product · 01 · the division
Division.
Q itself. The execution plane, the ledger and the approvals inbox. The part of the structure that builds, tests and signs off the equipment, and does not go on the mission.
The division is Q itself.
Three things, and only three. The execution plane runs the work: a run starts, retrieves evidence, waits for a person where it must, and ends with a receipt. The ledger records what every run did, decided and cost. The approvals inbox is where a person decides.
Everything else in the structure sits on these three. A department holds authority. A role does the work. A system is what a department is equipped with. None of them exists without the division beneath.
- execution plane
- runs on Temporal · pauses for a person · ends with a receipt
- ledger
- the journal and the spend record today · one ledger across systems in design
- approvals inbox
- bound to tenant, principal, run and action version
It equips the departments.
The division does not go on the mission. It builds the instrument a role will use, tests it against the contract, signs it off with its limits written on the tag, and issues it to a department. What comes back from the field is the receipt.
That is the whole relationship. Departments and roles carry authority and do work. The division makes sure every piece of equipment they carry was tested, is accountable, and says what it cannot do.
- builds
- runs, approvals, spend, journal
- tests
- contracts with their limits stated
- signs off
- the registry says stable, beta or alpha
- issues
- to a department, for a role
03 · the sign-off
A piece of equipment, from the bench to the field.
assembled
Built on the bench.
The boards seated, the keys in place, the cover off. Nothing leaves the bench until it is whole.
What exists today, and what is next.
Today the division runs durable work, holds every approval as a record, reserves spend before a model is called, and keeps a journal a run can be replayed from. These are in the running system and its contracts.
Next is the one ledger across systems, so a run's effect in Route Royal, its charge in Vellon and the identity that acted are read on one page. Standing mandates and qualification by replay follow it. None of these is claimed until it is in the registry.
- today
- runs · approvals · spend · journal
- in design
- one ledger across systems
- after that
- mandates · replay
The division, in figures.
- workflows
- Temporal
- runs survive restarts and resume where they stopped
- approval
- bound to 4 things
- tenant · principal · run · immutable action version
- consumption
- one dispatch
- not exactly-once; delivery is at least once
- spend
- reserved, then settled
- reconciled against provider records; load qualification pending
- isolation
- row-level, PostgreSQL
- a request without tenant context sees no rows
- registry
- 8 stable · 35 beta · 15 alpha
- as recorded on 12 october 2026 · the registry is the authority
- production gates
- 0 of 7 passed
- stated here until that changes
figures from the running system and its registry · updated when they change