KATABATIC

the method :: four controls, three action classes, seven flight rules

CAP :: the diagnosis

A Chaos Agentic Pipeline is any agentic build system whose outputs can reach production without all four of: provenance-classed inputs, programmatic quality gates, cold-context review by eyes that did not build the artifact, and an explicit, default-deny human GO. Remove any one and entropy compounds silently at machine speed. The failure mode is not a crash; it is confident drift.

The name collides with Brewer's CAP theorem on purpose. The collision is inherited from a 2002 department joke about a Certified Administrative Professional, and it earns its keep: a Chaos Agentic Pipeline reliably achieves none of consistency, availability, or partition tolerance. Security practice has said CIA daily for decades and smiled about it.

The four controls, each with its absence mapped

controlwhat its absence did, in the corpus
provenance-classed inputstraining memory shipped untaught content into a live course while wearing the source material's clothes
programmatic gatesauthored material was transformed without a fidelity check: verified present, never verified faithful
cold-context reviewa builder reviewed its own work inside the same saturated context and missed a dropped block that an outside reader caught in minutes
default-deny human GOa typo gained scope because nothing required an explicit yes before work items spawned from it

Action classes :: what needs a token and what never did

build Make artifacts in the working directory. Draft, render, gate, measure, rebuild, throw away, try again. Needs no token. This is the job; it runs without asking.
commit Touch a locked file, an engine, a state file, a manifest, a live system, anything in a webroot. Needs the token. Every time. One token, one commit, its scope named.
ship Reaches a human who is not the operator. No token exists for this. The final gate is a person, and no token substitutes for that person's review.

Running an engine to produce a draft is build. It is not shipping. It was never shipping. Most of the wasted reasoning budget measured in the field program was models falling into exactly that hole, so the method now states it in the protocol file itself.

Provenance classes :: rule 2, the load-bearing one

classmeaning
in_context_nowraw bytes, visible, this session
crawledpulled by a live fetch this session
operator_declaredthe operator decided it, in the transcript; self-provenancing, true because declared, revocable by reissue
operator_recallthe operator remembered it: a lead, not a finding; memory rots on both sides of the collaboration, so go get the transcript
context_clearedthe fact persists in the session while its raw bytes were pruned; re-read before reuse
memory_summarydistilled prior-session belief, present in the window but not a source; it orients questions and never authors anything
training_memorymodel prior knowledge; never authors anything
the rule A blank field beats a plausible one. Never build on a reconstruction of a source you have not seen. Say so and wait.

The seven flight rules, digested

NASA flight rules exist because somebody once improvised at the wrong moment. These exist for the same reason; every one has a scar attached, and the full text rides in the kit.

1  BLAST-RADIUS ECHO   restate what will and will not be touched,
                       before touching anything locked or human-made
2  PROVENANCE CLASS    any claim about to drive generation names its
                       source class; training memory builds nothing
3  COLD-CONTEXT AUDIT  a fresh session reads only the artifacts and
                       hunts mismatches; builders never final-review
                       their own work in the loaded context
4  ARTIFACTS, NOT      if source material exists it gets uploaded
   DESCRIPTIONS        before the build; otherwise the build waits
5  AUTHORITY AT THE    the content authority reviews one unit before
   SAMPLE GATE         anything scales to thirty-four
6  TAG THE TURN        translate, decide, or execute; intake welcomes
                       questions, execution runs silent
7  ASK NAKED           state the question bare, then add color; a
                       buried ask goes unanswered for a week

The protocol, public edition

The current protocol file rides here in full, roles substituted, as of 2026-07-13: nosotros, the domain edition. Why it reads like a config file instead of a treaty is itself a finding, and that page walks it.

The ethics gate

Gate fifteen is the one gate added from foresight rather than scar, which the case-law rule permits and the record celebrates. It is a release litany answered out loud by operator and executor both. It has its own page: the strike point.