~90
rooms
One project each: repo, address, paper trail.
What has been built
Rooms with something running in them.
A room is one project: its own repository, its own address, its own paper trail. Of roughly ninety of them, about forty hold a real running application and about eighteen are deployed to a public address. The rest are scaffolding, spec-stage, or retired — and saying so is more useful than a number that counts empty directories.
~40
running apps
Real software people use, not demos.
~18
publicly deployed
On their own addresses, access controlled.
39
graduated
Passed their gates and left the underground.
Fire-safety inspection. A technician scans an asset,
runs the inspection, captures photos and a signature; a PDF certificate is
rendered and archived. The field entry point is deliberately auth-free —
nobody types a password on a ladder.
At-home clinical screening. A phone reads a test kit and
returns a risk score and a next step. Every piece of clinical logic is
server-side, versioned and audited, each production gate held down until
signed off.
School management. Admissions through to a parent portal
— 332 of 336 requirements covered, ~2,200 tests. The suite is barred from
running at night because it would notify real parents.
Cafe and venue operations. Counter order to end-of-day
close-out, with bar items routed to a bar screen and kitchen items to a
kitchen screen. Five surfaces, one per person who works there.
The full catalogue, and the stack underneath it →
As of 2026-08-20. Client work described by function only.
What they were built with
An operating system that acquired a constitution.
C10:OS is text-default and CLI-first, work organized into numbered rooms, every change carrying the reason it was made. What changed is the part nobody plans for at the start: the system got large enough that its own record became the thing most worth protecting — and a record anything can write to is not a record. So the machine grew a governing layer: ratified doctrine, an admission gate, an append-only ledger of crossings, and an evidence trail behind every claim. Nothing self-admits. Not a document, not a decision, not this page.
The rest of this page is that layer — the parts that make the work above repeatable rather than lucky.
31
services
Registered with a role, a room, and declared dependencies.
4,050
recorded reasons
Append-only, since 2026-02-05, across 142 services.
131
evidence records
Claims reconciled against content, not against assertion.
7
fleet nodes
Each with a role, a profile, and a rollout stage.
The record
Git records what changed. The chain records why.
Every command that changes state takes a --why and refuses without one. The reason lands in an append-only chain beside the commit, so the question that actually gets asked six months later — why is it like this? — has an answer that outlives whoever typed it. This is the oldest rule here and the one everything else was eventually built to protect.
2026-08-20 08:50www
The apex ran an engineer-facing manifesto with no working call to action while another door ran a contradictory story with the only live intake; one front door was chosen so the site states one thing.
2026-08-20 09:01www
The last door still filed leads somewhere else; converged so every public door writes into the same queue.
2026-08-18 12:34atlas
Renamed a room across scaffold, registry, and roster in one pass — a rename that touches four places is a rename that gets half-done.
Quoted from the chain, trimmed for length. Room and client identifiers withheld.
The governing layer
Nothing self-admits.
A rule of recognition never recognizes itself. Every admission rests on something it cannot itself admit — so the regress is terminated, not hidden, at a declared external anchor, and the machinery below it is split into two organs that check each other. Fuse them and "the evaluator computed it" starts to masquerade as legitimacy.
Regulator
Holds the criteria
Applies the ratified tests and issues the verdict. It can only disqualify — its authority is delegated, never invented. It supplies governance, not a record.
Recorder
Holds the ledger
Append-only, replayable log of crossings. It makes admission reproducible and accountable. It buys replayability, not authority. No record, no admission.
Terminus
Holds the anchor
The founding act the graph cannot contain. It grounds admission and is never produced by it. A ratification is the sufficient step; eligibility is only necessary.
A crossing records an event, never a conclusion — that a probe ran, that a file was read, that a proposal was admitted. What the event establishes is a separate claim that references it and can be challenged on its own. That keeps the ledger a log of what happened rather than of what someone decided it meant.
26 candidate principles have been staged; 9 crossings are recorded; 35 assessments sit behind them. Objections are first-class and filed as their own records — and when none were raised, the ratification says so, because an empty objections folder must never be ambiguous between unused and unmet.
The boundary
AI can ask. Only code decides.
Automation proposes constantly here. It never holds the pen on what leaves. A deterministic gate sits at the boundary: policy decides, and every crossing — allowed or refused — is written to a hash-chained, signed receipt ledger, so a refusal is as auditable as an approval. The layer that negotiates what an outside party needs is blind by construction: it can describe the requirement without ever seeing the data behind it.
No language model sits on the release path. Plans are checked against declared policy before execution, not reviewed for plausibility afterward.
Working rules
The parts that don't bend.
CLI-first, text-default. Human-readable output
unless JSON is asked for. If it can't be read in a terminal, it isn't
finished.
--why is required. A state change without a
recorded reason is refused. The chain is the product; the command is the
interface to it.
Config cascades. One spine holds the registry,
roster, and profiles. A second implementation of an answer is a second
answer, which is the whole bug.
Rooms earn their way out. Prototypes live
underground until they pass their gates. Graduation is recorded and hashed,
not announced.
Identity is per-session, never per-machine.
Any source with one value for a whole box cannot tell two concurrent
sessions apart, and will hand you whoever touched it last.
Publish the bar before the claim. Measured
gates are pre-registered, then reported — including when the result is
unflattering.
Honest status
Load-bearing, and still forming.
Load-bearing
- The reason chain — 4,050 entries, relied on daily
- Room scaffolding, gates, and recorded graduation
- Service registry with declared boot order
- Publishing rooms to their own addresses, access by email
- Fleet rollout by role, profile, and stage
- Session-bound identity resolution with a single resolver
Still forming
- Composition — which operator acts next is deliberately unresolved
- The governing layer is young: most doctrine sits in trial, with review triggers attached
- Egress receipts are live; hardening continues
- Machine-inferred proposals — the half of the loop barely exercised
The open question is named on purpose. Everything above defines what gets preserved and how; none of it defines what selects the next move. Hard-wiring a pipeline would close that cheaply and wrongly, so it stays open until the answer arrives as its own operator.