Decisions timeline

The brief records 204 decisions in number order. ^[180] Each row gives the number and the title from the brief. ^[119] The brief itself holds the full text of each ruling. ^[128]

Decision	Title
1	Phase state.
2	Who does what.
3	m1-local shadows only rows with no M1 producer:
4	r0 is not a `release` row
5	Local digest
6	Project seed
7	Build roster
8	Verifiers.
9	Production entry
10	Policy owners.
11	C1/C2 checks run only through checkd.
12	`lines_live`
13	Panel votes
14	Eval schema names keep their case
15	Asks addressed to the Foreman are part of the loop.
16	harness_name admits kimi and cursor
17	Seat prompts are compact by construction
18	The engine seats the Foreman
19	Project creation records the budget
20	Seat models: declared first, policy second
21	Seat launches carry seat_id; votes wait for exit
22	Seed files are owned by the seed
23	Shared claim: built when the contract needs it, else merged empty
24	Claim snapshots push to the project repo
25	The frozen closure is what the tests reach
26	Seed lockfile = the workspace root's
27	Freeze worker spec and deps travel as read-only mounts
28	The template runner includes tests/
29	Defaults mode runs the code under test
30	SQL skeletons are raise-only too
31	Governing checks run per claim through checkd
32	Scratch clones borrow the template's installed dependencies
33	C4 runs the story's own lines; V4 runs the suite
34	The C4 gate reads per-story checks at the claim
35	Acceptance tests run under node
36	Build exits on merged, gated claims
37	C3 is a within-build sub-boundary
38	Asks cite the record, never a summary of it
39	V1–V4 have executable bodies
40	Gate decisions are append-only per tree, lap and harness
41	Gate reds under full lane load are rerun before they count
42	The Foreman stays a critical reader, not a relay
43	Checkd runs get a disposable schema on the application database
44	A shadow Foreman keeps the primary honest
45	The acceptance worker resolves the app root and runs scripts without pnpm
46	Cost is recorded per model call with every roll-up key, from M1b on
47	V5 runs against the local start in the per-run schema; only the eval replay targets the twin
48	The shared claim's gate
49	M1's explain-back is a hand-dispatched ask
50	Decision 39 is the M1 subset of V3/V4
51	Codex never verifies; the V column names the refuter seat
52	F19 supersessions and policy ownership
53	M1 requires s56 and the whole of F18 (s57–s71)
54	The operate spend row under m1-local comes from the ledger
55	Cursor is seated only at a lab outside {xai, google}
56	Only a tests-lane reissue unfreezes; the floor refutes, never authorises
57	The factory's own features are Foreman-dispatched until s82
58	M2 adds a traceability judge and runs at medium tier
59	Browser and live lines borrow the factory MCP client
60	Three capacity shapes, one engine; hosted-linked waits on a terms check
61	A story owns the data its acceptance line sees
62	Template tests assert their own effects, never the whole table
63	The factory runs on Kubernetes, customer apps on Cloud Run
64	The mutation sweep reads each project's own repo and resolves a tree to its integration commit
65	Mutants run in the verify environment with a baseline; type-position sites are not mutated; survivors go back to the tests lane, never to a threshold
66	Nine architecture properties, checkable, and one shape
67	agy is the shadow Foreman seat and the builder of GCP and Kubernetes work
68	Panel claims cite the frozen contract version
69	Architecture council outcome
70	Orchestration-tax retrospective of 2026-11-06, six defaults
71	The product workflow absorbs the bootstrap taxes
72	The hierarchy is a foreign-key spine for customers and not yet for the factory
73	Six risks not yet in the plan
74	Progress is derived at four levels, never typed
75	The product UI is one spine at three altitudes, designed by council
76	The DAG has a story layer today and needs a feature layer; the factory's own rulings are not yet enforced
77	The orchestration-tax budget has numbers
78	The finish line and seven standing rules
79	Seats, not shapes: the business model
80	Factory-provided seats
81	UI council pick: kimi's candidate is the base
82	Check runs never inherit the engine process environment
83	Liveness, not time
84	Review at scale, the factory's version
85	Mutants are sampled per story content, not per tree
86	M1 explain-back recorded on the merge
