (fail-closed scope export, fetchability gate, lockfiles, no transitive federation) were ratified and engine-implemented behind byte-identity + eval gates; conformance became an executable runner that caught real defects on its first fleet pass. Schemas grew 11 → 19, anti-patterns 9 → 16, checks 26 → 37 across the three bundles.

2026-07-06

Fleet grown to 7 brains, cross-domain. The registry now spans knowledge dashboards, presentation, video, marketing, an arsenal of curated primitives, and automotive engineering — every one a conformant brain, registry check green, and every one published in full on the Brain Health tab.

2026-07-06

NotebookLM adopted as a surface, not a home ADR-0043 — an enrichment studio (a scheduled export lands tagged proposals in the bank for ratification) plus an adapter-isolated, fail-open T4 semantic escape hatch. The git bank stays the deterministic home + router; wiring a non-deterministic surface into the deterministic path is now a named anti-pattern.

2026-07-06

The ingestion lane shipped. brain-ingest is the sync engine: a source proposes candidate knowledge into the bank's inbox; ratification validates its tags against the vocabulary, dedups, and mints a real co-located-tagged item; then the manifest regenerates. Non-deterministic sources are fail-open and can never mutate the ratified bank.

2026-07-06

Strategy doc published + Brain Health live-wired. This document shipped to shares.tbk-labs.dev; the Brain Health tab was wired to a public-safe fleet rollup refreshed every 2h by a systemd timer (data-age banner, amber on lapse).

2026-07-06

Brain Health dashboard built. A request-time served dashboard (reads each brain's health at request time — no baked snapshots); first fleet health scans (both brains hygiene 100).

2026-07-06

Routing-quality fork surfaced and RESOLVED ADR-0042 — the deterministic hot-path router can't reach the ≥0.8 gate (the golden labels are semantic), so the metric was split by surface: recall for the cheap card, ≥0.8 reserved for the reranked path. An opt-in LLM rerank layer was built the same day (+67% F1, +50% recall over the deterministic baseline, adversarially verified); the per-turn hot path stays deterministic.

2026-07-06

Hub brought up. The federation registry + 2 modules (Dashboard Knowledge Bank, Presentation Craft); registry check green.

2026-07-06

Router engine extracted & adversarially verified. Reproduces the reference catalog byte-for-byte and passes its eval 75/75; a real generalization bug was found and fixed.

2026-07-05

Group-B reconciliation ratified ADR-0041 — added the brain-playbook + brain-apply-ledger schemas, the hygiene-score formula, a canonical manifest hash, and split-by-tier budgets. Core vocabulary 1.0 → 1.1; schemas 9 → 11; conformance checks 26 → 31.

2026-07-05

Phase-0 forks ratified ADR-0040 — hub-canonical with transitional mirrors, adaptive depth ladder, deterministic-only hot path, per-brain id namespaces, extension escape valves, fresh golden-route labeling.

2026-07-05

Standard v1.0 shipped. The 7 normative docs + core vocabulary + scaffold template + product spec; a coherence gate reconciled the set.