The Genome Master Plan

The story

We spent a day trying to get agents to use a code map, and discovered we were building the wrong thing for the right reason. Agents don't need help — five straight experiments proved they are relentless, skeptical, and correct on any code they can read. What they need doesn't exist yet anywhere: a world that remembers. Every truth an agent derives today evaporates when its session ends. Every verification is paid for again tomorrow. The whole agentic world is an oral culture — brilliant, and amnesiac.

The end state is written memory for that world: the genome — settled truth, deposited as a byproduct of work, carrying receipts (a re-runnable proof), currency stamps (proof it's still true now), and honest fences (where it can't see) — held in one shared ledger that agents' own tools stand on and humans' own dashboards render from. Nobody adopts it. Work secretes it; work reads it; arithmetic makes reading cheaper than re-deriving; and an independent auditor tries to catch it lying, forever, because today we caught our own truth layer wrong by 63 files and the auditor we improvised is now the most valuable thing we own.

The end state, measurably

1. Verification compounds: the cost of the factory's full quality gate on an unchanged basis approaches the cost of checking receipts (target: >70% of gate legs skipped-with-proof on a typical increment; full re-mint on every trunk merge as the floor).
2. Workers born knowing: a cold agent/session resumes real work from genome reads alone — zero hand-written handoffs (target: HANDOFF docs retired; priming cost measured down >50%).
3. The world audited: every genome answer carries pin + receipt + fence; an independent recount runs continuously; a planted lie is caught within one cycle (proven mechanism — keep it red-teamed).
4. One core, many consumers: Eve, Fides, and DE Brain read/write the shared ledger contract instead of maintaining four private reimplementations (the substrate audit's finding).
5. Humans see honest surfaces: leadership dashboards and briefs render from the genome with the same stamps ("current as of… blind about…").
6. Fleet change with receipts: one shared-truth edit expresses across Neuron's fleet with per-site conformance receipts instead of per-site QA.
7. Intent has currency: North Stars and rulings live as deposited facts; "does this week's work still serve the point" is a checkable query (Eve, at the intent altitude).

What I decided and why — in consequences

• Structural-first, never voluntary. Every experiment that asked agents to trust or adopt, failed; every tool simply placed in their hands got used. So the genome arrives inside hooks, briefs, dispatches, gates, and tool results — the water, not the medicine. Consequence: internal delivery is a wiring task we fully control; persuasion is dead as a strategy.
• Deposits are byproducts, not products. Agents will never stop re-verifying — good; their re-derivations mint deposits and audit the ledger for free. Consequence: "adoption" dissolves as a concept.
• Two planes, one namespace. Facts append forever; intents (in-flight claims) lease and expire, and mint facts when resolved — never share a row shape (frame-fitness verified against four fields). Consequence: no Command-Sourcing rot, no tuple-space collapse, one migration avoided.
• One core, many consumers. Four DE systems independently reinvented provenance+supersession+fail-closed with zero shared code. We build the ledger core once; Eve/Fides/DE Brain consume. Eve 2.0's doctrine is the best-proven — steal it, and seat Eve as the intent-altitude projection. Consequence: the fourth reimplementation never gets written.
• Prove-first sequencing. Everything lands on Plato (cheap to be wrong) before Neuron (expensive to be wrong) before clients (unforgivable to be wrong). Consequence: the flagship only ever inherits proven machinery.
• Both verification layers are permanent. Work-verification (adversaries on builds — already caught and bounced a bad build tonight) AND world-verification (the swarm recount on the map itself — already caught the 63-file lie). The reviewer is never the author, including when the author is the truth layer.

