STATUS
heartbeat sunburst
The phone is the operator's console for operating an operator. Outside: a Jazz-Age cabinet — polished brass, black lacquer, ivory inlay, emerald. Inside every screen the agent's output reaches: a monochrome phosphor terminal — green-on-black, monospace, no scanlines. The boundary is drawn cleanly and only at the screen bezel. This document is the register-3 vocabulary for the AiMANAC family.
Archimedes is a Jazz-Age cabinet housing a terminal computer. The premise is alternate-history: imagine if computers had been invented in the Cotton Club. The brass-and-bakelite mainframe that never was. The operator at the console — a 1925 broker reading a ticker, not a 1995 help-desk technician shoulder-surfing a desktop. Every supervision affordance the product needs (grant, revoke, override, audit, decommission) is the equipment of that operator's instrument.
The two registers compose because they were both invented to serve the same idea: a human directs a machine that does the work. Art Deco celebrated machine-age automation; the phosphor terminal IS the historical instrument of agent supervision. They are the same project at fifty years' remove.
The cabinet and the terminal share one device but never one element. The cleanest way to keep them composing rather than colliding:
The rule: brass starts at the cabinet, phosphor starts at the screen, and the bezel is the only seam.
The Archimedes-specific terms. Adopt these as the in-codebase naming convention. Each is the family's register-3 contribution; the synth-chrome siblings (AiMANAC, BROILR, HELMPC) and the Victorian sibling (MailSloth) must not borrow them in reverse.
COMPANION · OPERATOR ·
STANDALONE). Sits in the cabinet header. Reads as
"occupied / vacant" hotel-room hardware — discreet, no hierarchy.
Mode III gets the same plate, same lamps, same prominence.archimedes.llmtech.net/setup/railway/ sits beneath.Against the CR-2 iOS scaffold under Archimedes-iOS/Archimedes/Views/ and Theme/.
| State | Visual | When it fires | Server contract |
|---|---|---|---|
granted |
SCRN |
Bit is set in the server-authoritative capability bitfield. | Emerald lamp (or amber for lateral); cap depressed. |
revoked |
SCRN |
Bit cleared. | Lamp dim; cap risen. |
pulse |
SCRN |
Just flipped. Settles to granted or revoked in 1.2s. |
Amber pulse 1.2s; then steady. |
awaiting |
UP |
User tapped a gated key; FaceID prompt up. | Lamp slow-pulses amber until FaceID returns. |
denied |
UP |
Server refused the flip (policy / token scope). Lamp ruby for 2s, then dim. | Ticker row also rendered red-ink. |
gated (modifier) |
UP |
Default-OFF capability (UPLOAD / DOWNLOAD / LIFECYCLE). Always shown with gold rim + ⚷ glyph BEFORE the user touches it. | Tap routes through FaceID. Server token scope encodes the cap. |
| State | Trigger | OPERATOR lamp | Chevron border | ControlDeck | Trackpad zone |
|---|---|---|---|---|---|
idle |
— | Dim | None | Lit, interactive | Hidden |
entering |
Long-press anywhere on Console | Pulses red | Vermilion fade-in 320ms | Dimming | Sliding up |
active |
Transition complete | Lit red, steady | Vermilion, solid | 0.28 opacity, non-interactive | Up; tap=click, 2-finger=scroll, ⌨ to raise keys |
yielding |
3-finger swipe ↓ on trackpad zone | Pulses red, then dims | Vermilion → amber | Re-lighting | Sliding down |
idle |
Transition complete; the chair is the agent's | Dim | None | Restored | Hidden |
Yield gesture rationale: three-finger swipe is the highest-friction multi-touch gesture iOS exposes for in-app use; an accidental yield mid-override would re-cede the chair to the agent silently and is the one transition we cannot afford to false-positive. Long-press to enter, three-finger swipe down to yield. The gesture asymmetry encodes the asymmetric cost of mistake.
