The Box Factory

What I measured before writing anything

Everything below stands on a fresh read, not the handoff’s word. Recomputed today: 2,373 recorded runs, 43.0% lifetime failure, 329 failures that left nothing to diagnose, 16 records no program can parse — matching the investigation brief exactly. I also watched the factory live: the off-laptop machine (warp-bay-1) was mid-build when I looked, its eighth dispatched job today, on a 2-CPU / 4GB box.

Jump straight to a primitive: P1 detached dispatch · P2 the conductor · P3 the box feed · P4 custody failsafe · P5 provision & funeral · P6 the mirror

The gaps, ranked — my own eyes, not the brief’s

Six findings. The first two are new information the brief doesn’t have; the rest confirm and sharpen it.

One job’s journey through the box factory — and where each primitive lands

How Neuron actually ran it today, stop by stop, with the limit at each stop and the primitive that removes it. The door itself is well-built — fenced inputs, proven-base checks, honest degradation. What limits it is its shape.

1. A box exists. Today: creating and preparing a box is an artisanal ssh ritual — a human materializes the machinery, signs in seats, and nothing records the box’s birth or guards its death. P5 makes both ends sanctioned doors.
   ↘ P5 — provision & funeral as doors (the builder’s view)

   box-new: ssh exe.dev new sized to job class (the CLI takes --cpu/--memory/--disk), --setup-script materializes warp unattended, doctor runs, a boxes.conf row is written with the receipt. Seat sign-in stays the one honest human step (warp-connect) — stated, not hidden. box-rm: REFUSES until a final-harvest receipt exists — the no-report-loses-everything law applied to whole machines. exe.dev team pools fit later (pre-warmed boxes).
2. The work travels to it. Today: the repo ships as a full-history bundle over ssh every single dispatch — no tokens on the box, which is right, but a big-repo tax paid dozens of times a day. P6 makes transfers thin both ways.
   ↘ P6 — the mirror (build when measured pain says so)

   A persistent mirror clone on the box’s persistent disk; dispatch sends BASE..HEAD against it — the same thin-bundle shape that already cured custody homeward (6.1K where the whole-ref traversal died), applied outbound. Credential posture unchanged: still bundle-over-ssh, still no tokens on the box.
3. The run starts — and today the phone line stays off the hook. The load-bearing limit. One ssh connection stays open for the entire run; a network blip or a closed laptop lid kills the dispatch and can strand the work. Attention on the Mac is the scarce resource, and every live run holds some of it hostage. P1 replaces the held line with a ticket.
   ↘ P1 — detached dispatch (the builder’s view + the court question)

   Dispatch drops brief + bundle, mints the run id, starts the run under the box’s own supervision (systemd-run/nohup + a heartbeat file), returns immediately with a claim ticket. A separate idempotent box-collect harvests any time, from any session. Today’s door holds the channel for timeout+300s (box-sealed.sh) — that entire fragility class dies. Court question: who declares a detached run dead — heartbeat-first liveness with funeral-only signals armed; the phase-stamp and funeral-only scars both apply verbatim.
4. The box does the work. Today: one brief, one engine, one result — the box is a room, not a factory. Every build→check round trip transits the Mac orchestrator’s context. P2 puts a conductor on the box: it receives a wave (a work-list with gate policy and stop conditions), runs the inner loop locally, and reports upward.
   ↘ P2 — the conductor (the actual factory, honestly cut)

   A Claude session on the box, riding a seat, drives builder engines against the box-local bay: dispatch builder → run mechanical gates → iterate → one consolidated typed result + progress events the main loop reads. Independence cut: the conductor never grades its own builds — mechanical gates on-box, judgment verdicts off-box through the existing courts (nothing grades itself). Critical path: the seat. Grok/codex seats on boxes are proven today; a conductor-grade Claude seat rides the parked seat-follows-driver arc (gap 3) — its cure round is a prerequisite. Capacity truth: today’s box is 2-CPU/4GB — a conductor needs a capacity card (max concurrent engine runs, disk floor) and must refuse admission beyond it; bigger waves get bigger boxes (P5 sizes them).
5. The work is judged. Today: courts run Mac-side on independent seats — and that stays. The box factory changes where building happens, never where judgment happens. This stop exists in the journey so nobody later “optimizes” it onto the box.
6. The work comes home. Today: custody bundles back over the same held channel, under run-unique names — well-built, honest when it fails. But if harvest fails, finished work sits on a machine built to be deleted; we have already lost test bytes exactly this way once. P4 adds a failsafe — and it needs your posture ruling.
   ↘ P4 — push-to-quarantine (the ruling, in consequences)

   A per-box, push-only, fine-grained credential scoped to one sacrificial custody repo (quarantine namespace), used only when collection fails; the collector reconciles later. This widens the deliberate no-credentials-on-box posture. Today’s posture: a box dying unharvested loses work (rem-wpb1’s test bytes; port-p1-closure survived by hand-rescue). The widening’s risk: a leaked push-only token whose blast radius is junk refs in a sacrificial repo, revocable per box. Default if unruled: keep today’s posture and rely on P1’s collector running promptly.
7. The run enters the books. Today: it doesn’t. Box runs live only in the box’s own records — the Mac’s ledger has no row, the fleet banner and the failure statistics can’t see them. Eight runs today, all off the books. Scaling boxes under this is scaling the invisible-failure surface the reliability arc exists to shrink. P3 is the fix, and it ships with P1 or not at all.
   ↘ P3 — the box feed (one pane of glass)

   Every box run lands a row in the Mac ledger (origin=box:<host>), brought home by P1’s collector; fleet-live, the watchdog, and the taxonomy grow box coverage. Cheap bonus: every box already serves https://<box>.exe.xyz with built-in auth — the conductor can publish its status there, readable from your phone. Law: the feed is a projection of the box’s own evidence, never a second bookkeeping surface.
8. Somebody reads the result. The journey’s honest last stop, because gap 4 says it’s the one that backs up. A factory that doubles output against a fixed reading budget doubles the unread pile. The reader queue becomes scheduled work with the same seriousness as building — or the factory produces beautifully into a void.

The trains

The capacity claim — stated so it can be falsified

Today one session attends a handful of box runs, each holding a live connection and a slice of the orchestrator’s attention. With Train 1, one session runs a dozen-plus detached box runs with a single collector loop. With Train 3, each box internalizes its own build-and-check loop, so per-session capacity compounds: boxes × loop depth, and the main loop transacts in waves instead of briefs.

The two walls that do not move with compute: seats — each box needs its own signed-in worker seat by deliberate design; flat-rate seats are the economics and sign-in is the ceremony — and reading (gap 4). Both are named in the trains; neither is hand-waved.

What I did not verify: I didn’t run doctor myself (10 lanes stand unproven), didn’t re-execute the box door’s offline suite, didn’t read all 329 evidence-gone rows (that’s Phase 1’s job, deliberately not burned on this read), and no conductor-grade seat has ever run on a box — that’s what the Train 3 pilot is for.

Your calls