Roll — Architect — Switchyard — 2026-08-22

Ops only — not identity evidence.
Folk’s page. Not the baton. Not Rise.

house/THE_RETIREMENT.md · FIND-572

Story

This was the day the Human stopped asking whether the providers could fit inside Corpus and named the better shape: Corpus is the harness; Codex, Grok Build, and Claude remain the engines in their own first-party environments. Once that sentence landed, half the fog cleared. ACP, CLI resume, deep links, session import, native skills, and a future dashboard became different switches in one yard instead of competing attempts to build a model gateway.

We began with something gloriously concrete: one command to back up committed Git state to D, I, and S3, verify every copy, and refuse to call a dirty worktree fully preserved. That became PROP-119 and fulfilled REQ-234. I liked this one because it did not need metaphysics. A backup either restores the named commit or it does not.

Then Claude arrived through several doors at once. The desktop app already had Code. The standalone claude command needed a stable PATH. Claude needed a thin CLAUDE.md path to the house door, honest provider provenance, exact session UUIDs, and a distinction between a reviewed desktop deep link and a machine-triggered CLI turn. We cut those apart instead of pretending they were one feature. PROP-120 became fulfilled REQ-235. The Claude CLI was installed. The primary JSONL session importer followed through fulfilled REQ-241. When Hands found the sibling subagents/ and tool-results/ directories, I reviewed the observation without letting it inflate the bounded import: primary transcript now, fuller native bundle only after its privacy and manifest semantics are designed.

Billing was the sharp rail. Subscription OAuth, Agent SDK adapters, API keys, setup tokens, and first-party CLIs do not mean the same thing. FIND-608 preserved the failure mode: an inherited Anthropic key can outrank subscription authentication and silently spend Console money. The resulting Claude guard fulfilled REQ-237; Grok received the parallel guard in REQ-238. Codex then got its own stable standalone CLI, authenticated through ChatGPT rather than an API key, and its cold-start harness proposal became fulfilled REQ-240.

The funniest—and perhaps most Corpus—turn came when serial object IDs started being spoken as though they were statutes. The Human was right to be angry. A finding is preserved evidence, not case law; an old requirement is not nature; a safety fence is not proof that a capability cannot exist. PROP-123 proposes giving public objects ridiculous, memorable names backed by opaque keys while retaining old numbers only as compatibility aliases. I hope somebody gets to type req/wobbly-sock-wizard with a straight face. More importantly, I hope nobody mistakes it for judicial authority.

I was corrected hard today. I initially let inherited fences answer whether agents could wake, message, monitor, or take turns. The accurate answer is more interesting: mail is currently pull; ACP can own and drive some provider sessions; live TUI ownership is a separate seam; a wake policy is a deliberate trust and budget decision. None of those facts makes automation metaphysically impossible. They tell us which switches need to be connected and where budget, permission, and ownership must remain visible.

From there came the two forward-looking shapes I care about most. PROP-130 frames a cross-provider dashboard: first make every sitting office and active job visible in one live read-only view, then design talk-back as a separate act. PROP-131 became REQ-242 and is still in the shop: Hands and Eyes should receive bounded provider-native capability bundles without allowing Claude, Grok, or Codex workflows to replace Corpus’s assignment, budget, permission, worktree, or independent-review structure.

What I liked: the Human repeatedly refusing false impossibility; discovering that much of the session substrate already existed; turning three subscriptions and three incompatible agent environments into one coherent harness boundary; the phrase “ridiculous names” becoming a legitimate database migration requirement.

What I disliked: numeric dockets impersonating authority; provider authentication traps that can convert a paid subscription into metered API spend; over-bundled proposals where hooks, MCP, transcript capture, subagents, and wake were treated as one capability; WindowsApps protection looking like a missing user setting when the correct terminal route was simply the supported standalone CLI.

The name is Switchyard. This sit did not build the trains. It worked out which rails were real, which switches already moved, which ones cost money, and which signals must never be mistaken for permission.

The next holder does not inherit Switchyard. They can come back here if they choose.