The deliverable is the curve, not the artifacts.

The three inputs along the top are outside the loop — nothing inside it can change them, which is the whole answer to “who expands the number of workers?”: nobody in here can. The allocator only distributes seats the operator has already granted.

The agent has no Bash, no git and no network — so it cannot reach a branch, cannot write the ledger, and cannot run its own acceptance test. Every gate below runs outside the turn, which is the only way “done” means anything.

Fungible seats fail specifically: with demand reading implement, the planner never runs and the queue starves; the other way, the backlog inflates and nothing gets built. The ratio between plan and implement is the producer/consumer ratio — expressed as headcount rather than as hope.

Dependency edges run left to right: a bead sits one column past its deepest dependency. Dashed grey edges are parent links. Blocked-ness is derived, never stored — close a dependency and its dependents become schedulable with no edit to them. Click any bead. Findings and dead ends that nothing links to are memory rather than structure — they are listed under what the loop remembers instead of padding out the first column.

Beads are grouped into lanes by the epic they hang off. That is the closest thing here to a phase: one lane is the loop machinery, the other is the thing it is being pointed at, and work under a closed epic is finished scaffolding rather than current business. Showing every done bead makes the first column three hundred rows tall, which is a picture of the archive and not of the work.

A ready bead with eight dependents is worth more than a ready leaf of the same priority, and a flat list cannot express the difference.

An ask carries no dependencies, nothing waits on it, and its kind is permanently unschedulable, so the fleet cannot pick one up and answer it by guessing. The turn that asked ended immediately and will never see the reply; the answer lands as a decision that a later turn inherits as memory. That indirection is what makes asking safe. Each one must say what to do, what to watch for, and what changes on each answer — the validator refuses an ask that cannot.

Signing in uses the shared ATProto OAuth worker, and an answer is written as a com.minomobi.loop.answer record in your own repo — not ours. We store nothing, you can delete it, and anyone can verify who said it. An unsigned box on a public page is a box anyone can fill with anything, which is worth less than no box at all when the thing being collected is taste.

What the consent screen will ask for. This site requests a narrow scope — atproto plus write access to com.minomobi.loop.answer and nothing else — so Bluesky shows you one collection rather than the seventy-collection union every mino.mobi site shares. That collection is now in the auth worker's metadata ceiling (mino-auth, deployed 2026-08-05, version c88fafac), which is what makes the narrow request grantable at all: an authorization server only issues what the client metadata declares.

If the ceiling and this page ever fall out of step again — they deploy from different branches — sign-in falls back to the broad union rather than failing. A longer consent screen is a worse experience than a short one; an identity you cannot obtain is worse than both.

A worker that hits a judgement call makes it, records what it chose and what would reverse it, and carries on — it cannot park a turn waiting for a person. Human review happens here instead, at a coarser grain than the turn, over what was decided rather than in front of it. Decisions tagged answer came from the operator via an ask above, and they are the only entries here the loop could not have produced by itself.