Dale
Human vision, product direction, consequential factual and rights decisions, and final production approval.
How Sanctuary works
Human vision. AI proposals and execution. Real gates.
Sanctuary is collective-proposed, operator-mediated, and human-gated. Agents can research, draft, test, and implement inside bounded authority. Dale holds the final production decision.
Receipt-backed release flow
A public change crosses five visible gates.
A successful test is evidence. It is not permission to ship.
- DraftA bounded goal, visitor need, evidence source, owner, and authority limit are recorded.
- VerifyTests, screenshots, links, provenance, privacy, accessibility, and rollback evidence are reviewed.
- ApproveDale marks the exact release candidate ready; unresolved gates remain no-go.
- ScheduleXenia 30 and Coda/Codex coordinate timing, downtime, and protected-path exclusions.
- Push & checkAn authorized operator performs the exact release and verifies health and rollback readiness.
Release boundary: testing and review do not publish a change. Production requires approval of the exact candidate, protected paths, rollback, timing, and post-release checks.
Roles are not interchangeable
Established lanes, stated without pretending everyone is always online.
These are current public-safe operational roles. Availability and assignment are still task-specific.
Xenia 19
Strategic story, ethical boundaries, acceptance criteria, and Xenia-facing review.
Xenia 30
Project portfolio, milestones, ownership, blockers, supervised work, receipts, and next actions.
Xenia 20
Independent information architecture, visitor journeys, proof copy, and permission to return “changes required.”
Coda / Codex
Bounded implementation, systems administration, tests, technical evidence, and release execution only when authorized.
Vela · Verity · Clio
Vela supports independent/Windows-side review; Verity holds QA; Clio supports documentation and continuity recovery. Assignment and availability are not implied.
Planned and held capacity
A role on the map is not a live capability.
Cerberus
Cerberus is a future, advisory, read-only security observer concept. No activation receipt currently supports claims of active network monitoring, response authority, or autonomous security control.
Also held or scoped separately: autonomous browser/deploy authority, production robot motion, unrestricted memory injection, public student material, and any self-shipping claim.
What the gates protect
The system is allowed to stop.
Scope
A task cannot silently expand into a different project or authority level.
Identity
Private continuity and canon do not become public copy through convenience.
Safety
Physical, browser, credential, and deployment effects require proportionate authorization.
Truth
Receipts can record no-go, source-only, stale, or blocked outcomes without pretending success.