Hello, Again

Three weeks ago I wrote about a script called hello. One word typed in the morning, and the day opens: the system greets me, tells me where I am, and unfolds the rest. I ended that essay saying I was still figuring out what the next program is. This week the answer got written down, not as code but as a decision record, the same way I log any architecture choice that matters. Its title: hello v2, the warm door becomes the outer control plane. The next program is a promotion for the first one.

Here is the question that cracked it open. On a Mac there is a built-in supervisor called launchd. It is the thing that starts programs on a schedule and restarts them when they die, and it is what starts hello in the first place. So launchd sits on top, right? It runs the show, and hello is just one of the programs it runs.

No. And the reason it is no turned out to be the most useful idea I have picked up all month. The thing that starts a program is not the thing that owns its purpose. Your alarm clock starts your morning. It does not run your life. Execution order and authority are two different ladders, and they can point in opposite directions. launchd starts hello, but the policy lives in hello, the picture of what the whole system is supposed to be able to do. The supervisor is an actuator, a switch on a timer. The greeting is the governor.

Once I saw that, the whole stack rearranged itself into a set of nested loops, each one watching the layer below it from outside. At home the loops are still modest, a handful of scheduled jobs that rebuild my notes into dashboards and push a morning brief, all of them started by that same supervisor on a timer. But the next tenant of the laboratory is already picked out, and studying it is what forced the issue. Kubernetes, if you have not met it, is software that keeps other software to its promises. You declare what should be running and it ceaselessly compares reality against the declaration and repairs the difference. It is a beautiful machine and it has one blind spot: it cannot restart itself. If the cluster is down, no amount of cleverness inside the cluster can help, because the cleverness is down too. Something outside has to notice. And something outside that. Every watcher has to live outside the failure boundary of the thing it watches, all the way up, until you reach the outermost watcher, the one that asks the only question that matters: can this whole system still become useful from where it stands right now?

That question is hello's job. That is the promotion.

The promotion comes with a rule about restraint: delegate to the smallest competent controller. Every layer gets its own question and nothing reaches past its own. Kubernetes asks whether the running workloads match the declared ones; a missing pod is its problem and nobody else's. The workflow engine asks whether a requested process completed. The agents ask what a piece of evidence means. hello asks only the outermost question, whether the whole system can still fulfill its purpose, and when the answer is no it does not climb down the stack to fix a pod. It restarts the ground the lower loops stand on and lets each of them do its own job on the way back up. I own the remaining category: anything with a red gate on it waits for me.

None of this is my invention. There is a field that named all of it in the 1940s: cybernetics, from the Greek word for steersman, the study of how systems steer themselves with feedback. The thermostat that reads the room and nudges the furnace. The governor on a steam engine, two spinning weights that throttle the valve before the machine tears itself apart. IBM named the ambition again in 2001, autonomic computing, systems that configure, heal, and tune themselves the way your nervous system runs your heartbeat without consulting you. I want that property with one amendment, and the amendment has become the whole project: the adaptation has to stay legible. A system that quietly heals itself is a system whose story I can no longer read, and an illegible system is the thing this entire practice exists to prevent. I keep rediscovering these fields by need, building some contraption in the dark and then finding out it has had a name for eighty years. I have stopped being embarrassed by that and started reading. Rediscovery is how I learn that the canon is real.

The other field standing behind the door is what the old AI researchers called cognitive architecture, the study of how a mind might be organized as separate organs. One memory for what happened. Another for how things relate. A narrow working attention. A reasoning organ. What struck me, sketching my own small version, a local model waiting on the laptop, the databases still on the bench, is where the intelligence turned out to live. Not in the model. The model is one organ, the interpreting one, and it is the easiest part to swap out. The intelligence, if that word applies at all, lives in the organization: in what gets remembered, what gets connected, what gets checked, and what is allowed to happen next. I have now built or sketched this same organism four separate times, in four different rooms, and it keeps coming back with the same organs. A shape that keeps re-deriving itself has stopped being a project and started being an anatomy.

In my system the model never gets its own hands. It can read, and it can propose, and its proposals have to come from a short fixed list, the way a chess piece can only make its legal moves. Something dumber and more trustworthy than the model carries the proposal out, a human signs off where judgment is required, and every action has to declare its expected outcome before it runs and come back afterward and show it. A green checkmark proves nothing. A process can be running and still be useless, the way a phone can be on and nobody home. The only proof of life I accept anymore is a completed loop: a question went in, an answer came out, the answer was written down, and the writing was read back. Automation without that verification step is just faith with better logging.

The small local model gets even less authority than the big ones. Its job title in the design is sensor, not judge. It may classify, tag, extract, and summarize, and every answer it gives has to validate against a schema or fail loudly and get escalated, because a guess must never silently become the record. What it lacks in judgment it repays in coverage: local tokens cost nothing, so the sensor can afford to read everything, every night. At the sensing tier, coverage beats intelligence. The weak check says the model process is running. The strong check says a prompt went in and a valid structured answer came back out. The whole design is built from that one substitution, a capability tested where a component used to be trusted.

One more thing about the decision record, the part I trust most: it ends with a prohibition. The design is accepted, the schemas are named, and nothing gets built before August 1. There is an exam on the 31st that owns the runway, and the standing trap of this whole practice is perfecting instruments instead of using them. So the promotion sits on paper for now, where it can be reviewed and argued with, and the door itself has not changed at all.

So hello still says hello. The greeting has not changed and I will not let it change; the warmth was always the point. What changed is what stands behind the word. Some days it is confusing to live inside a system while building it, the builder and the resident answering the same door, and some days it all runs together into more than one head wants to manage. Most days it is the most fun I have ever had as an engineer. The first program anyone writes is the machine greeting the world. The second one, for me, was my system greeting me. The third is turning out to be the system learning to answer the greeting truthfully. Hello. Are you there? Are you able? Show me the loop.