Playbook · the delegation loop

How work is handed to agents, and how that trust is earned

Every recurring job in the estate maps to one play. A play says who does the work, at what authority, and how a second party proves it was done. Plays climb from documented to unattended only on the strength of their run records. Written for humans and agents alike: each card pictures the idea, shows the mechanism, and ends with the rules an agent follows.

32 cards · about 6 h of reading · projected from devarno-cloud/plays @ 541e640, read 2026-10-25

The loop in one picture

flowchart LR
  JOB(["A job arrives"]) --> R{"Router:<br/>is there a play?"}
  R -- "no" --> NP["NO-PLAY<br/>seen twice: interview, draft a play"]
  R -- "yes" --> S0["Step 0<br/>search the toolbox first"]
  S0 --> T{"Tier"}
  T -- "T0 reversible" --> DO["Agent runs the play"]
  T -- "T1 needs a signature" --> DO
  T -- "T2 irreversible" --> PK["Agent prepares the packet<br/>human executes or approves"]
  DO --> RV["Reviewer who is not the doer<br/>checks every exit criterion<br/>and its false_pass"]
  PK --> RV
  RV --> REC[("Run record")]
  REC --> LAD["Ladder L0 → L4<br/>computed, never declared"]
  RV -. "a correction" .-> F["Finding<br/>amends a play or says why not"]
  F -. "new version" .-> R
  T -. "T1 waits for the" .-> SW["Signing window<br/>never halt meanwhile"]

Authority tiers

TierMeaningCompleted by
T0Reversible, internal, checkable by evidenceReviewer pass is done
T1Needs a human signature, not urgentBatched into the signing window
T2Irreversible or outward-facingHuman executes or approves each run

Trust ladder

  1. L0 Documented a play exists, nothing has run
  2. L1 Guided the operator executes
  3. L2 Approved the agent executes, the operator approves each run
  4. L3 Sampled an independent reviewer checks, the operator spot-checks
  5. L4 Unattended scheduled, the operator sees exceptions only

T2 plays stop at L2, permanently.

Orientation

The whole delegation loop on one page. Start here.

  1. 000 The delegation loop in one picture · 🔒 Use when you are new to the playbook and need the whole shape before any detail beginner 8 min

Foundations

What a play is, how a job finds one, who may act at which tier, and what “done” means. The rules every other card leans on.

  1. 001 Plays own how, ledgers own what · 🔒 Use when you are about to write a fact about a deck, decision or app into a play, card or prompt beginner 7 min
  2. 002 Anatomy of a play: the template and what the validator refuses · 🔒 Use when drafting a new play or a new version of one intermediate 10 min
  3. 003 The router: every job maps to one play, or it is NO-PLAY · 🔒 Use when a session is handed a job and must decide which play owns it intermediate 10 min
  4. 004 Authority tiers: T0 reversible, T1 signed, T2 irreversible · 🔒 Use when deciding whether an agent may finish a step alone beginner 9 min
  5. 005 Definition of done: evidence, a second reviewer, and no lost corrections · 🔒 Use when about to say a play run, task or fix is done beginner 8 min
  6. 006 false_pass: a check that cannot fail is not a check · 🔒 Use when writing the false_pass column of an exit-criteria table advanced 12 min
  7. 007 Versions and supersession: never edit a merged play · 🔒 Use when a play needs to change after it has merged intermediate 9 min
  8. 008 Ratification: FLIGHT signs, and a merge is not a countersign · 🔒 Use when a play, decision or spec awaits the operator's sign-off intermediate 10 min
  9. 009 Rule L-fix: a correction is not done until it is a finding · 🔒 Use when the operator corrected you mid-session beginner 8 min

Trust programme

How a play earns autonomy: run records, executable checks, planted faults, the L0→L4 ladder, and the permanent cap on irreversible acts.

