The supporting cast

Supernova’s headline machinery — the delivery loop, the bus, the agents — only survives because ten quieter systems notice failures, restart services, guard the repo, and keep hostile email from becoming shell commands. Each gets a paragraph here, led by its most opinionated design choice — with one build-state note up front: every system below is at least [built in-repo] (real Rust with code and tests in the workspace), and at best [engineered, not deployed] where an opt-in end-to-end proof runs against a checked-in Docker Compose stack. None is a standing service.

monitor — the loop must close

The predecessor platform had Prometheus and Grafana already [live in automatt] — “barely used,” because nothing consumed the alerts. The rebuild refuses that fate: systems emit to Kafka, an OTel collector feeds Prometheus and Grafana, and alerts flow back onto the bus, where a listener agent named Sentinel consumes and acts — “it’s whole circle of life” (Matt). Sentinel is an agent, not a subsystem (Matt’s ruling, 2026-06-10) — it investigates and escalates but cannot file issues, which is reserved for a judgment principal. Sentinel can’t report its own death over the bus it watches, so an out-of-band watchdog and a synthetic-canary loop are first-class requirements. Audits split (D7, 2026-06-18) into fast mechanical checks that write artifacts and a small agent-led pass that reads them and applies judgment — deliberately not automatt’s expensive swarm of eight ephemeral agents each re-reading the repo. The full stack runs today only as an opt-in test: post an OTLP metric through the collector, watch a real metric-backed Grafana alert land on the monitor bus [engineered, not deployed].

test — heavy E2E on hardware you own

Test earned system status by weight — “if it’s heavy enough to worry about RAM, it’s heavy enough to be its own system” — and by the owned-infrastructure definition of “local” that excludes every hosted, metered CI product: no GitHub runners, no per-run billing. A run stands up a full real stack (Kafka, Temporal, Postgres, mocked externals) once per batch, not per case, because concurrent spin-ups stress a 64GB box; isolation is absolute between batches. The sharpest choice is a deletion — smoke testing, removed from the lifecycle entirely (delivery tells that story); field truth now comes only from monitor’s passive Prometheus assertions. A ~95% coverage gate applies to the batch’s changed code, and a failed run carries the implicated wires so the issue system boots them back to in-progress [built in-repo]; remote offload to the owned Proxmox server is explicitly future work [supernova design].

review — stamps that die when the code changes

Review is “the enforcement MECHANISM, not the rule-store”: each system’s own invariants list is what gets checked against a touching patch, so declaring an invariant is registering it. Merging takes two stamps — primary and architecture/safety, either order — keyed to the reviewed content hash: a post-stamp change silently drops the stamp, so nothing merges stale (a fix for a real automatt bug). A third review type gates feature closure: an independent agent — neither implementer nor closer — confirms real usage at least twice, “separation-of-duties applied to closure, the same way the double-stamp applies it to merge.” Stamps live as fields on the issue record, written in the same transaction — no separate review store — and bypass exists only as a recorded approval-flow elevation, never a silent override [built in-repo].

ops — the motor neurons

Ops is where “restart” lives (Matt, 2026-06-04: “where else does ‘restart’ go? restart, update, status”): start, stop, and upgrade the owned fleet — Kafka, Temporal, Postgres, Prometheus, Grafana, the agent runtime — all Docker Compose and systemd on owned machines, explicitly not cloud IaC. The boundary with monitor is anatomical: “monitor = sensory (afferent)… ops = motor (efferent)” — monitor detects, a bus reactor fires, ops restarts. Ops also holds the sole sanctioned exception to everything-rides-the-bus: a bus-independent Kafka broker health probe, because you cannot ask a dead bus whether the bus is dead. Resource governance is deliberately soft (D6): no hard caps, pressure answered by “reclamation of rebuildable state, not enforced ceilings.” Container bring-up is real today — a primary container plus per-project swarms, source mounted read-only — and a checked-in inventory reports all nineteen systems production-ready only when every service has been started by hand; the default fails closed [engineered, not deployed].

ingest — hostile by default

Ingest’s premise: external input is “hostile by default until a transport-verified sender says otherwise.” Trust tiers derive from the authenticated sender, never the source channel, and taint propagates — a policy can never auto-approve unknown-external input above minimal risk. The most opinionated stage is the capability-stripped reader: classification runs under a permission profile denying network, tools, and external sends, so prompt injection is contained because the reader can do nothing even if the content tells it to. What escapes is a typed, versioned Recommendation record — “the SCHEMA is the security boundary” — then two human gates: intent (“act on this at all?”) and quality (“execute THIS exact produced thing?”). “A denial at either gate is not a failure — it is a designed branch”: gate-two denials park a Temporal workflow that resumes when a revised artifact arrives. The operator path, with a live authenticated Discord-webhook-to-issue proof, works today [engineered, not deployed].

