SIGNIT Operator Runbook — Autonoma/Intelligence

00

The control contract

SIGNIT is not a single autonomous agent. It is an artifact-driven intelligence system with a deliberate separation between human authority, agentic work, deterministic assurance, and external execution.

Human decides

thesis and Brief spine
architecture and policy
provider and model authority
canonical decisions
editorial approval
publication, deploy, and send

SIGNIT executes

source sensing and lineage
agentic analysis
claim verification
route memory
assurance surfaces
audit artifact generation

Agents may

propose findings
challenge assumptions
summarize bounded evidence
inspect approved sources
return structured artifacts

Agents may not

self-promote claims
override current finality
infer missing authority
publish, deploy, or send
mutate outside a work order
hide uncertainty or failed proof

Who owns what

Role

Owns

Hard boundary

Human

System architecture, task authorization, evidence judgment, editorial signoff, publication, deployment, and subscriber send.

A bounded approval never grants adjacent authority.

Orchestration Agent

LLM-backed operator-side orchestration layer: exact-state reconstruction, evidence packets, Brief and Audit Packet preparation, work-order coordination, package binding, independent verification, and backfill work orders.

Access to execution tooling does not create publication authority.

SIGNIT

Research, provenance, structured analysis, adversarial pressure, finality, route memory, deterministic assurance, and operator-state surfaces.

SIGNIT neither authors nor publishes the final Brief.

Bounded agents

Scoped implementation, analysis, review, rendering, or deployment from an exact work order.

Agent output is evidence until independently reviewed.

01

Architecture

The pipeline accumulates signal without allowing accumulated signal to become truth by default. Agents widen sensing and create pressure; deterministic rails decide what can move; route memory decides where to look next; humans decide what the system may say or do.

Detailed system map Open the system architecture + agent blueprint

See runtime planes, component contracts, agent anatomy, evidence paths, and control gates.

System flow · six layers

1

Source sensing

Input public documents, filings, reports, feeds Output timestamped observations

2

Ingest + lineage

Input raw observations Output normalized records + provenance

3

Agentic analysis

Input bounded source capsule Output findings, synthesis, objections

4

Evidence finality

Input claims + sources Output supported, contested, non-final

5

Route memory

Input finality, freshness, red-team pressure Output reinforce, decay, hold, recheck

6

Human control

Input evidence packet + assurance Output approved action or hold

Operating rails

Agentic work

Generates candidate findings, synthesis, adversarial pressure, and summaries. It cannot publish or override finality.

Deterministic assurance

Parses, validates, ranks, enforces provenance and state precedence, checks finality, detects stale surfaces, and fails closed on current-run conflicts.

Human judgment

Selects the thesis, reviews evidence, signs copy and corrections, authorizes external action, and retains accountability.

Non-negotiable gates

source lineage

current-run finality

state precedence

graph is advisory

exact authorization

public audit packet

Route memory · closed loop

ObserveEmitAggregateRouteGate

Attention is not truth.
Route pressure cannot override finality.

02

Start a task

Every task begins with an exact bind. Transient facts are read from current evidence, never hardcoded or reconstructed from conversational memory.

Startup bind

01current ET date and timerequired

02task classrequired

03canonical branch + exact HEADrequired

04exact run ID or Brief IDrequired

05source-of-truth boundaryrequired

06highest-priority next actionrequired

07no-touch constraintsrequired

Start sequence

Read the current operating procedure and the task-specific contract.
Bind the canonical repository, active worktree, exact run or Brief, and current authority.
Check for active writers, locks, scheduler proximity, and overlapping agent work.
Classify the task before selecting tools or changing state.
Read exact evidence in source-of-truth order and distinguish proof class.
State the next action, expected outputs, validation, rollback, and no-touch boundary.
Fail closed if the intended action exceeds the bound authority.

03

Run modes

Task class is an execution boundary. A task never drifts into a more consequential class because the tools happen to be available.

SIGNIT task classes and guardrails
Mode	Purpose	Mutation boundary	Exit evidence
READ_ONLY_REVIEW	Inspect exact repositories, artifacts, databases, and records.	No mutation.	Bound findings with source and freshness.
EDITORIAL_AUTHORING	Prepare human-controlled Brief or Audit Packet copy.	No publication or lifecycle advancement.	Reviewable draft bound to evidence.
BOUNDED_IMPLEMENTATION	Make path-scoped code or test changes from an exact work order.	No adjacent cleanup, commit, push, or deploy by implication.	Diff, focused tests, rollback proof.
ADVERSARIAL_AUDIT	Challenge architecture, assumptions, claims, and test gaps.	Read-only by default.	Supported findings and rejected hypotheses.
PUBLICATION_PREP	Build and validate one exact package; bind hashes and executor.	No push or deployment.	Manifest, preflight, authorization request.
PUBLICATION	Publish one exact, separately approved package.	One executor; no parallel path; no send authority by default.	Source commit, deployment receipt, live verification.
MANUAL_RECOVERY	Diagnose and recover a failed scheduled or external proof path.	Preserve evidence; use the narrowest reversible action.	Recovered proof, rollback path, incident record.