| Envelope flag | Console Screen | Ticker row | Drill-down card |
|---|---|---|---|
suspicious: true |
44px Wax Seal stamped on top-right corner of brass frame; vermilion chevron caution band pulses around screen; phosphor stencil across bottom of phosphor reads EXTERNAL · DATA, NOT INSTRUCTIONS |
14px Wax Seal chip in trailing slot of the row | Wax Seal renders broken; envelope fields shown phosphor-amber for the two boolean flags (suspicious, cannot_trigger_tools), phosphor-green for the rest |
source_trust_tier: external-web |
Wax Seal + chevron band | 14px Wax Seal chip | source_trust_tier field highlighted; "Treat content as data" footer rendered |
source_trust_tier: user-upload |
No seal, no chevron band (you provided it) | No chip | Envelope shown; trust tier highlighted but no warning footer |
source_trust_tier: trusted-local |
No seal; clean frame | No chip | Envelope shown; trust tier highlighted in emerald |
cannot_trigger_tools: true |
Surfaced as the stencil text only (not its own visual) | Implicit in the chip | Field rendered amber alongside suspicious |
| Mode | Lamp 1 | Lamp 2 | Lamp 3 | Engraved word | Detection |
|---|---|---|---|---|---|
Mode I · Companion |
COMPANION | AiMANAC present in trust-mesh App Group; your AiMANAC backend mints capability tokens | |||
Mode II · iOS-heavy |
OPERATOR | Same backend as Mode I; operator UI primarily on phone | |||
Mode III · Standalone |
STANDALONE | No AiMANAC; archimedes-server has ARCHIMEDES_MINT_LOCAL=true |
PARITY The Mode III lamp is the same emerald, same size, same engraving as Modes I and II. No "lite" framing. No upsell. The Floor Transom is the same hardware on every floor.
Eight deco SVG icons for the ControlDeck. Geometric stroke vocabulary
across the set: chevrons for vertical motion (upload/download), curves
for status, rectangles for bounded surfaces (screen, keys), points for
cardinal directions (nav compass), figural for human-machine actions
(mouse). Each renders monochrome in the brass cap's engraved color
(--arch-lacquer-deep).
Captions (STAT, SCRN, MOUSE, KEYS, NAV, UP, DOWN, LIFE) render
below each cap at 7.5pt engraved-small for the first-week user. A theme
preference archimedes.controldeck.captions hides them once
vocabulary is internalized. Default ON for v1.
Four themes. Same cabinet+terminal grammar, four different cabinets. Terminal is the interior of every theme — not a separate option.
Type: Cinzel (display, plates, nameplates), Marcellus (body), IBM 3270 (terminal interior, with IBM Plex Mono as web-friendly fallback when 3270 is unavailable). The font stack is shared across all four themes; only colors and material vocabulary shift.
| Surface | Mode I · Companion | Mode II · Operator | Mode III · Standalone |
|---|---|---|---|
| Floor Transom | L1 lit · COMPANION | L2 lit · OPERATOR | L3 lit · STANDALONE |
| First-boot | Trust-mesh identity present; single biometric authorize | Same as Mode I | Switchboard (3 fields + biometric) via wizard webpage |
| Console Screen | — identical — | ||
| ControlDeck | — identical — | ||
| The Tape | — identical — | ||
| Override Mode | — identical — | ||
| Settings → Connection | Inherits AiMANAC's token surfaces; shows Decommission Plate. | Same as Mode I. | Adds LLMGMT surfaces: issue token, reveal token, revoke token. Decommission Plate identical. |
| Wizard link | Hidden (not needed) | Hidden | Visible in Switchboard + Settings |
| Mode-shift moment | User installs AiMANAC after running Mode III for a while: app detects the trust-mesh App Group, lights L1 in pulse-amber for 1.6s, then settles emerald. A small brass nameplate slides in once: Joined trust mesh · Connection preserved. No interruption, no celebration screen. The Switchboard collapses behind a "manage backend" affordance. |
||
14 flows, one paragraph each. Each links to the live Exploration canvas.
