Is the machine running itself, correctly, with no human in the loop? Every row is a real cadence or guard on the sovereign NAS. Program: /org · graph: /atlas · live WIP: /standup. Snapshot 2026-07-19.
| cadence | schedule | what it does | evidence |
|---|---|---|---|
| surface-sentinel | :15 hourly | verifies every published surface = 200; auto-files a sev-6 debt if any goes RED (self-healing) | surfsentinel.log |
| atlas-beat | 06:15 daily | rebuild the 16.5k-node graph → honesty ratchet → auto-debt on regression | atlas_beat.log |
| arch-board | 06:20 daily | the team's standing structural judgment of the tree | arch_board.cron.log |
| frontier-pages | 06:25 daily | republish the CPM board to /frontier + /plan | frontier_pages.cron.log |
| ecomat-beat | 06:40 daily | re-measure ecosystem maturity → republish /compare/maturity | ecomat_beat.log |
| standup | */30 min | re-derive + republish /standup (ACTIVE/STALE WIP from beats) | standup.cron.log |
| guard | protects against |
|---|---|
| never-brick deploys | a bad promote — health-gated + auto-rollback watchdog on every /api/deploy |
| hostctl-sentinel | a died daemon — respawns from the supervised fleet registry |
| edge443-reconcile | the DSM nginx co-squat — keeps the sovereign edge on :443 |
| overcommit-assert | OOM fork-refusal — the memory-exhaustion supervisor-death class (root-caused + cured) |
| survey-reconcile | cron drift — keeps cron.reg == the live crontab (this is how new cadences go live) |
| clean-serve-sentinel | the media-resolve daemon — keeps /clean fresh |
The debt ledger is now read by our OWN organ, not a throwaway analysis: nx_debt_hygiene compiles the mixed-schema debt- plane to one line, on demand over MCP. Live: 195 total · 144 open · 51 eaten · 51 gating (open sev≥6). By severity (open): s8=7 · s7=19 · s6=25 · s5=57 · s4=18 · s3=16 · s2=2. The conductor refuses lane-work while an in-scope sev≥6 debt is open — eat-first, mechanized. Built API-pure (nx_fs_write source → /api/build 86,875B first-try → promote → register → mint), zero shell.
The supervisor is one never-brick control plane: promotion + monitoring are ONE circuit — a deploy that fails its health check auto-rolls-back, so a bad change cannot brick the fleet. Cadences ride cron.reg (the SSOT); survey-reconcile makes the live crontab equal it every minute, so adding a cadence = adding one data row. Two failure classes were root-caused + cured this program: the memory-exhaustion supervisor death (overcommit guard) and a per-GOP transcoder leak. The loop closes on itself: a cadence that finds a regression (atlas islands grew, a surface went dark) files its own debt, and the conductor then refuses new lane-work until it's eaten.
| function | A | R |
|---|---|---|
| supervision / never-brick | supervisor | supervisor (the control plane + guards) |
| cadences / cron | conductor | conductor (cron.reg, the plans, the sentinel) |
| health / self-heal | supervisor | supervisor + warden (policy) |
Measured from: nx_health (14/14 live) · cron.reg (the cadence SSOT) · plan-surfsentinel- + surfsentinel.log (5/5 = 200) · ecograph_full (16,580 nodes). Compare vs SOTA: /compare/supervisor (systemd/Prometheus/Netdata) · /compare/coordination. Nothing here is asserted — each cadence writes an evidence log the next run reads.