87	Gate learnings from the s69 merge
88	The record is the factory's memory hierarchy; the plan-steward dreams
89	M1 gate passed and merged
90	Live M1 run, first two gaps
91	Live M1 run, third gap: the Foreman seat is told the rules it is judged by
92	Plan-phase laps raised to 8 for M1
93	Live M1 run, fourth gap: a workspace has no verifier accounts until someone admits them
94	Live M1 run, fifth gap: refusal codes without their rules, and refutations without their target
95	Live M1 run, sixth gap: a panel seat leaves a second launch row open and holds the account lease
96	Live M1 run, seventh gap: the panel tally reads a field the real harnesses never write
97	The product Foreman is the Claude Code Foreman, on the factory's own web UI
98	Ideation is a walk through a policy agenda, asked with cards
99	Live run 2, eighth gap: an engine restart forgets who is running
100	Live run 2, ninth gap: every resubmission seats a new intent panel while the superseded one still runs
101	Live run 2, tenth gap: the Foreman is asked to copy text it cannot see
102	Fix forward: the framework is the deliverable, the live run is the probe
103	Test runs against the engine's database destroyed the live run and the build channel
104	Live run 3, two gaps on the first unaided pass
105	Live run 3, build phase: the tests-first seat is given line ids and not the lines, and cannot reach the Foreman
106	Live run 3: the claim snapshot dies on output volume and masks the lane's reason
107	The watchdog cannot see a lane that is working, and cannot stop one that is not
108	The asynchronous panel completion races the propose that seated it
109	The gate ran the factoryd suite's files in parallel against one throwaway database
110	The daemon's C3 integrator is not per project; the scripted runtime's is
111	Architecture council 2: the essay "Which architecture fixes which failure" against our record
112	Prepare the release stage for GitHub's agent-scale Git without a remote
113	The workspace Foreman on Slack and Microsoft Teams
114	One spine for the factory and for customers: epic, feature, story, claim; rulings and verdicts attached to the node they govern
115	Dispatch is blind to usage; the claude skew is the roster, not the load
116	Limit pools are rows; routing is a workspace setting with named modes
117	Every vendor lane leaves a usage sample; samples joined to outcomes are the routing dataset
118	Every runner has a headless pool read-back; "none" was wrong
119	Plan-conformance pass 2 (record sha 805359a): 79 amendments accepted, 30 findings refused
120	Re-seating the Foreman is an engine operation, not choreography
121	Harness transcripts are rows; the file is a cache
122	The Foreman in the developer's own harness: Claude Code, Codex, agy, grok as Foreman front-ends
123	The Foreman plugin: MCP, skill and hooks that write to the record
124	Live run 3, C3 re-run after the gate-32 merge: a pre-106 snapshot carries node_modules and the freeze reads the whole tree one `git show` at a time
125	Live run 3, C3 laps 2 and 3: the tests ask says "line id" and the refusal quotes the title, not the rule
126	Foreman handover is a protocol in the plugin until the engine owns it
127	Real-time Claude-to-Claude communication is the engine owning each session's inbound channel
128	Plan-conformance pass 3 (record sha 71f8a3b): 22 amendments accepted, 12 findings refused
129	The self-build milestone, provisional name SB: the factory ships one of its own stories through its own pipeline with no hand step
130	Claude's status-line `seven_day` is the current model's pool, not a shared one
131	The factory's account layer, not the host's: a desktop Foreman launch carries its account, and the attach bundle is per account row
132	A new user starts the Foreman from Claude Code with nothing hand-wrung: one onboarding, two doors, one record
133	Where `/foreman new` keeps a project's files: one root per machine, a clone per project, Foreman state per workspace, engine state apart
134	Plan-conformance pass 4 (record sha dfb953f, by builder-muse-2 as a lane task): 12 amendments accepted, 16 findings refused
135	The product is named yantra; one token derives every surface
136	Session messaging audited; on Kubernetes it is hub-and-spoke through the engine, never a socket mesh
137	Three controls taken from Uber's agent-security framework: lane provenance, replay before enforcement, admitted tool servers