chat — internal only, on purpose

Chat owns channels, DMs, threads, and identity-bound delivery, and does nothing external — all outward transport belongs to the link system. Discord is a link adapter, not a chat backend: inbound messages are re-emitted and restructured into internal chat semantics rather than mirrored 1:1, because third-party message shapes don’t map onto chat’s channel/thread/identity model. Interruption is structural, not textual: an urgency ladder (D55) runs from idle-read to between-turn steering to permission-gated interrupt to compact-then-context-switch, with defaults low and the old !!! bang-markers removed as a cross-system syntax (2026-06-22) — surviving only as a Discord-inbound convention parsed onto the ladder. One invariant exists purely because of an automatt incident — a self-message can never reach interrupt level — and channel-post authority is capability-group membership, “never a hardcoded agent name” [built in-repo].

vcs — git with numbered laws

Vcs “carries the platform’s most dangerous failure modes” — orphan worktrees, half-rebases, a crash in the window between rebase and merge — so its entire reason to exist is a set of numbered, citable invariants review can block on: never cherry-pick, ff-only merges to shared branches, never reset --hard on dev/main, never stash, atomic worktree create/teardown, and a two-step ship (rebase then ff-merge) that is “crash-window-atomic and re-runnable.” The distinctive gate (D58): merge-to-main carries an approval decision on top of the capability check — “the cap-group decides who may drive the merge; the approval decision decides whether this specific merge proceeds” — while ordinary worktree commits stay ungated. A live agent can drive the full ship today: approved record, real rebase, real fast-forward, provenance events replayed to the owned broker [engineered, not deployed].

config — one file, guarded by the OS

Matt’s founding spec (2026-06-04): “GIANT YAML FILE! cli to manage it… each system gets its own top level.” One config.yaml replaces the predecessor’s scatter of env files and per-tool configs, with per-project overlays cascading over global defaults (D51/D62). The unusual choice is who guards writes: an OS-level file permission on the whole file, never a runtime permission call — “config never calls permission, which dissolves the config-permission bootstrap deadlock” (D62). CLI and library are dumb writers that never emit; a single inotify watcher is the sole event emitter (D31), diffing against last-known-good and publishing section-update events that trigger hot reloads. There is no outbox and no audit table: “the file is the durable record” — hand-editing is allowed-but-discouraged, and the watcher keeps last-known-good and screams. Watcher service, schema validation, and rollback run today; the OS/container write gate still awaits proof from a real running container [engineered, not deployed].

auth — one identity object, no vault

Auth is who you are; permission is what you may do — a boundary defended by mirror invariants (“auth MUST NOT make authz decisions; permission MUST NOT own credential material”). Auth is the sole owner of the canonical Principal contract (D4): every other system stores only a principal_id reference, closing the seam where agent, chat, and approval each half-owned an identity. Its contrarian call is the secrets substrate: not HashiCorp Vault (“too heavy for a single owned box”), not AWS Secrets Manager (off-owned-infra) — a sops/age-style encrypted-local file store instead. An AES-GCM store with no-plaintext-at-rest evidence exists today [engineered, not deployed]; the credential-lifecycle contract for external integrations (D49) is [supernova design].

core — the substrate with self-respect

Core is a different kind of system: horizontal, owning framework concerns and never a vertical domain’s rules. It exists because scattered utilities kept accumulating occupants — in Nova’s words, “‘util’ is junk-drawer name; ‘core’ is the same stuff with self-respect” — and it is pointedly not named sun, because “a system named after the CLI that hosts every system’s CLI is circular.” It owns CLI dispatch, system scaffolding with 5-part-shape validation, the stateless client library every surface shares, and the config schema registry (D63). A validator binds contract to implementation: core must implement exactly each system’s declared interface — no orphan commands, no undocumented commands. The frontend is ruled a renderer, not a system (2026-06-20): “CLI = text layer; UI = rendering layer; both stateless, neither owns state,” each view owned by its host system. Framework, dispatch, and scaffolding validation are [built in-repo]; the web renderer is [supernova design] — no shipped UI.

What this costs

Ten systems means ten boundary disputes — monitor-vs-ops (“monitor aggregates, ops probes”), chat-vs-link, auth-vs-permission — each split buying clean invariants at the price of seams that reactors must bridge and reviewers must know. Some of the sharpest choices are admissions of past failure: smoke testing wasn’t refined, it was deleted (D68) after causing real bugs; the audit swarm was replaced, not optimized; Grafana Alloy and bang-markers were superseded; a refactor system was removed outright. And the gap is uniform: the readiness dashboard itself says “the remaining gap is not missing proof machinery; it is production/live-substrate readiness,” and flags that status words “can still conflate” specced, implemented, in-repo-proven, and live — the exact masquerade this page’s tags exist to prevent. Nothing here runs as a standing service: the evidence is real; the deployment is not yet.