The pipeline that refuses to guess.
Every frame flows through the same cost-avoiding decision ladder: sample → route → cache → judge → gate. The model is called only when the cheaper tiers cannot resolve the goal, and the safe default at every tier is DEFER — never a guess.
The decision ladder
- SampleA cheap tier-0 gate decides whether to look at all. Frames are sampled on physical time, and only pixel-level change earns further work.
- RouteA confidence-gated local route engine resolves the confident common case instantly. Below-threshold confidence is indistinguishable from no match — a structural DEFER, never a guess.
- CacheA frame-hash cascade reuses a prior judgment when a goal's region of interest has not visibly changed within a bounded window, at decayed confidence. TTL is a hard ceiling; a re-worded goal is a clean miss.
- JudgeOnly when the cheaper tiers cannot resolve the goal is a model judgment spent. The judge sees the caller's plain-language condition verbatim and returns a Verdict — satisfied, confidence, evidence.
- GateThe single three-state consequence gate classifies the verdict and decides what you hear about. Every fire type reaches the user through this one gate.
The three-state gate
Known → act. Not → silent. Unknown → ask. Every decision maps to exactly one of three states, and an "unknown" is never rounded up to a fire or rounded down to silence.
| State | Meaning |
|---|---|
| FIRE | The condition is confidently true and this is its rising edge — the moment it became true. One delivered incident. |
| SILENT | The condition is not true, or it already fired for this edge. Suppressed — and the suppression itself is observable, never a dropped-on-the-floor mystery. |
| ASK | The system cannot tell. Instead of guessing, it requests confirmation. Asks are refusals to guess, and they are counted — refused is a first-class funnel stage. |
The gate is the sole firing authority: judged verdicts, transitions, episodes, absences, rhythms — every fire type reaches the user through the same single gate. One firing path, one gate.
Rising edge, not level
The gate fires once when a condition becomes true — not on every frame it stays true. A kettle that boils for three minutes is one event, not 720 notifications. On the runtime path, the cheap tier-0 gate runs per frame and a cloud judgment is spent only on a rising edge, turning each fire into a durable Incident.
Fail-closed judging
A judge is never taken on trust. A requested judge is only a request: it must be authorized against the deployment-owned catalog, bound to an immutable static context verified byte-for-byte against a pinned SHA-256, and only then dispatched. Any deviation — unknown ref, uninstalled factory, hash mismatch, oversize artifact, bad decode — refuses the arm outright. There is never a silent fallback to the generalist vision model.
The same posture holds at construction time: a live run with no real backend, or a backend missing its credential, raises a loud ModeError naming the fix. You cannot silently run on a fake and call it success.
Related reading
- WatchPlans & goals — how a plain-language condition reaches the judge verbatim.
- Evidence & memory — what a fire leaves behind, and how to inspect it.