Quanta → team-operational

The frame (read this first)

Parked on purpose. The deeper harness dream (context-as-ledger) is the NEXT arc. This spec is scoped to one thing: get Quanta producing for the team on the architecture we already proved.

The engine works. Proven today: a green gate sheds a currency-stamped receipt to the ledger, verifiable from git. The gap isn't the engine — it's the on-ramp.

The bar. "Works on the repo that built it" is NOT "works for the team." Done = a teammate who isn't me, on a repo that isn't quanta, banking a verifiable receipt.

Two real traps, both dogfood-found. The on-ramp still writes the KILLED in-tree design, refuses matrix repos, and calls a command name that isn't installed — so it silently does nothing and looks fine. The exact pattern we're killing.

The rollout — five moves in order

Follow one thing through: a teammate's repo, from unwired to visibly producing. The first two moves are the real work; the last three are fast once they land.

Where we are. Quanta is activated on its OWN repo (moment #1): every green gate run banks a receipt to refs/genome/ledger, durable on GitHub, recomputable from git. Zero of that reaches a teammate yet — the on-ramp generates the old, wrong wiring.
1 — Port the seed to the off-tree ledger. The tool that wires a repo still writes receipts INTO the tree (collides with the gate) and commits them to protected main (the knot we dissolved). Make it generate the NEW wiring — banks to the ledger ref, the exact path we proved. Until this, there is no correct team path at all.
↘ go deeper — the exact generator changes

src/cli/onboard-cli.mjs: inline mint (~L390) quanta deposit …--repo . → quanta ledger bank …; buildDepositWrapperScript (~L556) action → ledger bank (fail-safe contract kept); CI banking job (BANKING_JOB_PREFIX, ~L785) replace git add genome/deposits + commit [skip ci] + push HEAD:REF with quanta ledger bank + quanta ledger push (push refs/genome/ledger, no tree write, no protected-branch push). Docs + onboard generator tests re-pinned to the ledger-ref shape; red-first pin that the OLD in-tree shape is no longer emitted.
2 — Fix the two on-ramp traps. (a) The seed refuses to wire any repo with a CI build matrix — and real repos have them (my Windows matrix tripped it). (b) The receipt step calls quanta, but the CLI installs as plato — so it fail-safe-skips and looks wired. That's the fides silent-no-op, shipped by default. Both are fleet-stoppers.
↘ go deeper — the two fixes

2a matrix — RATIFIED policy A: drop the matrix refusal for the ledger path; place the bank step on every qualifying job/leg; receipts stamp which leg banked them. F1 fail-closed family stays for genuinely-unresolvable entrypoints. 2b name — RATIFIED both halves: (1) install uniformity — install guarantees a quanta command, plato quiet alias, all team-facing wiring says quanta; (2) resolver insurance — buildDepositWrapperScript (~L584) spawnSync('quanta',…) → resolver (quanta → plato → repo's own node src/cli/plato.mjs). Fixtures: plato-only machine still banks, never skips; fresh install exposes quanta.
3 — Turn on CI banking (moment #2). CI pushes receipts to the ledger ref after a green run — so receipts appear even from work nobody runs on their laptop. Small now: the protected-branch decision is gone (the ref isn't protected).
↘ go deeper

Mostly falls out of Step 1 (the CI job emits ledger push). Confirm CI creds can push refs/genome/* (verified live on quanta today). CI check: a green run advances refs/genome/ledger on origin.
4 — Plant the pilot repos, end-to-end. Ratified: neuron, eve, arby (Robert) · prism (Lukasz). Order: arby or eve first (smallest blast radius), then neuron (isolated clone — never race the live checkout), then prism with Lukasz driving — that one is the actual proof of "operational for the team." A lead operation, not a code change: run the ported onboard, merge, trigger a green run, verify the receipt from a clean checkout.
5 — Build the fleet view (see it producing). One surface: per repo, does the ledger ref exist, how many receipts, newest age — and a named CANNOT-SEE state for never-banked. Without this you can't tell "producing" from "silently skipping" — exactly how it looked fine this morning while doing nothing.
↘ go deeper — the honest-judge test

Extend the existing quanta fleet read-only aggregation with a receipts column. Frame-fitness judge (both poles pinned): a wired-but-silently-skipping repo must show VISIBLY different from a producing one — never a blank that reads as "fine." That difference IS the structural guard against this morning's failure recurring.

What could go wrong (honest)

Duplicate receipts from matrix/multi-job runs — off-tree makes them cheap, but the ledger gets noisier. A dedupe view if it bothers.

The ledger ref grows unbounded over months — a rotation/hygiene question, deferred but named, not forgotten.

Silent-skip returns in a new costume on a teammate's machine — the fleet view (Step 5) is the structural guard; without it we're back to "looks fine."

The pilot's setup differs (Windows, no toolchain) — the cross-platform gate + robust resolver are the defenses; the pilot surfaces what we missed, which is the point.

Your calls — ratified 2026-07-18

Sequence — confirmed. 1 & 2 together (the on-ramp) → 3 → 4 → 5.

Matrix policy — A. Bank from every qualifying green run/leg; per-platform receipts are signal, not noise ("Windows receipts stopped Tuesday" becomes visible). The fleet view groups by commit — the cost lands on machines, not on every teammate who onboards a repo.

Name — kill the dual name. "Plato naming is just causing confusion, i want the simplest path to full functionality." Everything the team sees says quanta; the install guarantees the command; plato stays a quiet alias; the wrapper keeps a resolver fallback as invisible insurance so a name mismatch can never again silent-skip.

Pilots — named. Robert: neuron, eve, arby. Lukasz: prism. Lukasz-on-prism is the bar-setting pilot — someone who isn't the lead, on a repo that isn't quanta.

Fleet view — minimal now; richer chartered. This rollout ships the producing-vs-silently-skipping guard. The richer view — connections between repos, the larger world model — is its own next arc, with this ledger as its data source. Sequenced, not dropped.

Done = a teammate who isn't me, on a repo that isn't quanta, banks a currency-stamped receipt from a real green run — and the fleet view shows it current. Anything short of that is partway. | Canonical source: docs/ai/SPEC-quanta-team-operational.md