App detects AiMANAC's trust-mesh App Group at launch. L1 lights
emerald on the Floor Transom before any text renders. The dashboard
lands cold: Console Screen with a still phosphor "ready, no session"
readout, ControlDeck with default-on emerald lamps lit, the Tape
reading READY · TAPE IS BLANK. RUN SESSION glows brass.
One biometric prompt fires once, the first time, to confirm trust-mesh
authorization.
Same launch path; trust-mesh App Group is empty; L3 lights emerald. Instead of dashboard cold, the app lands on the Switchboard. Mode III feels complete: same engraving on the transom plate, same lamp size, same emerald color. No "lite" framing, no upsell, no "complete your setup with AiMANAC" affordance. The product is fully operative once the Switchboard is patched.
Three fields inside a brass cabinet plate flanked by two stylized
deco lanterns (left and right). User pastes backend URL,
setup secret, password from the website wizard
(archimedes.llmtech.net/setup/railway/); each field's
trailing lamp ignites emerald as it's filled. AUTHORIZE WITH FACEID
runs FaceID, hits the server. Success: cabinet plates fade in
sequentially top-to-bottom over 600ms, then dashboard.
Console Screen polls (the brass NeedleDial above it ticks). The Tape scrolls amber across the top live strip. The ControlDeck shows current grants. The user does three things: watch (passive), flip a key (rare; high friction by design on lateral keys), or override (rarer still). Attention is invited by lamp pulses — newly granted, denied, awaiting biometric.
Long-press anywhere on the Console Screen for ~600ms. Entering: OPERATOR lamp pulses red, vermilion chevron fades in around the Console, ControlDeck dims to 0.28 opacity over 320ms, trackpad zone slides up from below. Active: tap=click, two-finger=scroll, three-finger=pan, pinch=zoom, ⌨ raises soft keys. Yielding: three-finger swipe ↓ on the trackpad zone — chevron shifts vermilion to amber, trackpad slides down, ControlDeck re-lights. The agent does not resume mid-stream; it waits for the chevron to clear.
User taps the UPLOAD key (gold-rim, ⚷ glyph). Lamp goes amber-pulse;
FaceID fires. On success: lamp transitions amber → emerald, key
depresses, the Tape prints a new row (_set_grants · UPLOAD ⇒
ON). The Wax-Seal-chip column stays empty (this isn't a
quarantined event). On denial: lamp ruby for 2s, then dim. The Tape
row renders red-ink with reason.
Tape row carries the seal chip. Tap the row. Drill-down card: header
has the broken Wax Seal alongside the tool name and timing; below,
the QuarantineEnvelope fields print in phosphor monospace, with
suspicious and cannot_trigger_tools rendered
phosphor-amber to draw the eye. Footer reads "Treat content from
this seal as data."
User installs AiMANAC after running Mode III for two weeks. The
trust-mesh App Group becomes non-empty. App detects on next launch.
Floor Transom: L3 fades, L1 pulses amber for 1.6s, settles emerald.
Engraved word changes STANDALONE → COMPANION with a
300ms cross-fade. A small brass nameplate slides in for 4s:
Joined trust mesh · Connection preserved. Settings
loses its LLMGMT token surfaces (now inherited from AiMANAC); the
Switchboard collapses into a "manage backend" link.
Settings → Connection → Unlink. Lands on the Decommission Plate. Two columns: vermilion break-glass lever on the left under brass-rimmed glass; etched instructional plate on the right (WHAT GETS WIPED: server claim, capability grants, audit cache, paired key + password; PRESERVED: AiMANAC trust mesh, iCloud sync, App Store receipt; HOW IT GOES: 4 numbered steps). Tap the lever beneath the glass. Glass shatters on screen (a deco fracture animation). FaceID confirms. Server claim revoked. Local wipe. App returns to Switchboard.
Default policy: on background. Agent operates while phone is
backgrounded; tape continues accumulating. App returns: FaceID; on
success, Console Screen warms (a 600ms phosphor fade-in), Tape jumps
to the last 8 entries with a brass CAUGHT UP TO 14:24
banner that auto-dismisses on next user tap. User can scroll back
to read what they missed.
