Mutation Stays Deliberate

"'It can't change anything yet' isn't a bug report. It's the safety catch, held on purpose until each trigger is proven."

Disabled is a posture, not a defect

Watchfire ships to production with mutation disabled, and it stays that way on purpose. This isn't an unfinished feature waiting to be switched on; it's the automation boundary, held deliberately. The engine can see everything and — until an operation earns otherwise — change nothing. It's the exact discipline the first track opened with, now standing as a permanent stance rather than a starting one.

Power is earned per operation

An operation turns its power on only after it passes a specific gauntlet: the required implementation exists, an exact-plan review passes, the executor is enrolled and authorized, and Dad gives a revision-bound approval. Miss any one and the operation stays off. Power doesn't arrive by flipping a global switch to on — it arrives one earned operation at a time, which is what keeps the blast radius of 'we turned it on' small enough to reason about.

Manual evidence is never an executor receipt

When Dad operates a target directly — sits down and fixes it himself — that creates manual evidence, and it is never laundered into a Watchfire dispatch. Receipts exist only for signed jobs the executor actually ran. The engine records what it truly did and clearly marks what a human did instead; it never dresses a person's action up as a machine's receipt to make the log look more automated than it was.

The gates stay, even when the power is on

And enabling an operation doesn't remove its guards. The mutating kind and risk class are still validated at definition, claim, and start, and a mismatch still fails closed in every mutation mode. Earning the power to act is not the same as earning the right to skip the checks — those hold for the entire life of the operation.

Keep the safety on until each trigger is proven, and keep the gates after. Disabled-by-default plus earned-per-operation is how a system stays powerful without ever getting casual about it.

Code

Power is earned per operation, not switched globally·python

def may_run(op):
    return (op.implementation_exists
        and op.exact_plan_reviewed
        and op.executor_enrolled_and_authorized
        and op.dad_approved_this_revision)

# Production default: mutation DISABLED. An operation runs only if it has
# earned every gate above -- and even then, kind/risk are re-checked at
# definition, claim, and start, failing closed on any mismatch.
if watchfire.mutation_mode == "disabled" or not may_run(op):
    record_manual_evidence_if_any(op)   # a human may have done it -- that's EVIDENCE,
    refuse_dispatch(op)                 # never a synthesized executor receipt

Exercise

Take a powerful action in a system you run (deleting data, sending to customers, changing production config). Design it 'disabled by default': list the specific gates that must all pass before it can run, and decide how you'd record the times a human did the same thing by hand — without ever labeling that human action as an automated success.

Hint

The gates are your earned-power list: implemented, reviewed, authorized, approved-for-this-version. The manual record is honest bookkeeping: 'a person did X at time T' is evidence, and calling it 'the system did X' — to make the automation look more complete — is exactly the self-flattering log this lesson warns against.

Disabled is a posture, not a defect

Power is earned per operation

Manual evidence is never an executor receipt

The gates stay, even when the power is on

Code

External links

Exercise

Progress

Comments 0