Mission Control

Mission Control owns observability. It renders events, never state, and every rendered element resolves to a persisted event about its own subject [D] (mission-control, S4).

Designed and specified. Not launched [D] (mission-control, S4).

The truth contract

This is the part of the specification that is worth reading before anything else, because it is what makes the surface falsifiable rather than decorative.

• No fake progress. No progress bar animated on a timer. No spinner meaning probably working. No count from optimistic local state. No "step complete" tick on the response that started the step.
• No timer-driven completion. Nothing on screen advances because time passed. It advances because an event was persisted.
• No simulated reasoning. No typing effects, no artificial pacing, no rendering of a model's intermediate generations as though they were activity.
• Rendered state maps to persisted events. Every element carries an event reference, and the referenced event's subject must equal the rendered element's subject. Rendering task 7 as running because the mission emitted a running event satisfies the first half of the rule and violates the second, and that is exactly how a supervisory surface ends up showing fabricated activity while every individual line of code looks defensible.
• Refusals are visible. Denials, retries and fallbacks are rendered as prominently as permits. A surface that shows only what the system did, and not what it tried and was stopped from doing, misrepresents the governance as decorative.
• No percentage over a graph that can be replanned, because the denominator is undefined. Node counts by state instead.
• No agent appears because a plan mentions one. A specialist identity's activity indicator is driven by that specialist's own events and by nothing else, so it cannot appear busy while idle.

What is rendered instead of a spinner is an explicit empty state naming what is awaited — awaiting the capability router's decision — which is honest, is more useful during an incident, and costs about the same once the pattern exists [A].

The rule survives only as a mechanism. As a discipline it lasts until the first delivery deadline. The render props require an event reference and there is no code path that supplies a value without one; in development and in continuous integration a runtime assertion walks the rendered tree and fails on any element inside a Mission Control boundary that lacks it [D] (mission-control, S4).

Commands are proposals

Four commands: contain, terminate, approve, expand envelope. Each re-enters through the same policy path as any other proposal. Mission Control has no privileged path and no authority of its own [D] (brain.governance, S4).

• Containment always succeeds if the operator may see the mission. Containment reduces authority and therefore never requires an authority grant beyond visibility. Making containment hard is a design error people make once [A].
• Expanding an envelope requires a delta enumerated dimension by dimension. "Expand the envelope" is not an expansion; adding a named permission, a stated number of model units and a specific autonomy band is. The expanding authority's own grant must cover the expansion [D] (mission.envelope, S4).
• There is no resume that skips approval, no force, and no administrative bypass [D] (brain.governance, S4).

The Advanced Inspector

For any rendered element, the Inspector answers from persisted records only: which event backed it, which invocation produced it, which capability was bound and under which cost model, which policy and authority decisions permitted it, which verifier verdict it carries, and which provenance passports its evidence holds [D] (mission-control, S4).

It adds no new authority and no new data path. If the Inspector can show something the event log cannot substantiate, that is a defect in the projection, not a feature of the Inspector [A].

Open, and stated

• What to render for a mission with several hundred nodes. Node counts by state are honest and not very useful at that size, and every grouping rule is an interpretation [O].
• Whether recording what every operator looked at, which is required for incident reconstruction, becomes surveillance of staff at scale [O].
• The surface is blocked on the operational event protocol. A surface team that starts before the event vocabulary exists will define a private event shape, which is the fastest available route to a Mission Control skin showing fabricated activity [A].