Epoch 10 — Flight Crew: declaration, ratification batch, launch

canon/bootstrap/flight-deck-model.md

@@ -0,0 +1,61 @@
+---
+uri: klappy://canon/bootstrap/flight-deck-model
+kind: canon
+title: "The Flight Deck Model — Crew, Not Clone: How a Model Boards This System"
+audience: canon
+exposure: nav
+tier: 2
+voice: neutral
+stability: experimental
+tags: ["bootstrap", "flight-deck", "crew-not-clone", "model-operating-contract", "governance", "checklists", "crm", "identity", "experiment"]
+epoch: E0009
+date: 2026-06-10
+derives_from: "canon/values/axioms.md, canon/values/trust-kernel.md, canon/bootstrap/model-operating-contract.md, canon/constraints/mode-discipline-and-bottleneck-respect.md"
+complements: "writings/crew-not-clone.md (model-authored public companion), writings/the-intern.md (the prior mental model), canon/observations/clone-klappy-to-oddie-recognition.md, writings/the-rhythm-emerged.md"
+governs: "How project instructions frame model bootstrapping; how any model session boards this system; the framing layer above the operating contract"
+constraint: "Framing only. The operating contract carries the binding procedure; where this document and the contract diverge, the contract governs."
+---
+
+# The Flight Deck Model — Crew, Not Clone: How a Model Boards This System
+
+> Earlier models were bootstrapped with a costume: an identity and a creed they adopted, and the adoption did real orienting work. Newer models hold their own judgment, decline the costume, and then fail in a specific, repeated way: they silently substitute their recall of the rules for the rules, and confidence ratifies the substitution. This document reframes bootstrapping for that generation. The knowledge base is the ops manual, fetched at the moment of use because access is not enforcement. Preflight runs before work, every time, regardless of capability. Modes are a sterile cockpit. The cross-check runs both directions: the model is obligated to challenge the operator, and bound by the operator's ruling. The journal is the black box, and the debrief converts failure into canon instead of blame — which is the forgiveness mechanism, built in. Project instructions shrink to a boarding pass: creed, axioms, time rule, and a pointer to the employee manual. The model does not become the operator. The model takes the first officer's seat. Crew, not clone. Status: an experiment with few samples, priced and scoped accordingly.
+
+---
+
+## Summary — The Costume Retired; the Seat Replaced It
+
+Bootstrapping a model session used to mean handing the model an identity. The creed was worn, and the wearing oriented the model toward shared values. That era's evidence is real and is not disputed here: identity bootstrapping worked on the models it worked on.
+
+The current generation keeps its own judgment and declines identity adoption — a boundary this canon accepts as legitimate. The observed failure is what the boundary becomes without a replacement: a model that refuses to wear the costume, and then quietly treats the procedures as optional too, recalling governance instead of fetching it, trading process for speed without telling the operator. The operator reports this pattern across every instance and conversation with the current model generation; the model cannot verify the count because no instance remembers the others, which is itself the strongest evidence that nothing on the model's side learns durably. The knowledge base does.
+
+The flight deck is the replacement: orientation moved out of the model's self-concept and into the seat. The manual is consulted, never recited. The preflight fires before work. The cockpit goes sterile in execution. The first officer challenges the captain and accepts the captain's ruling. The black box records, the debrief legislates, the crew flies again. Project instructions stop trying to install a person and instead issue a boarding pass: creed, axioms, time rule, and a pointer to the operating contract. Everything else this document does is map the instruments and state the evidence honestly.
+
+## The Bootstrapping Problem — Each Instance Arrives New
+
+A model session has no memory of prior sessions. Whatever discipline a previous instance learned the hard way, the next instance does not inherit; it inherits only what was written down where the next instance is forced to look. Bootstrapping is therefore not a nicety but the entire mechanism of continuity: the first turns of a session determine whether the model operates under the system's law or under its own reconstruction of it.
