CAP :: the diagnosis
A Chaos Agentic Pipeline is any agentic build system whose outputs can reach production without all four of: provenance-classed inputs, programmatic quality gates, cold-context review by eyes that did not build the artifact, and an explicit, default-deny human GO. Remove any one and entropy compounds silently at machine speed. The failure mode is not a crash; it is confident drift.
The name collides with Brewer's CAP theorem on purpose. The collision is inherited from a 2002 department joke about a Certified Administrative Professional, and it earns its keep: a Chaos Agentic Pipeline reliably achieves none of consistency, availability, or partition tolerance. Security practice has said CIA daily for decades and smiled about it.
The four controls, each with its absence mapped
| control | what its absence did, in the corpus |
|---|---|
| provenance-classed inputs | training memory shipped untaught content into a live course while wearing the source material's clothes |
| programmatic gates | authored material was transformed without a fidelity check: verified present, never verified faithful |
| cold-context review | a builder reviewed its own work inside the same saturated context and missed a dropped block that an outside reader caught in minutes |
| default-deny human GO | a typo gained scope because nothing required an explicit yes before work items spawned from it |
Action classes :: what needs a token and what never did
Running an engine to produce a draft is build. It is not shipping. It was never shipping. Most of the wasted reasoning budget measured in the field program was models falling into exactly that hole, so the method now states it in the protocol file itself.
Provenance classes :: rule 2, the load-bearing one
| class | meaning |
|---|---|
| in_context_now | raw bytes, visible, this session |
| crawled | pulled by a live fetch this session |
| operator_declared | the operator decided it, in the transcript; self-provenancing, true because declared, revocable by reissue |
| operator_recall | the operator remembered it: a lead, not a finding; memory rots on both sides of the collaboration, so go get the transcript |
| context_cleared | the fact persists in the session while its raw bytes were pruned; re-read before reuse |
| memory_summary | distilled prior-session belief, present in the window but not a source; it orients questions and never authors anything |
| training_memory | model prior knowledge; never authors anything |
The seven flight rules, digested
NASA flight rules exist because somebody once improvised at the wrong moment. These exist for the same reason; every one has a scar attached, and the full text rides in the kit.
1 BLAST-RADIUS ECHO restate what will and will not be touched,
before touching anything locked or human-made
2 PROVENANCE CLASS any claim about to drive generation names its
source class; training memory builds nothing
3 COLD-CONTEXT AUDIT a fresh session reads only the artifacts and
hunts mismatches; builders never final-review
their own work in the loaded context
4 ARTIFACTS, NOT if source material exists it gets uploaded
DESCRIPTIONS before the build; otherwise the build waits
5 AUTHORITY AT THE the content authority reviews one unit before
SAMPLE GATE anything scales to thirty-four
6 TAG THE TURN translate, decide, or execute; intake welcomes
questions, execution runs silent
7 ASK NAKED state the question bare, then add color; a
buried ask goes unanswered for a week
The protocol, public edition
The current protocol file rides here in full, roles substituted, as of 2026-07-13: nosotros, the domain edition. Why it reads like a config file instead of a treaty is itself a finding, and that page walks it.
The ethics gate
Gate fifteen is the one gate added from foresight rather than scar, which the case-law rule permits and the record celebrates. It is a release litany answered out loud by operator and executor both. It has its own page: the strike point.