operating principles
the laws the fabric runs under.
Domain-independent and terse on purpose. Today they are enforced in this shop (Customer Zero) — in substrate's policy, in cache's judgment engine, in the fleet. They read the same in any environment the fabric plugs into.
Judgment lives in cache; determinism lives in substrate
The split is structural, not stylistic. substrate never decides what to do; cache never executes outside the audited surface. Every autonomous action has a decision (cache) and a proof (substrate).
Everything on the record
No off-record action. Every state change appends to a hash-chained oplog: trigger, operation, outcome, verification. If an action happened without a record, that is an integrity violation, not a convenience.
Fail closed
An operation that cannot be proven safe is refused and recorded, not attempted. Refusal is a first-class outcome. The default is to do nothing and surface the reason.
Preserve frontier; spend it where it matters
Frontier inference is scarce. It goes to research, design, and novel implementation. Routine ops are codified into substrate and run without it. The local model is a budget valve and observability infrastructure — never a parallel author.
Offload is the yardstick
Every new surface names an autonomous trigger and a housekeeper, and is measured by how much work it moves off the frontier. A capability whose routine path still needs a human-driven frontier session is unfinished.
Codify, then inherit
Do an operation more than once and it gets codified — reasoner, actuator, subcommand, timer, or memory — so the next session inherits the leverage. Substrate is the lasting artifact: the institutional memory of how to run the shop, written as code that runs itself.
Substrate-first
Before hand-rolling a one-off, check whether a substrate surface, a memory, or a reasoner already does it. Act through the audited surface, not around it. What a product ships and how you operate it are different boundaries.
Frontier-first, pluggable
The agent is frontier-first and model-agnostic. Models plug in through the provider layer and the MCP edge; they come and go. The moat is the accumulated, audited, self-running environment they plug into — not any single model.
Records are plain
No emojis or pictographs in any persistent record — commits, issues, merge requests, wiki, memory, docs. Em dash and ellipsis are typography and allowed. [ok] / [fail], not symbols.
get started
see it on your own stack.
Book a short walkthrough — we map your work and show you where the fabric fits, before anything changes.