THE IMPLEMENTATION VIEW · SOURCE-TRACED

Follow the code.
Find the control.

What writes the plan? Who starts the process?
What makes “approved” enforceable?

THE CENTRAL PATTERN

Read current facts → validate authority → commit a transition → perform the effect → observe the result.

SQLite coordinates state. The operating system contains processes. Git holds versioned artifacts. None substitutes for the others.

TRUSTED OPERATORBrowser / CLItoken + request boundary↓

GOVERNED ARTIFACTSGit

Specs · plans · source · checks

Intent → effect → probe → finalizer

ENGINE MAIN THREADAPI · Scheduler · Adapters

Short store commands.
External effects outside transactions.

STORE WORKER THREADSQLite

One connection · WAL · FULL sync

State + authority + events commit together

UNTRUSTED ROLE CODELauncher → namespace init → backend

A qualified Linux execution boundary, with cgroups, a private filesystem view and controlled egress.

Inspected at ded5d5a · store/worker.ts, store/transitions/tx.ts, invoke/launcher.ts, invoke/sandbox/mounts.ts. Paths on this page are relative to packages/engine/src/ unless stated otherwise. This is a code-reading explainer, not a new security audit.

01 / INTERACTIVE EXECUTION TRACE

Choose a mechanism.
Inspect each handoff.

Every step identifies the component, the state it touches, the rule it enforces and the failure it prevents. Click dotted terms for definitions.

CLICK A HANDOFF · ORDER IS SIGNIFICANT

READS / WRITES
WHAT THIS CONTROLS
IF THE RULE DOES NOT HOLD

CONCEPTUAL PSEUDOCODE · NOT A COMPLETE IMPLEMENTATION

INVARIANT

02 / WHERE HUMAN AUTHORITY ENTERS

Human decisions are records.
Gates are evaluations.

Yes, the database is checked. But the control is the validated transition—not a client setting an approved = true flag.

01 / AUTHENTICATEIs this an operator request?

The API checks exact authority, origin evidence and the engine token. The sandbox cannot obtain that authority through its normal mounts or network path.

02 / VALIDATEIs this still the shown decision?

In a store transaction, the engine reads the decision and recomputes its kind-specific preview from current dependencies. The offered option must remain legal.

03 / APPLYIs the effect still permitted?

Consumption and local effects or effect intents are durable. External-effect preconditions are re-read before execution; plan publication has its own guarded finalizer.

The human decision inventory

Grouped from the implemented DecisionKind enumeration. Open a row for its routing and enforcement. These are possible decision sites, not approvals required on every run.

AUTONOMY IS SCOPED

Fewer pauses, same floor.

step, stage and phase change scheduling boundaries. A conforming replan can register automatically; baseline-changing or uncertain work routes to the owner. These policies do not let the Builder approve its work or turn failed checks into passes.

D6 §§5.4, 6.5; scheduler/autonomy.ts; store/transitions/work.ts.

ALPHA ≠ GO-LIVE

Not every gate is human.

Alpha deployment can be requested manually or by approved policy. Both enter the same deployment request and authorization path. Future publication and Live approval remain part of the intended platform; they are not implemented human decision kinds in this snapshot.

D6 §6.8; store/transitions/deploy.ts; D5 remains later.

⌁ Why the token, Host and Origin checks are not the entire sandbox

The local API treats possession of its operator token as authority; its request actor is labelled human. That does not prove a biological person clicked, and it is not per-user RBAC. Trusted operator processes can automate API requests.

The normal browser token-bootstrap route is disabled. Its compatibility setting is an explicit exception because a local process can forge browser headers. When enabled it requires positive same-origin evidence; ordinary authenticated, origin-less CLI requests still use the token. The role boundary must keep the engine token, store, host sockets and API reachability out of the untrusted domain.

Trust is in the host kernel, service manager, engine/helpers and operator environment. This is not a promise against a compromised host or trusted operator.

api/server.ts:798, 827; api/boundary.ts:154; invoke/sandbox/plan.ts; D2 §§2.1–2.6.

03 / WATCH A STALE APPROVAL FAIL

Approval has a context.
Change it, and permission expires.

A small state-machine simulation of the answer → effect boundary. No engine API is called. The version numbers and digest labels are illustrative.

Try a change before answering. Then reset, approve first, change a dependency, and try the effect.

LIVE DEPENDENCY VERSION

PREVIEW SHOWN TO OPERATOR

DECISION

EFFECT INTENT

Based on store/transitions/decisions.ts:118; store/transitions/queue.ts:2021 and revalidateIntent; decisions/effects.ts. Real manifests bind multiple values and effect-specific facts. This lab intentionally models one dependency.

04 / HOW TO VERIFY THIS EXPLANATION

Inspect the enforcement point.

The explanations cite functions and files actually inspected in the checkout at ded5d5a. Pseudocode is condensed for teaching; it is not copied production code or an executable contract. External observations are prepared outside SQLite and carried into validated transitions where required.

Read state, do not invent it.

The store worker owns one better-sqlite3 connection, configured for WAL, FULL synchronization and foreign keys. transact() uses an immediate transaction. Git commands, process launch and streams are not held inside that transaction.

Database rows carry authority and observations. They cannot by themselves prove a process is gone, a git effect happened or a deployment is healthy. Those facts require an observed boundary or an effect probe.

store/worker.ts:1, 850; store/transitions/tx.ts:1, 85; journal/driver.ts:1; boundary/terminate.ts:1.

Current scope and limits

This engineering view covers the implemented M1–M5 mechanisms. Designer-specific approval and preview mechanisms are D7/M6 design, not code in this snapshot. The current local Alpha deployment path does not imply cloud, mobile-native or production support.

Inspection was read-only: no engine runs, paid model calls, service-manager operations or security probes. Website interactions are browser-local simulations. This walkthrough is an explanation of enforcement, not a claim that code inspection establishes every invariant.

Return to the full platform map →

Follow the code.Find the control.

Choose a mechanism.Inspect each handoff.

Human decisions are records.Gates are evaluations.