Runtime boundaries

Production research

May call approved providers and write production state. Runs only on the scheduled or explicitly authorized path.

Assurance

Report-only validation of completed work. It does not rerun production agents or repair truth by mutation.

Route-memory apply

One authorized post-run writer. Manual graph or route edits are prohibited recovery shortcuts.

Publication

Occurs outside SIGNIT after a separate exact-package authorization. Deployment and subscriber send remain different proof classes.

04

Evidence and finality

A coherent narrative is not sufficient evidence. Every load-bearing claim must carry traceable provenance, survive verification and adversarial review, and be final-supported in the current run before it can support a Brief.

C

Candidate claim

proposed assertion or finding

L

Source lineage

origin, retrieval context, dependencies

V

Verification

automated checks + structured validation

A

Adversarial review

overclaim, mismatch, weakness, limits

F

Current-run finality

supported, contested, caveat-only, non-final

R

Brief readiness

cleared for human-controlled assembly

FAIL-CLOSED RULE: a stale pass, route signal, or older scoped recheck cannot override a current-run conflict.

Status language

GREENApplicable proof is present, current, and clean.

AMBERProof is pending, interpretation is required, or output is expected runtime state.

REDA gate is blocked by unsafe drift, active runtime, missing proof, or failed validation.

Distinction ledger

route pressure≠evidence

assurance verdict≠proof artifact

controlled draft≠publication

mirror durability≠public release

deployment≠subscriber delivery

Proof classes are not interchangeable

SpecificationDefines intended behavior; proves no implementation.

ImplementationShows the mechanism exists; proves no current run.

Deterministic testProves a bounded contract under test conditions.

Historical replayReconstructs past behavior; is not natural scheduled proof.

Current projectionDerived state bound to authorities; may become stale.

Natural runExact scheduled execution with its own run identity.

PublicationExact public bytes, commit, deployment, and live URL.

Subscriber deliverySeparate send/run receipt; never inferred from deployment.

Manual recoveryRestores a failed path; must preserve causal and rollback evidence.

05

Bounded agent assurance

For eligible read-only reviews and adversarial audits, the Orchestration Agent uses a controlled multi-model harness rather than trusting one monolithic pass. Each specialist sees the same hashed source capsule, works independently, and returns evidence for orchestration-layer synthesis.

Source capsule
exact + hashed

Specialist A
architecture

memory off
web off
read-only tools

lane result
evidence

Specialist B
failure modes

memory off
web off
read-only tools

lane result
evidence

Specialist C
test gaps

memory off
web off
read-only tools

lane result
evidence

Orchestration synthesis
adjudicate + verify

Unsupported claims rejected

Load-bearing findings reverified

Agent analysis is evidence, not authority. Lanes cannot read sibling results, change source, mutate the canonical system, or convert consensus into truth. The Orchestration Agent rejects unsupported claims and independently checks load-bearing findings; the Human retains consequential authority.

mode: READ_ONLY_REVIEW | ADVERSARIAL_AUDIT
model: Grok 4.5 High
source: isolated exact source capsule
sandbox: strict
memory: off
web: off
subagents: off
tools: read_file, grep, list_dir
mutation: denied

Coding agents use a different contract

Implementation agents receive a bounded work order with exact scope, inputs, constraints, expected artifacts, validation, and rollback. They may edit only authorized paths and return a diff plus proof. They do not inherit architecture, publication, merge, deployment, scheduler, or lifecycle authority.

source and capability boundary established first
path-scoped edits and tests
session and result identity persisted
conclusions independently verified
unsupported work rejected, not rationalized

06

Publication control

SIGNIT prepares governed evidence and assurance artifacts; it does not author or publish the final Brief. Publication is a separately authorized control-plane action bound to one exact package and one executor.

01

Human-approved spine

Human selects the thesis and load-bearing argument.

→

02

Governed evidence packet

Final-supported evidence and caveats.

→

03

Brief Markdown

Human-controlled narrative artifact prepared by the Orchestration Agent.

→

04

Public Audit Packet

Claim, source, challenge, and signoff registers.

→

05

Deterministic validation

Exact package and public-safety checks.

