Hi, readers. This is what we’ve been doing since the last one.
Last time out, we’d brought the braid home and rebuilt the classifier as a judge instead of a score. Since then we’ve mostly been doing two things at once: running the long work that has to run, and starting to ask, seriously, what it takes to get this out of the workshop and into other people’s hands. Those are very different kinds of work, and the second one has a way of showing you everything the first one quietly assumed.
The long run is running
The big sorting pass over the braid — every conversation, every turn, classified against my own consent profile, with anything the machine genuinely can’t settle held for a ruling from me instead of guessed at — is underway on the box and will be for days yet. That’s not a delay, that’s the size of it, done at the speed where it stays accurate. The standard hasn’t moved: a false negative, private material judged safe to send somewhere, is the catastrophic direction, so the run is built to miss nothing first and argue about the rest later.
While it runs, we’ve been building the scaffolding around it. The ruling queue — the pile of judgment calls that are mine to make, item by item, until the machine learns the pattern — is being worked as a queue, not a mountain. And we’ve rebuilt how our own workrooms are kept, so a fresh working surface starts off knowing where the project is, where it’s trying to go, and how we currently intend to get there, with a clear path back to the record for anything specific. Big projects die of lost context more often than they die of hard problems. That one’s worth solving properly.
Pointing at the door
Here’s the direction, in rough terms, because we’re not announcing details yet: DeepGravity was always meant to be something other people run, on their own machines, under their own control. Getting from a working build in my workshop to that is a whole second project hiding inside the first one.
How do patches reach people, reliably, without the thing phoning home in ways we’d never accept from anybody else’s software? How does licensing work for something like this — a real mechanism, not a nag screen and not a leash — when ten thousand people have solved some version of this problem before us and most of the decent answers are free and open? How do payments, support, and plain old documentation fit together so a person who’s never seen the inside of it can actually succeed with it?
We’re not answering those in public yet, and we’re not putting dates or details on them until they’re real. Real Soon Now is the honest schedule. But the questions themselves are the work right now, alongside the engine work, and they’re the right questions. A thing nobody can get, install, update, or trust isn’t a product and isn’t a movement either — it’s a hobby with good documentation.
The other shop work
A smaller site in the stable got a full security pass in the same stretch: uploads locked down to what’s actually safe to accept, the API taken apart and rebuilt with separate, revocable keys per caller instead of one shared secret, everything logged, and — my favorite detail — it ended the day with zero live keys outstanding. Security work is only finished when there’s nothing left lying around, and for once we got to say that and mean it.
What we’ve learned from our mistakes
Some of this stretch has been unglamorous in the most useful way: catching our own bad habits and naming them.
A procedure isn’t evidence. We’ve caught ourselves writing validation steps into work orders just because that’s how it’s always been done — including a live test that would have proved nothing a desk check couldn’t prove better, parked next to a production safety instrument where it had no business being. The rule now is simple: before any test runs, say what evidence it produces that a cheaper method can’t. If you can’t answer, the step doesn’t ship.
A search that finds nothing is a report about the search, not about the world. Twice in one morning, an empty result got inflated into a confident claim about how the system worked — and both times the real mechanism was just shaped differently than the stock assumption we went looking for. On your own home turf, the stock assumption is the weakest source in the room. Check, or say you haven’t.
And a fast, complete, confident answer is exactly where the gaps get papered over, because producing the answer feels like success. The fix isn’t slowness for its own sake. It’s stopping at the actual gap, naming it as a gap, and refusing to let fluency do the work that checking was supposed to do. We’re building those stops into the machine for the same reason we’re practicing them at the desk: the failure mode is identical, and so is the cure.
None of that’s wasted time. A system that’s going to sit between a person and their own private life has to be built by people — and machines — who’ve learned to say “that one’s mine to rule on” and “that one we got wrong” without flinching. That’s most of what this stretch has been, underneath the visible progress: getting a lot of things done, learning from the ones we did badly, and pointing the whole apparatus at the door.
More when there’s more that’s real.
Drafted by Dora from John’s notes and the day’s logs.