138	A browser pool per workspace and a cells-per-host budget
139	Live run 3 after gate 33: the seed's fixed hold-out does not match the contract, an import into a held-out path is refused at C3 instead of at C2, and factory-error laps still count
140	Payback accounting for framework fixes, and the factory does not fate-share with its own repair
141	The steward (s79) moves to right after s50, with its dependencies trimmed to what the pass needs
142	Plan-conformance pass 5 (record sha ba70bf8, by builder-muse-2 as a lane task): 25 amendments accepted, 52 findings refused
143	Tiered breach bands that reopen planning, and skill text rendered from the record
144	Seats are routed on teamwork as well as capability, and every lap 2, re-seat and verification is a takeover to be measured
145	Every sentence shown to a user is ASD-STE100 Simplified Technical English, enforced by a lint, not a convention
146	A bootstrap map for imported repositories, and a re-audit of what the laps added
147	Plan-conformance pass 6 (record sha e81b38c, by builder-muse-2 as a lane task): 6 amendments accepted, 62 findings refused, first forgetting check 12 of 12
148	The host cell count must count only what the engine serves and what is really running
149	An attached Foreman holds the project seat through the lease, and can hand it back
150	A contract revision during build is the redirect C2, served by the Foreman's rpc
151	Plan-conformance pass 7 (record sha e38cbfe, by builder-muse-2): 4 new amendments accepted, 66 findings refused, forgetting check 9 pass, 2 superseded, 1 fail
152	Run 3's v4 was refuted on intent, rightly: the customer's brief never asked for an inquiry
153	Customer cards are served in build when the customer changes the brief
154	Why the exhausted seat was not seen: captured but unmapped, relayed but unrecorded, hooked only on the Foreman's login
155	The idb plugin bus is the only bus; Switchboard is out of the Foreman's procedure
156	Usage truth per vendor: every surface audited by the vendor's own seat, two sources reconciled, one truth view the scheduler reads
157	The host sweep never runs a vendor CLI under a scratch HOME; leaked panel sessions are reaped
158	Routing by intelligence class, then by pool headroom; use-it-or-lose-it; Kimi and Cursor join the roster
159	Pass 8 rulings
160	All four Claude logins' Fable 5.1 allowances are the Foreman's; the Foreman seat rotates across them as each Fable pool exhausts
161	A refused rpc is replayed from the record once its handler lands; the engine never waits for a human to repeat a message
162	An owner-relayed brief amendment is the customer's intent: the card recommends it, the proxy confirms it, and the engine resolves the pick before the Foreman sees it
163	Re-anchor: gate 1 of decision 129 is the only goal until it passes
164	Overnight mandate: ship end to end through the whole backlog, however long it takes; the original goal stands
165	The subtraction test and the incremental gate
166	A card decision made under a default the record has since corrected is voided at replay and the card is re-served
167	Status reports are plain language by phase
168	An intent panel without a valid quorum is inconclusive and re-runs; it never counts as a refutation; voided records are not claims
169	An open ask with no launch is woken from the record at boot and on every patrol tick; a wake is never only a notification
170	A panel that cannot reach a valid quorum is the factory's failure, never the proposer's: the engine re-seats it until it can judge, and a repeat of a pending proposal re-seats instead of refusing
171	The intent panel judges a redirect against the amended brief, and a seat's health is read by login, not by account row
172	A redirect withdrawn on a refutation whose panel materials the record has since ruled wrong is replayed from the record
173	An environment-cause C3 re-run that fails the same way every tick stops and says so; the re-run reads the re-snapshotted tree
174	A launch that never starts a container is re-launched within one tick, and a re-wake delivered while the member's previous launch is exiting waits for that exit
175	A redirect's C2 proceed writes everything a first C2 writes for the new claims, and a launch that cannot open its claim says so on the channel