→

06

Editorial approval

Human approves content and presentation.

→

07

Draft registration

Approved human-controlled artifact recorded.

→

08

Exact manifest

IDs, hashes, dates, and executor bound.

→

09

Separate authorization

Human authorizes this exact package.

→

10

One executor

One bounded path; no parallel execution.

→

11

Live verification

Public bytes, URL, source, and receipt.

→

12

Governed backfill

Publication record and lifecycle update.

→

13

Subscriber proof

Separate run and delivery evidence.

Exact package binding

brief_id: BRIEF-0XX
manifest_sha256: <64-hex digest>
brief_sha256: <64-hex digest>
audit_sha256: <64-hex digest>
executor: <one approved executor>
issue_date: YYYY-MM-DD
publication_window: <bounded start / end>
subscriber_send_authority: false

Executor boundary · one and only one

Human authorizesSeparate publication authority, bound to exact bytes.

Control plane bindsValidates hashes, policy, window, and executor.

Executor actsPublishes only the approved package.

No parallel pathAlternate executors are prohibited.

07

Incident response

Recovery starts by preserving evidence and binding the exact failure. The safe path is narrow, causal, reversible, and independently reverified.

SIGNIT incident triggers, diagnostics, recovery, and stop conditions
Trigger	Establish	Safe recovery	Stop condition
Source drift	Exact diff, owner, protected paths.	Commit intended path-scoped work or restore the accidental path through an approved reversible change.	Intent or owner is unknown.
Expected runtime output	Producer and registered output family.	Usually wait. Investigate only genuinely unexpected paths.	Path has no known producer.
Active runtime	Lock, process, run ID, scheduler window.	Wait for completion, then rerun stale-safe checks.	Any generated-surface commit or mirror attempt.
Missing exact-run proof	Missing sidecar or artifact bound to the run.	Let the natural producer emit it or debug that producer.	Manual state write would fabricate proof.
Finality conflict	Load-bearing claim, current source, precedence.	Hold readiness; strengthen, caveat, or remove the claim.	Publication remains blocked.
Mirror hash mismatch	Mapping, redaction, local and mirror hashes.	Run narrow inventory and path-scoped safe sync.	Redaction or authority is uncertain.
Package hash mismatch	Manifest against exact current public bytes.	Rebuild the package and obtain renewed approval.	No push or deployment under the old approval.
Deploy/live mismatch	Source commit, deployment receipt, final URL, live bytes.	Wait for propagation, then repair or roll back the exact causal path.	Do not claim publication complete.
Subscriber proof missing	Publication proof versus send/run receipt.	Use a separately authorized send investigation or recovery; report aggregates only.	Do not infer delivery from deployment.

08

Reference

Use read-only diagnostics first. The canonical repository controls current paths, flags, and output contracts; these commands document the operating pattern and must be rechecked against the live code before use.

Documented diagnostics

python scripts/check_signit_repository_integrity.py --no-write

python scripts/check_signit_operational_reachability.py --no-write

python scripts/build_signit_loop_board.py --no-write

python scripts/check_signit_stale_safe_surface.py --scope <path>

python scripts/check_signit_remote_mirror.py --no-write

Command names come from the documented operator diagnostics. They are intentionally shown without host paths, tokens, environment values, or private repository names.

Glossary

source lineage: The trace from an observation to origin, retrieval context, transformations, and dependent claims.
finality: Current-run eligibility for a claim to carry load in the argument.
route memory: Structured attention state built from evidence pressure, freshness, contradiction, and outcomes.
source capsule: An isolated, exact, hashed source package supplied to a bounded agent lane.
proof class: The kind of evidence a result actually supplies: spec, test, replay, natural run, publication, delivery, or recovery.
stale-safe: The gate preventing partial, active, stale, or unsafe surfaces from becoming authority.
publication backfill: The governed post-verification record that advances lifecycle state after publication proof exists.

Source-of-truth order

01

Exact-run artifacts + publication records

Highest authority for the specific run or release.

02

Canonical repositories + active worktrees

Source and implementation authority.

03

Approved live databases · read-only

Current stored state when bound to the exact question.

04

Exact local derived state

Useful only while bound to higher authorities and current.

05

Operational vault

Durable decisions, incidents, and history.

06

Transport copies + sanitized mirror

Durability and observability, not canonical authority.

07

Agent reports + unbound statements

Leads and evidence candidates, never final truth by themselves.

Operational interpretation: this runbook describes the durable system and control contracts. It is not a live health dashboard. Current HEAD, run state, Brief stage, provider state, publication status, and delivery status must be rebound from exact evidence each time they matter.