Protected Control Plane

Relevant source files

The following files were used as context for generating this wiki page:

• plans/noesis-autonomous-compounding-implementation-plan.html
• plans/compounding-partnership-product-loop.html
• plans/noesis-high-leverage-correction-plan.html
• AGENTS.md
• plans/noesis-first-complete-iteration.html
• packages/domain/test/architecture.test.ts

The Protected Control Plane is a critical architectural boundary within Noesis designed to govern the promotion, activation, and management of executable behaviors. It ensures that while the system can autonomously reflect on experience and author candidate improvements, the actual authority to modify the active runtime state remains outside the reach of generated or self-modifiable content. This "protection by construction" approach prevents autonomous agents from silently widening their own permissions or bypassing evaluation gates.

The scope of the control plane includes effect enforcement, principal grants, approval workflows, and the execution of protected rules. It acts as the final gatekeeper for any material changes to the system's active capability revisions, ensuring that every transition is backed by a verifiable AuthorityReceipt and meets predefined risk and safety criteria.

Sources: plans/noesis-high-leverage-correction-plan.html, AGENTS.md:38-40, plans/noesis-first-complete-iteration.html

Architecture and Components

The Protected Control Plane is structured to separate the authorship of new capabilities from their activation. It relies on a deep adapter that captures raw workspace mutation ports and exposes them only through operation-shaped controllers.

Core Components

Component	Description
AuthorityBoundary	The entry point for all protected promotion, rollback, and scheduling transitions.
EffectGateway	Mediates all side effects, ensuring tools and background work fail closed through a single boundary.
Protected Evaluator	Executes held-out test suites and blind judging to validate candidates before activation.
AuthorityReceipt	A closure-private, unforgeable token required for every live protected mutation.

Sources: plans/noesis-high-leverage-correction-plan.html:362-386, plans/noesis-first-complete-iteration.html, AGENTS.md:41-45

System Relationships

The following diagram illustrates the relationship between the learning organs, which propose changes, and the protected control plane, which authorizes them.

The diagram shows that the Learning Organs can only propose changes via a request to the Authority Boundary, which requires verification before any commit to the Workspace Store occurs.
Sources: plans/noesis-autonomous-compounding-implementation-plan.html, plans/noesis-high-leverage-correction-plan.html:370-380

Atomic Activation Process

Activation is the process of promoting a CapabilityRevision to active status. This process is strictly transactional and requires evidence that the candidate has passed protected evaluation.

Activation Lifecycle

1. Materialization: The system materializes the complete, byte-stable snapshot of the candidate revision (prompts, tools, and routing rules).
2. Preflight Validation: The Protected Evaluator runs a held-out protected suite. A regression in this suite acts as a "hard rail" that blocks activation regardless of other qualitative scores.
3. Receipt Issuance: Upon passing evaluation, an AuthorityReceipt is issued for the specific operation, resource, and effect.
4. Transactional Commit: A single SQLite transaction atomically exposes the staged revision set and updates the activation pointer.

Sources: plans/noesis-autonomous-compounding-implementation-plan.html:350-365, plans/noesis-high-leverage-correction-plan.html:420-435, AGENTS.md:50-55

Activation Sequence

Effect Enforcement and Risk Policy

The EffectGateway serves as the enforcement layer for all external interactions. It ensures that every tool call or background job operates within durably reserved grant and cost budgets.

Risk-Based Autonomy

The Control Plane applies different policies based on the perceived risk of the change:

Change Kind	Policy
Narrow Read-only Skill	Auto-activate if preflight passes and risk is low.
New Write/Network Effect	Explicit user approval required.
Credential/Account Access	Explicit user action required.
User Constitution Edit	User-owned confirmation required.
Protected Kernel Mod	Never self-modifiable by generated behavior.

Sources: plans/noesis-autonomous-compounding-implementation-plan.html:460-485, AGENTS.md:46-49

Effect Validation Logic

Before any effect is executed, the EffectGateway performs the following checks:

• Idempotency Binding: Binds the idempotency key to the specific principal, effect class, resource, and request identity.
• Budget Reservation: Reserves the estimated cost in the authoritative operational state.
• Receipt Verification: Ensures the caller holds a valid receipt issued by a protected boundary.

Sources: plans/noesis-high-leverage-correction-plan.html:380-400, plans/noesis-autonomous-compounding-implementation-plan.html:390-400

Implementation Invariants

The Protected Control Plane is governed by strict engineering invariants to prevent boundary erosion.

Structural Protections

• One Authority per Datum: Every persisted piece of data has exactly one declared authority. Derived data must cite an authoritative SQLite row or recorded file revision.
• Import-Only Legacy Support: Legacy JSONL support is restricted to one-time migration. No second operational authority exists around it.
• Closure Privacy: AuthorityReceipt authenticity is kept closure-private; structurally typed receipts are not trusted to verify themselves.
• Architecture Test Enforcement: Automated tests (e.g., packages/domain/test/architecture.test.ts) forbid the UI and other untrusted packages from importing or accessing ledger, raw registry, or protected mutation ports.

Sources: AGENTS.md:21-35, packages/domain/test/architecture.test.ts:165-190, plans/noesis-high-leverage-correction-plan.html:385-395

// Example of Protected Seam narrowing derived from plan requirements
// raw protected workspace ports are captured inside a deep adapter
export interface ProtectedAdapter {
  commitActivation(receipt: AuthorityReceipt, revisionId: string): Promise<void>;
  rollback(receipt: AuthorityReceipt, capabilityId: string): Promise<void>;
  grantPermission(receipt: AuthorityReceipt, grant: Grant): Promise<void>;
}

Note: The snippet above represents the architectural requirement for narrow, operation-shaped controllers.
Sources: plans/noesis-high-leverage-correction-plan.html:370-375

Conclusion

The Protected Control Plane is the cornerstone of safety in Noesis's autonomous compounding loop. By enforcing strict separation between candidate generation and executable promotion, and by requiring unforgeable receipts for every mutation, it ensures the system remains under human-defined rails. This architecture allows Noesis to autonomously improve while guaranteeing that authority expansion, security-critical changes, and fundamental behavioral shifts are always subject to protected oversight and verifiable evidence.