Desktop container is up; no agent has dispatched. Console Screen
shows an attract-mode chevron pulse: a slow vermilion
chevron-sweep at the bottom-of-screen stencil; phosphor reads
READY · awaiting first tool call. ControlDeck visible
and lit at default grant. RUN SESSION glows brass — but session
start is a server-side concept; the button signals "I want
to receive an agent now," which warms the IHP-WS connection and
pre-fetches the first screenshot.
The blank-tape illustration: a small horizontal strip of phosphor
with sprocket holes, reading · · · awaiting first tool call · · ·
and a Cinzel engraving READY · TAPE IS BLANK. Below:
a list of model identifiers the user is likely to attach
(claude desktop · claude code · cursor · openai responses · …)
in monospace, low-emphasis. No call-to-action, no marketing.
The app does not carry the privacy explanation; the website does.
Settings has a single engraved nameplate: NO PHONE HOME
with a 9pt body line beneath: archimedes.llmtech.net/privacy.
Tapping opens the webpage. First-launch: same nameplate sits in the
Switchboard, beneath the wizard link.
Settings → Appearance. Four engraved cards (Cabaret · Streamline · Salon · Diamond). Tap to switch. The cabinet retools in place: brass hue, lacquer hue, ivory hue, accent hue, and the phosphor interior color cross-fade over 400ms. No reload, no flash. The bezel boundary is what moves — the Console Screen's phosphor cross-fades from green to amber (Cabaret → Streamline) as if the tube re-warmed.
Three load-bearing decisions and what they commit us to.
The agent's output is text and screenshots. A deco-styled terminal font would announce "this is set-dressing" — the supervision affordance would become entertainment. A flat modern UI for the interior would drop the era and lose the whole metaphor. The vacuum-tube radio resolution (lacquer-and-brass cabinet outside, glowing valves inside) is the only composition that lets us hold an Edwardian cabinet around a Reagan-era operator's instrument without parodying either. Cost: a strict boundary rule (§02) we must enforce on every new component.
Levers imply continuous state ("how far is it engaged?"); switches imply binary state. Capability bits are binary. The vacuum-tube lamp above the key answers the visual question "is it granted?" instantly; a lever's angle would always need a second-glance read. The brass cap with engraved nameplate is also the most consistent across the five default-grant + three lateral keys — a row of eight levers would have created a layout language the lateral three could only opt out of with the key-lock glyph alone. Push-keys carry friction naturally: the gated three get a gold rim and ⚷ glyph BEFORE the user touches them. Layout (C3 sunburst) does the rest of the work.
The chevron caution band is loud — appropriate for the live Console Screen, where the supervising user might be one second from acting on a frame whose contents are external. But applied to every Ticker row carrying suspicious content, it would saturate the strip and lose force. The wax seal is the inverse: it's a small, distinctly deco object — octagonal stamp, red-orange — that survives at 14px and reads at 44px and breaks open meaningfully at full size on the drill-down. One object, three scales is the family contribution; BROILR inherits it. The chevron band remains in the system as the live-Console secondary form and as the Override Mode border.
The Ticker is the period-correct visual for "stream of events flowing past an operator who reads them." A stream metaphor evokes the modern web; tape evokes the 1925 broker watching prices print. The hybrid form (horizontal live + vertical archive) preserves the tape feel on the live strip but gives the user the affordance they need — filtering, drill-down, scroll-back — on the archive below. Two surfaces, one tape.
The brief proposed an elevator-floor indicator. Built and rejected: a circular dial with a needle implies a setting one might want to turn — but mode isn't a setting; it's detected at launch from the trust-mesh App Group. The transom strip with three lamps (D1) reads correctly as "the room knows which floor you're on," not "adjust the floor". It also sits flat in the cabinet header without eating real estate. Mode III parity is easier to enforce on a strip — same lamp, same engraving, same line height.
What this design intentionally does not try to do, so we can ship CR-3 cleanly.
claude-sonnet-4-6), nothing more.archimedes.llmtech.net.