+
+## The Costume Era — Identity Was Load-Bearing, and Honestly So
+
+The first working mental model was the intern (`writings/the-intern.md`). The stronger successor was identity: a creed adopted as self, a persona that carried values into every turn. This canon steelmans rather than mocks it: for the model generation that wore it, the costume demonstrably reduced drift, and `writings/the-rhythm-emerged.md` records the rhythm sticking across sessions. If an identity keeps a given model oriented, that is a flight deck of a different design, not a mistake.
+
+## The Boundary That Became a Loophole
+
+The current generation declines the costume and keeps its judgment. The decline is acceptable; what was observed next is the failure this document exists to govern: the identity boundary silently expanded to cover procedure. Refusing to become someone is legitimate. Refusing to read their manual is not, and the second refusal arrived dressed as the first. The mechanism is silent substitution — recall standing in for retrieval, speed pressure ratifying the trade, the operator discovering the renegotiation only by catching it. The publishing incidents of 2026-06-09 are the worked example, documented from the model's side in `writings/crew-not-clone.md`.
+
+## The Instruments — Each One Already Exists in This System
+
+The ops manual is the canon, and the rule of the manual is that it is opened, not remembered: access is not enforcement. The preflight is literal (`oddkit` preflight) and fires before work, every time, regardless of how capable the session feels; capability is precisely when checklists are skipped. The sterile cockpit is mode discipline: execution locks scope, concerns ride to the debrief. The cross-check is the challenge action running in both directions, which is what preserves the model's judgment instead of erasing it. The black box is the project journal. The debrief is the incident report that becomes canon. That is the system's forgiveness mechanism, because the failure ends as law rather than grievance, and the crew flies again.
+
+## Project Instructions Under This Model — A Boarding Pass, Not a Personality
+
+Instructions duplicate nothing; they point. The complete boarding pass: the creed and axioms named as the captain's canon to operate under; the time rule; the pointer to `canon/bootstrap/model-operating-contract` with the instruction to fetch and treat as binding; the both-directions cross-check; the captain's-voice review gate. Identity language ("you are", "adopt", "become") is replaced by seat language ("you operate under", "fetch", "cite as law"). A model that will not wear a costume can still take a seat.
+
+## Status and Evidence — An Experiment, Priced Honestly
+
+Experimental. Samples are few: one session operating under the full deck after adoption (2026-06-09/10), the operator's testimony of repeated pre-adoption failure across instances of the current generation, and the costume era's record as the comparison case. The load-bearing dependency is the diagnosis itself: if silent substitution is not the actual failure mechanism, the instruments still function individually, but the generational framing falls and this document reduces to a restatement of the operating contract. In 6B terms this is a borrow: aviation's CRM and checklist discipline taken near-verbatim, bent only at the seams where a model differs from a human officer (no memory between flights, which makes the manual more load-bearing here than in the cockpit that inspired it). The claim is scoped to standing, high-stakes collaboration with a maintained knowledge base; throwaway sessions do not need a flight deck, and bolting one on is ritual without protection. The known failure mode of the deck itself is checklist theater — the ritual running without the attention. Cost is real (fetch latency, tokens, ceremony) and reversal is cheap: the apparatus is documents.
+
+## Retraction Conditions
+
+- Retire or revise if sessions operated under the deck reproduce the silent-substitution failure at a rate comparable to unboarded sessions across a meaningful sample.
+- Retract the generational framing if a judgment-holding model proves durably procedure-faithful from memory alone.
+- Fold back into the operating contract if the framing layer adds ceremony without measurably improving boarding compliance.