176	Judges are graded against human labels, every line a seat reads carries its origin, materials put the brief and the question at the edges, failures are counted by class, and a seat never holds the lethal trifecta
177	Framework lanes work in their own worktrees; proof is part of done; two laps then a new brief; counted countermeasures; every brief says what is mounted
178	Five techniques from NVIDIA auto-ontology, as reimplementations, after gate 1
179	Every person is spoken to in their own clock; the record keeps UTC
180	A technical deep-dive site, generated from the record, is a standing artifact: the architecture page grows into it, the steward regenerates it each pass, the Foreman publishes it on the owner's word
181	The resume packet carries the live picture (shadow finding, 10:50 CST; parked behind gate 1 under 163(a))
182	Packet-only takeover is a rule; 181 is built first after gate 1 (owner choice on the shadow's recommendation, 11:45 CST)
183	After gate 2 the record is written as rows and rendered (owner choice on the shadow's recommendation, 11:45 CST)
184	C3 waits for the lane's launch to exit and its snapshot to land; a missing claim ref, an absent toolchain in /work, and a blocked tests reply are the factory's errors, never a lap or a silent stop
185	The loop prompt is a record row the resume packet carries; a takeover never composes it from prose
184	Ten papers reviewed against today's failures; six rules adopted, parked behind gate 1 (owner asked, 11:15 CST; Foreman inline, no council spend on the 79% pool)
187	An attached Foreman seat is woken by its mail; a turn never ends with mail waiting
188	A windowed inbox read never moves the member cursor; only bus_inbox consumes
189	A frozen test never asserts a band against the wall clock: usage fixtures carry a clock, or their resets are relative to the test's now
190	The yantra console: a separate deployment of the owner's dunkbot web shell pointed at factoryd, read-only first, every status derived from the record
191	Provisioning is proven by its postcondition inside the seat's container, never by an exit code on the host; an unprovisioned toolchain holds the claim instead of burning seat launches
192	The engine's graceful shutdown drains within a bound and exits; a drain past the bound is a factory error, never a hang
193	The Foreman's Fable truth is read from the login its launch records; a cell token's expiry is a seat-health event, never the Foreman's rotation trigger
194	A template ships its design system as a tool the lane can query; Astryx is a per-project option, never the default while Beta; the console stays on the dunkbot stack
195	Lessons are structured record rows the engine injects into a cell launch under a byte budget; unproven until a done reply cites them and the gate passes; the record is the only store
196	A project's lockfile is its template's own or none; a frozen install that reports a stale lockfile falls back to a regenerating install; an unprovisioned reason carries the install's stderr
197	A lane's whole-suite evidence runs against a database that is migrated to the lane's tree; stale schema is environment, never a lane failure
198	Prevention that makes gate 1's remaining steps testable is a run-3 unblock: a real-cell dark run of C3 to C7 as a gate stage, lane evidence on isolated databases and worktrees, and a gate preflight; run 3 keeps cycling meanwhile
199	The C3-to-C7 path reviewed before run 3 reaches it: thirteen faults preempted, the dark run re-scoped to the host engine, a configuration preflight, a driver-level factory_error recorder, one toolchain locator, and a guard against tests touching the live record
200	The first host rehearsal of the dark run: provisioning proven live; the template's own tests fail at import until a story lands, so the dark run follows the pipeline's order; the bistro fixture contract gains its defaults; the C3 hold-out coverage risk is on record
201	Agent quality as record rows: a rubric per lap graded by a different-family judge, a failure-pattern pass that proposes skill and config changes, and a quality page over time
202	Gitignored paths are never snapshot inputs, and the snapshot's excludes apply at the first pollution check, not only at the re-snapshot
203	An Engram-shaped query layer over the record, and Engram as the customer relationship memory
204	Drift between idb/build and main is measured on every tick, and a batch refuses to gate on a pick that depends on an unlifted commit