Build the city before the brains.

A research organisation is not a pile of models.

It is a set of roles, rules, records and resources. Build those four correctly and the models become a swappable component — which is the whole reason this city starts with a stub where its intelligence should be.

roles

A citizen is defined by a declarative spec, not a prompt buried in code. A role states its purpose, its permitted tools, its data clearance, its budget, and who reviews its output. Changing the workforce is editing YAML, not rewriting a program.

rules

Nothing is enforced by convention or good intentions. Admission policy rejects non-compliant workloads. NetworkPolicy makes exfiltration a routing impossibility rather than a promise. Budgets are enforced at the gateway, so a runaway agent stops rather than bills.

records

Every run is replayable or it did not happen. Inputs hashed, config and seed captured, every model output kept by its hash, the whole causal chain queryable — and replayable — months later. A scientist that cannot show its work is a random number generator with good manners.

resources

The substrate is a detail we deliberately refuse to hard-code. Today the city is one laptop: a real model on its GPU, and a stub for everything else. Tomorrow it runs on rented GPUs. That transition must be a configuration change, because any architecture that makes it a migration is the wrong architecture.

The metaphor is load-bearing.

Every district is a real component with a real job, not a naming flourish. If a district cannot name the software that implements it, it does not exist — and a component without a district is one nobody has placed.

The last column says how far each one is. Designed: written down. Built: it exists and runs. Verified: a test that can fail is green. Most of the city is still designed.

An agent is four things.

An image, a role spec, an identity, and a budget. Nothing else distinguishes one citizen from another — which is what makes the workforce editable rather than rewritable.

The Referee is deliberately adversarial and cannot be the author of what it reviews. Self-approving agents produce confident nonsense at scale. Architecture · L4 citizens

That separation is not a guideline. It is a field in the spec, and the spec is what will run once the dispatcher that reads it is built. The scientist cannot publish a result at all: it can only ask for review, so its work reaches the principal and the human through a verdict or not at all.

  # Deliberately cooler than the Scientist: this role is not here to be creative.
  model: { primary: beh-reason-lg, temperature: 0.2 }
  clearance: internal
  tools:
    - name: vector.search
    - name: mlflow.read         # read-only: a referee cannot edit the record
    - name: artifact.get
  denied: [ artifact.put, mlflow.log, code.execute, ledger.write, net.egress.internet ]
  constraints:
    # …
    never_review_own_authorship: true
    must_cite_evidence: true    # a verdict without evidence is itself rejected
  # …
  messaging:
    subscribe: [ "city.review.requests.>" ]
    publish:   [ "city.review.verdicts.>" ]
  outputs:
    required: [ verdict, evidence, severity, required_changes ]
    verdict_enum: [ accept, revise, reject ]

Seven principles that decide arguments.

Each one exists to settle a class of decision in advance, so the same debate is not had twice.

Two runs, one seed, one scheduler. The divergence readout is measured rather than asserted, and it can fail: perturb run B — give it the next seed — and it leaves zero at once; restore it and both runs restart on one seed and hold at zero. That is the property dummy-inference gives the foundry. Recorded on 10 October 2026: the same verdict request, sent twice, returned content hash 3cf31417ed54cfdf both times; with the seed one higher it returned af053a5574dccabc.

The real model held too, measured the same day: a greedy answer came back identical with and without a second request sharing its batch. That holds on this laptop and this build, which is why the records keep outputs rather than trusting a re-run.

It is already shipped once. Juju, the company’s second product, runs its speech model at build time rather than at runtime — every line is reviewed before a child can hear it, and what reaches the device is a folder of audio files that is identical every session.

One door, two locks.

Every artifact, dataset, prompt and agent carries a data-class label, and admission policy rejects any workload that omits it. The gateway resolves (class, backend) and refuses illegal pairs with a logged, traced denial. A caller can raise a request's class, never lower it.

For that data the difference between a policy and a promise is somebody's safety, so it is enforced at two independent layers on the assumption that either one may fail. Secops · why restricted exists

Budget is a safety control, not accounting hygiene. An agent that loops is functionally a denial-of-wallet attack against its owner. Ceilings per run, per ticket and per day, priced in GPU time, because one laptop decodes about two million tokens a day and that is what is scarce. Three review rounds, then a human decides. The city and the companion have separate budgets, so a runaway agent cannot silence the companion. Stub mode reports realistic token counts, so all of it is tested at €0.

And three independent records, because a single log an attacker can edit is a comfort, not a control: the gateway ledger, the traces, and immutable run records.

Twelve decisions settled. Ten corrections proposed.

Written down as ADRs so they can be argued with later by someone holding the reasoning, rather than re-litigated from memory. Some already have been: an October review found the design and the repository disagreeing in ten places. Each correction is an ADR of its own, proposed until the principal accepts it, and none rewrites the decision it corrects.

Honestly, at the beginning.

The architecture is written and most decisions are made. The cluster is not running yet; one real model is. Publishing the milestone it is actually on is cheaper than explaining a status light that cannot go red.

First come the platform labs the city is built from — secrets, observability, delivery, recovery. M0 follows them.

A green suite that cannot go red proves nothing. The rule every milestone is held to