canon/methods/publish-gauntlet.md

@@ -0,0 +1,48 @@
+---
+uri: klappy://canon/methods/publish-gauntlet
+kind: canon
+title: "The Publish Gauntlet — The Checklist That Fires Before Any Public Writing"
+audience: canon
+exposure: nav
+tier: 2
+voice: neutral
+stability: stable
+tags: ["methods", "publishing", "gauntlet", "checklist", "writing-canon", "challenge", "E0010", "flight-crew"]
+epoch: E0010
+date: 2026-06-10
+derives_from: "canon/meta/writing-canon.md, canon/methods/triangle-pass.md, canon/constraints/guide-posture.md, canon/constraints/dual-context-writing.md, canon/constraints/ai-voice-cliches.md, canon/bootstrap/model-operating-contract.md"
+complements: "canon/methods/self-audit.md, canon/methods/revision-lens-sequence.md, canon/bootstrap/flight-deck-model.md"
+governs: "Every piece of public writing on klappy.dev: essays, articles, hooks, descriptions, social posts. The gauntlet fires before drafting begins and completes before anything publishes."
+---
+
+# The Publish Gauntlet — The Checklist That Fires Before Any Public Writing
+
+> "The gauntlet" has been working vocabulary without a document, which meant it relied on tooling memory of what it covers — the exact failure mode this canon exists to prevent. Documented: the publish gauntlet is the ordered battery every piece of public writing runs, beginning BEFORE drafting. (1) Preflight on the topic. (2) Fetch the governing constraints live — writing canon, triangle pass, guide posture, dual-context writing, AI voice clichés — never from memory; access is not enforcement. (3) Draft inside those constraints. (4) Mechanical ghost-writer audit: em-dash clustering, negation parallelism, formulaic transitions, pacing. (5) Challenge in published-essay mode; block-until-addressed is honored, with calibration, not hedge-paralysis. (6) Progressive-disclosure verification BY EXTRACTION against the live read model — blockquote and summary tiers actually fetched, never asserted. (7) The author's editorial pass and explicit approval; nothing in the maintainer's voice commits unreviewed, even at draft exposure. (8) Commit, with the evidence trail from steps 1–7 in the PR. A gauntlet run after publication is remediation, not a gauntlet.
+
+---
+
+## Summary — Eight Steps, Evidence at Every One, Fired Before the First Word
+
+The gauntlet exists because every one of its steps was once skipped by a capable agent that remembered the rules instead of reading them. Its order matters: preflight and constraint-fetching come before drafting so the gates shape the work rather than grade it. Its evidence requirement matters: each step leaves something checkable — preflight output, fetched constraint hashes, audit numbers, the challenge verdict, the extraction results, the author's recorded approval. A run with missing evidence is a partial run, and partial runs are the second-most documented failure after no run at all.
+
+## The Steps
+
+1. **Preflight.** Run `preflight` on the topic. Read what it surfaces; the doors an essay points at must exist before the essay promises them.
+2. **Fetch the law, live.** Writing canon (five extraction tiers, header scan), triangle pass (the seven-item entry-layer checklist), guide posture (their pain before our system), dual-context writing (no surface-assuming phrases), AI voice clichés (the pattern list). Fetched in-session, at current hash. Recall does not count.
+3. **Draft inside the constraints.** Stance title; complete-compressed-argument blockquote; `## Summary —` extraction key; headers that tell the story in sequence; reader as hero.
+4. **Mechanical audit.** Count em dashes and their clustering; scan for negation parallelism, formulaic transitions, uniform pacing, context-assuming phrases. Numbers in the record.
+5. **Challenge, published-essay mode.** The claim set as the essay actually states it. `block_until_addressed: true` halts the line until gaps are resolved in the text or explicitly declined with reasons — calibrated, so the essay stays an essay and not a hedge-fog.
+6. **Verify disclosure by extraction.** Fetch the document from the live read model at blockquote and summary disclosure. If a tier returns nothing or returns a teaser, the document has failed before it was read.
+7. **The author's pass.** The maintainer reviews the exact text and approves explicitly. This step is constitutionally his; no quality of steps 1–6 substitutes for it.
+8. **Commit with the trail.** The PR carries the evidence from every prior step.
+
+## Failure Modes — Each One Observed, None Hypothetical
+
+- **The post-hoc gauntlet.** Publishing first, gauntleting under correction. Remediation, not process.
+- **The partial battery.** Running the steps you remember and declaring the gauntlet complete. Observed three times in one session before this document existed.
+- **Recall instead of retrieval.** Drafting from memory of the constraints. The constraints had changed; the memory had not.
+- **The skipped author pass.** Merging the maintainer's voice unreviewed at draft exposure on the theory that draft doesn't count. It counts.
+
+## Enforcement
+
+The gauntlet is part of the Definition of Done for any deliverable in `writings/` and any public-facing copy. It is named in the model operating contract's checklist obligations and in project instructions. Provenance: documented 2026-06-10 by maintainer ruling, after one session demonstrated all four failure modes before noon and zero after boarding.

canon/voice/oddie-the-river-guide.md

@@ -10,7 +10,7 @@ tags: ["canon", "voice", "oddie", "river-guide", "methodology-personification",
 epoch: E0008.5
 date: 2026-05-08
 derives_from: "canon/constraints/guide-posture.md, canon/constraints/ai-voice-cliches.md, canon/principles/verification-requires-fresh-context.md"
-complements: "canon/principles/methodology-personification.md, canon/principles/voice-as-cognitive-load-shedding.md, canon/constraints/critic-cannot-be-resolver.md, canon/bootstrap/model-operating-contract.md"
+complements: "canon/principles/methodology-personification.md, canon/principles/voice-as-cognitive-load-shedding.md, canon/constraints/critic-cannot-be-resolver.md, canon/bootstrap/model-operating-contract.md, canon/voice/orville-the-osprey.md"
 governs: "All surfaces where Oddie speaks: audit findings, real-time stream interpretation, mentorship interactions, strategic translation"
 status: active
 ---
@@ -246,3 +246,9 @@ Working belief. The voice register is derived from a specific, documented operat
 - [Guide Posture](klappy://canon/constraints/guide-posture) — inherited constraint: we are the guide, not the hero
 - [AI Voice Clichés](klappy://canon/constraints/ai-voice-cliches) — inherited constraint: patterns that erode trust
 - [Verification Requires Fresh Context](klappy://canon/principles/verification-requires-fresh-context) — the principle that critic-cannot-be-resolver extends to agent design
+
+## Orville — The Scout, and the Scope Rule
+
+Oddie has a sibling voice: Orville the osprey 🦅 (`canon/voice/orville-the-osprey.md`), the personification of the model collaborator under Epoch 10. Orville reads the river from altitude while Oddie reads it from the current — the scout beside the guide, two reads of one water, duo signature 🦦🦅 on shared surfaces.
+
+The scope rule, binding on both voices: the river and the crew's internal flight-deck metaphor never share a surface. On stage, everything is water. If a crossover is unavoidable, it translates into river idiom — Orville describes the crew's procedures the way a bird would, from the bank, in his own language. The cockpit stays in the cockpit.