  1. 010 The trust programme (RS-DL-002): from scaffold to proven autonomy · 🔒 Use when you need to know what phase the delegation programme is in and what closes it intermediate 11 min
  2. 011 Run records: one JSON file per run, failures included · 🔒 Use when writing, reading or validating a run record intermediate 10 min
  3. 012 One executable check per exit criterion, re-run by a second principal · 🔒 Use when turning a play's exit criteria into code advanced 11 min
  4. 013 Planted faults: proving every check can fail · 🔒 Use when a check has only ever been green advanced 10 min
  5. 014 The trust ladder: L0 Documented to L4 Unattended · 🔒 Use when someone asks how trusted a play is intermediate 12 min
  6. 015 T2 is capped at L2 forever: no evidence buys irreversible authority · 🔒 Use when someone proposes letting an agent publish, deploy, change DNS, rotate credentials or move money unattended beginner 7 min
  7. 016 The scoreboard and devarno.si: a public projection that cannot lie · 🔒 Use when someone wants to show how trusted the delegation loop is intermediate 11 min

The automated loop

What runs while nobody is watching: the 12-hour tick, two separate principals, exceptions that open and close themselves, and the alarms that fire when the loop goes quiet.

  1. 017 One 12-hour tick, end to end · 🔒 Use when you need to know exactly what the scheduled loop does between 06:17 and 18:17 UTC intermediate 12 min
  2. 018 Two principals: loop-doer, loop-checker and the principal table · 🔒 Use when deciding which identity may write, review, ratify or merge in the loop advanced 12 min
  3. 019 Exceptions that open and close themselves · 🔒 Use when a loop-exception issue opened and you need to know what condition raised it and what will close it intermediate 10 min
  4. 020 Heartbeat and dead-man: making silence loud · 🔒 Use when the loop may have stopped and you need to know which alarm should have fired intermediate 9 min
  5. 021 Subject cards: what the loop sweeps, and why onboarding is one file · 🔒 Use when onboarding a new org, DNS subject or IRINA target into the scheduled loop intermediate 9 min

Play catalogue

The plays themselves, with worked examples across every tier.

  1. 022 The play catalogue: every play by job, tier and owner · 🔒 Use when you need to find which play owns a job before doing any recurring work beginner 11 min
  2. 023 Worked example: PLAY-016 org health sweep · 🔒 Use when you want to see one play end to end, from card to score to exception, with every check explained intermediate 13 min
  3. 024 Worked example: PLAY-018 auditing the instrument (IRINA reading review) · 🔒 Use when an IRINA drain-time reading looks wrong and you need to know whether to believe it advanced 13 min
  4. 025 T2 plays: a deck act under GO, and retiring a surface · 🔒 Use when any write to a VPS deck (SPUTNIK, APOLLO, ODIN) or DNS that points at one is being planned advanced 14 min
  5. 026 PLAY-001 signing window: batch the signatures, never halt · 🔒 Use when work is blocked on a decision, phase close or play ratification that needs FLIGHT's signature intermediate 12 min
  6. 027 Human-led plays: PLAY-010 demand before money, PLAY-019 walking the runbook · 🔒 Use when a launch-to-revenue gate needs proof that real people want the product before money is switched on intermediate 11 min

Extensions

Where the programme is going next: the trust core end to end, and the revenue loop.

  1. 028 RS-DL-003: the trust core, end to end · 🔒 Use when you need the plan for taking the loop from 'runs' to 'independently proven', phase by phase advanced 13 min
  2. 029 RS-DL-004: the revenue loop — one rail, demand first, money that stays consistent · 🔒 Use when deciding how an app should take money, and in what order relative to other apps advanced 14 min

Adoption

Taking the loop to any project, and the one-page reference an agent keeps open.

  1. 030 Adopting the loop in any project · 🔒 Use when bringing a new project, org or recurring job under the delegation loop intermediate 12 min
  2. 031 Agent quick reference: read order, hard refusals, evidence · 🔒 Use when an agent session is starting work that might be covered by a play beginner 8 min