The workstreams, at map altitude

• W1 — Verification capital (in repair loop now): the deposit ledger; gate legs bank receipts; unchanged basis = skip-with-proof; full re-mint at every merge. Kill: if receipt upkeep costs more than re-running, stop and study.
• W2 — The standing world (v0 merged): harden the genome service — auth, tenancy, deploy (Cloudflare), multi-repo; never-serve-stale stays mutation-tested. Kill: none; hygiene-paced.
• W3 — Workers born knowing: dispatch briefs and session hooks become genome reads; agent derivations deposit automatically; handoff docs retire. Gated on W1's ledger. Kill: if genome-read briefs measurably underperform hand priming, study before scaling.
• W4 — The intent plane: leased claims + rulings + North Stars on the shared core; Eve consumes as its projection. Gated on W1 + the two-plane contract. This is where Eve stops being a private reimplementation. Consumer arithmetic, closed: four reimplementations collapse to one core — Eve seats first (W4), DE Brain seats second (a named W4 deliverable — it is the live-in-production case and the highest-friction migration), Fides seats at W8, and de-memory is absorbed and retired as pattern-donor (its two-plane split is the ratified schema).
• W5 — Human projections: the two-altitude doctrine applied to dashboards/briefings — rendered from the genome, stamped with currency and blindness. First surface: the leadership brief.
• W6 — Neuron inherits (the business): adapter + fleet blast-radius with per-site receipts; first real fleet-wide change ships with receipts and a measured QA delta. Prove-first gate: W1–W3 green on Plato first. (Known debt: the adapter's cited spec never existed — rebuild from the deposited recon, honestly.)
• W7 — Currency beyond git (research): what "current" means without a commit SHA — source-of-record pointers, freshness windows, honest fences. The one true research risk; run as falsification probes, not a build.
• W8 — The authoritative record → certification layer (parked): practice genomes feeding Fides and AI surfaces; then cross-org receipts. Un-parks only when W6 ships its first receipted fleet change.

Critical path: W1 → W3 → W6. W2, W5 ride alongside; W4 joins after W1; W7 runs as research throughout; W8 waits.

Your calls, standing

1. Red-pen this page (the annotatable surface renders when you're at a screen).
2. The fold-in draft (#53) — ratify the consolidated roadmap.
3. W4 kickoff timing — when Eve's seat gets built (after W1 proves, my recommendation).
4. Alie is a gate, not a memo. Her survival frame (revenue, runway) formally gates W6 kickoff — the moment the program touches the business, her pushback is a gate, not input. Concretely: W5's first rendered artifact is HER brief (the story + the wall-clock spent + what W6 defers), delivered when W1 is demonstrable — which it now is. Nothing revenue-deferring proceeds past W6's gate without her frame heard.
5. Scope note (deliberate): the DE team's human touchpoints begin at W5 (rendered briefs) and W6 (fleet work) — Stages before that are Plato-internal by design.
6. Standing ownership: the planted-lie drill against the genome (not just the code graph) is W2's permanent obligation — as the ledger grows facts, intents, and practice truth, the recount grows with it. The day it stops being red-teamed, this program has failed its own thesis.

What could go wrong, honestly

• The compounding never pays (receipts cost more than re-runs) → W1's kill criterion catches it in days, on Plato, cheaply.
• Currency-beyond-git resists → W7 is fenced as research; business-truth surfaces stay fenced-honest ("unverified since Tuesday") rather than lying — degraded, never false.
• The genome gets trusted and then lies once → the standing recount + planted-lie drills exist precisely for this; the day it stops being red-teamed is the day this program has failed its own thesis.
• Fragmentation persists (teams keep private truth layers) → the substrate ruling makes the core the cheapest option; if consumers don't migrate, that's a signal to study, not to mandate.
• Agents re-verify by default — our own strongest finding. Six of six re-checked an oracle billed as never-wrong; the one calibration data point re-derived everything anyway. End-state #2's cost collapse may not come from trust at all. So "W3 green" is defined on the machinery bar, not the trust bar: structural consumption wired + deposits flowing + briefs measurably not-worse than hand priming. That unblocks W6. Voluntary trust-savings are upside, tracked by W3's instrument — never load-bearing.

The standing commitment (Robert, 2026-07-01: "make sure we don't stop until this vision is real and proved transformative")

This program does not stop at merged code. It stops when the proof bar is met — or a kill criterion fires and we say so plainly. The proof bar, measurable: (1) the three counters — facts minted · reads · re-derivations avoided — compound for four consecutive weeks; (2) one documented real task completed at ≥5× lower cost because settled truth was read, not re-derived; (3) W6's first fleet change ships with receipts and a measured QA-effort delta. Until all three: every session inherits this mission from this page and the latest STATE deposit, advances the critical path, and reports the counters. No hyperbole — the numbers carry the claim.

How we'll know it's working

Each workstream's definition-of-done is a measured number on this page's end-state list — and the meta-signal is singular: each build cycle should get cheaper than the last on unchanged ground. The week the gate's skip-rate first exceeds half with every skip carrying a receipt, the thesis is realized in miniature. Everything after that is scale.

LAYER 2 — machinery below this fence: expanded by workers, graded against Layer 1, Layer 1 wins on conflict.