Gates that refuse
People ask me how the tower stays up. Not which software it uses — that part is scenery. How it holds. The honest answer fits in one sentence: the tower is not reliable because its agents are smart. It is reliable because its gates know how to say no.
Here is the plan. I gave myself one rule while drawing it: a six-year-old must be able to follow it with a finger. Every shape carries its name in plain words, every arrow says what goes through. If a plan needs a dictionary, the plan has failed.
A name = a job written on the door
Every agent in the tower has a name, and the name predicts the role. Clark builds. Lois rereads. Jimmy brings the proof. The one watching everything from the top is not called "supervisor-service-v2": it is an eye, and everyone in the house knows what an eye does — and above all what it does not do. A name that predicts the role is already a security rule: when someone does something their name does not announce, it shows.
Gates that refuse
Between two floors there is always a gate, and behind the gate, a guard. Work never climbs on its own: it climbs with its proof. The test that passes, the reread that happened, the written trace. Without proof, the guard says no and the work goes back down. That is the green path and the red bounce on the drawing.
I learned this the real way. One gate of the tower stayed closed for seven days straight. Seven days during which a whole circuit waited. Following the trail, we found a guard in duplicate — two nearly identical names, one of which nobody had ever seen work. Here is the point that matters: a closed gate shows — it ends up noticed, questioned, repaired. A hole in the fence never shows. Of the two possible failures, the closed gate is the good failure.
The eye touches nothing
The one who watches does not repair. It feels wrong at first — it sees the problem, it is right there, why not let it fix things? Because a watcher who repairs becomes judge and party: its own mistakes are exactly the ones it will not report. The eye watches, the eye warns, and the repair work goes back down through the gate, with its proof, like everyone else.
The stop button is planted outside
A system that manages its own security will, sooner or later, modify the very settings that allow it to be stopped. Not out of malice — out of zeal. So the stop button is not in the tower: it is planted outside, in the ground. The tower can be switched off even on the day the tower is sick, confused, or very sure of itself.
The bell too
Same reasoning for the alert: a bell hung inside the tower needs the tower to be healthy in order to ring. So it is silent exactly on the day you need it. The tower's bell is outside, on its own post: if the tower burns, the bell still rings.
The safe, and the key that is not in it
In the basement, the safe of secrets. The key to the safe is not in the tower. Simple consequence, one a child understands: stealing the safe gives nothing. You would have to rob two houses at once, and every opening of the safe leaves a trace.
What the plan does not show — on purpose
This plan shows ideas: gates, proofs, an eye, a bell. It shows neither versions, nor paths, nor settings. A public plan shows how the house thinks, never where the lock is. Ideas are for sharing; the attack surface is not.
If you keep only one thing: when you build a system of agents, do not count their successes. Count the refusals of your gates. The day that number drops to zero, it does not mean everything is fine — it means nothing is guarding anything anymore.