The Harness Plumbing — Where Work Outlives Its Workers

One dispatch through the pipes

Follow a single job — a build brief headed for codex at 2 a.m. — through the whole harness, including the night it goes wrong. Every stop is a pipe that exists, shipped this morning, or is being welded in right now.

1. A job is born: a brief and a fit list. The lead writes a self-contained brief and names the candidate engines — or says nothing and inherits the failed card's fallback chain. From this moment the job is data: everything downstream reads facts, never intentions.
   ↘ go deeper

   Fit list is caller-declared, defaulting to the card's fallback_engine chain (ratified call #2). A fully silent card set means honestly exhausted after one attempt — early surface, never a guess.
2. Preflight (#4, built tonight): the doomed dispatch never launches. Before any engine is paid, the job's declared domain is checked against the target card's facts. A card that says this engine cannot take this work refuses or reroutes on the spot. A card that says nothing lets the job through — a preflight that guesses is a quieter failure than the one it prevents.
   ↘ go deeper

   Same pure decision module as the failure walk, pointed before spend (reroute-decide.py --preflight). Guard facts fail closed (the frozen security guard's law); capability facts fail open. The existing before-spend security swap in route.sh is untouched — one law per layer. The too-eager guard is a first-class twin arm: the proof that a silent card DISPATCHES ships alongside the proof that a filtered card refuses.
3. Through a door: isolation, a clock, custody. A chaperone hands the brief through one of four doors. The engine works in a sealed worktree or a cloud runner — never the live checkout — under a hard timeout from its own card. Whatever it produces is committed to a bay branch by the door, not by the engine's good manners. A dead worker leaves no wreckage.
   ↘ go deeper

   Sealed room (run-sealed.sh, any engine with a card) · api lens (api-worker.sh, single-shot second opinions) · sandbox lane (Cloudflare containers, capacity builds) · codex cloud (their runner, our notary — diff custody, isolated clone, fetch-back). One ledger row per run, every lane, battery-proven.
4. The typed word (#1 — shipped this morning): failure becomes a value. However the run ends — finished, starved, filtered, cancelled, door-sick — the door hands back one machine word from a closed set of seven, on every exit path. Prose never decides anything again. This is the socket the entire pipeline layer plugs into: you can only route around a failure that comes back as a value.
   ↘ go deeper

   bay-src/bin/door-result.py: {ok, category, reason, partial} with seven categories — complete, nothing_to_do, engine_failed, timeout, refused, cancelled, door_failed. The projection derives ok; downstream routes on the projection ONLY, never on reason text or report prose. All four doors emit it as of 0.6.119, live on this machine and published.
5. The failure walk (#2, built tonight): the job moves itself. The word says the engine died. A pure decision module — facts in, decision out, recomputable by anyone — reads the word, the cards, and the attempt history, and names the next fit engine or stops honestly. A thin loop re-dispatches clean from the same starting point. The lead hears exactly one of two things: finished work, or one complete failure chain. Never a mid-flight death. Three handmade per-engine patches become one mechanism.
   ↘ go deeper

   What walks: engine_failed yes; timeout only to a strictly larger clock (same-size retry is the banned blind retry); refused only when a card fact explains the refusal and another family clears it; cancelled and door_failed never (an operator's stop is respected; a sick door surfaces — rerouting through it burns spend and hides bay breakage). Budgets: 3 attempts, each engine at most once, wall ceiling 2x. Partials: attempt N+1 starts clean, every partial's branch rides the record named out loud — your ratified amendment of the double-carry gate. The module gates spend, so it joins the dangerous-files list: every future edit demands a declaration and a non-author court.
6. The pipeline record (#3, built tonight): the job's memory leaves the lead's head. Every attempt writes one line — engine, word, decision, the card facts read — into a record that is itself the job. A multi-step pipeline (build, court, cure, walk) becomes a recomputable object on disk. The crash that once lost a seven-gate deploy because it lived only in a session's context becomes structurally impossible.
   ↘ go deeper

   Grows from the reroute record's shape (staging/reroutes/<job>.jsonl — the intent names it the embryo on purpose). Design is being duelled tonight by two independent pedigrees, cross-refuted, then synthesized into a draft intent for your pen. Rubric: append-only, one writer, recomputable, cold-session resumable, zero settlement-side machinery — Quanta stays dry dock. Replay property: run the decision module over the recorded facts and get the identical decisions byte-for-byte.
7. Cold resume: a session dies, the work does not. A brand-new session — no context, no memory of the job — reads the record and continues from the exact step where the last session died. The proof is the acceptance walk: kill a live pipeline after step one, hand a cold agent nothing but the record's path, watch it finish.
8. The flywheel: recovery teaches prevention. A failure gets recorded with its cause. The cause becomes a fact on the engine's card. The next preflight reads that fact and refuses the repeat before spend. Recovery (#2, #3) feeds prevention (#4) through the cards — the harness gets harder to hurt every time it is hurt. No scores, no predictions, ever: facts recorded, facts read.

What only you can decide