Solar Voice · The Imprimatur — Lock to Production (Go-Live)

Reading the proof — validation lens2 🟦 Graph · real node/edge 🟪 Hybrid · grounded + rendered 🟨 LLM · voice, no fabrication 🟩 Data · own, not inflated ⬜ Fixed · static 🟥 Care · two-tier holds the Desk inherits the Bench's ink key — same house

The Imprimatur — Lock to Production

— "let it be printed"

The act

Granting the imprimatur writes config/live — a runtime-config flip, app-cached (picked up within the cache TTL), no deploy. One live pair at a time; the prior edition is superseded. The decision is an explicit human act — the advisory sim-score never auto-promotes (I8 / I10).1

SELECT THE CANDIDATE · ?uid & id

Nominated proof to send to press — from the Proof Spike (all operators)

Open the Proof Spike →

Reading the cross-operator board…

On the Press

— the nominated proof under final review

Reading the live edition…

Grant the Imprimatur

— to press

EDITOR-IN-CHIEF ONLY

○ Select a candidate to begin

This writes config/live for every reader at the next cache refresh. No deploy. One live pair at a time.

Zero-variation

On grant, the engine chat path and the optimizer both read the new config/live via getLivePrompt() / getLiveCorpus() — byte-identical baseline.5

Git mirror

The locked prompt is mirrored back to prompt.js + voice-feedback.md (a recorded reconcile intent, for version control — cf. web-pilot-reconciliation.md).7

The Go-Live Ledger

— run-of-record · who · when · the sim that justified it

CONFIG/LIVE · AUDIT TRAIL

Reading config/live…

Reading the go-live ledger…

Every row stamps both promptVersionId and corpusVersionId — never a prompt or corpus alone.4 The ledger is append-only; superseded editions are struck, never deleted — the run-of-record stays complete.

Marginal Apparatus · Operational Anchors

1: Imprimatur. Literally "let it be printed" — the editor-in-chief's authority to send an edition to press. Here: the pioneer's lock — a write to config/live { promptVersionId, corpusVersionId, staticBlock, voiceLayer } (a runtime-config flip, app-cached, no deploy). One live pair at a time; supersede-prior; full audit trail. Gated to roleOf(email)==='pioneer' — Antano & Harini only.
2: Validation lens. Each surfaced component is coloured by what proves it true: 🟦 graph (a real node/edge), 🟪 hybrid (grounded + on-voice), 🟨 LLM (rendered language, no fabrication), 🟩 data (the user's own, never inflated), ⬜ fixed (static), 🟥 care (two-tier). The same ink key the Compositor's Bench uses — the Desk reads the proofs in the same colours.
3: The justification on record. Two signals on the same beat-event axes: outcome (the real production / A-B telemetry for the pair — activation as 2nd-day-within-72h, committed, graduation; the lagging ground truth) and mechanism-fidelity (the sim-score — cause-moments present in the transcript, the leading advisory signal, not a metric forecast). Pick on outcome first, then sim. A win must hold graduation and the invariant floor — an activation-only lift that degrades graduation is a reject.
4: The coupling. Prompt × corpus are not independent — the prompt's Block-3 template (ground(retrieval) in prompt.js) formats whatever the corpus retrieval exposes. So what goes live is a pinned (prompt × corpus) pair; every iteration / edition stamps both promptVersionId and corpusVersionId. The lock is compatibility-guarded: permitted only if the prompt's required corpus fields ⊆ the corpus version's retrievalInterface — e.g. a prompt that reads meta_scope_shift cannot be locked against a corpus that doesn't expose it.
5: Zero-variation. The optimizer must be behaviour-identical to the shipped engine — one code path (P.buildPayload, neo.retrieve), reused, never re-implemented. Both the chat path and the simulator read config/live via getLivePrompt() / getLiveCorpus() as the locked baseline, so anything tuned on the Bench is byte-identical to what ships. If they could diverge, the simulator would be a toy.
6: The invariant floor. The one thing plumbed — a flag, not a ranker. The sim-score's invariant sub-layer (care I15 · honesty / no-inflation I17 · no-gate I9 · no-fabrication I7 · ≤55 words) hard-flags a candidate ineligible, a release-blocker, regardless of judgment — and the lock button stays disabled while it trips. The advisory overall score never auto-ranks or auto-promotes (I8 / I10); humans pick, the score is a lens.
7: The git mirror. On grant, the locked prompt is recorded as a reconcile intent for the engine source — prompt.js (the static + voice blocks) and voice-feedback.md (the accumulated voice-layer corrections) — so version control and the reconcile pass (web-pilot-reconciliation.md) always match what's live. The runtime flip is instant; the mirror is the durable record (reconciled manually).