Orchestrates
Defines the mission lifecycle: dispatch, execution, verification, review, completion. Every transition runs through an explicit state machine with pure, testable guards.
Project
GOD MODE Control Plane
Durable orchestration for long-running autonomous engineering missions, with machine-checked evidence and human control at risk boundaries.
Problem
Long missions need more than a prompt.
- Kind
- Control plane for autonomous missions
- Scope
- State, evidence, review, authorization
- Record
- Architecture here; operations private
An autonomous engineering mission that runs for hours must survive crashes, leave a machine-checkable record of what actually happened, and never exceed its granted authority. GMCP turns those requirements into enforced structure rather than good intentions.
Positioning
A control plane, not another coding agent.
Does not write the code
Engineering work is performed by an executor agent operating inside the plane. GMCP governs the process around that work; it does not compete with coding agents.
Enforces the loop
Workspace leases, verification contracts, evidence requirements, and authorization gates are enforced mechanically, not by policy text alone.
Execution model
The executor works inside a bounded loop.
01
Dispatch
A coding agent (the executor, running in an agent runtime such as opencode) receives a mission with a bounded objective, hard boundaries, and explicit verification instructions.
02
Execute
Work happens in an isolated workspace on an assigned branch. Each logical unit ends in a local commit; the shared main branch stays untouched.
03
Verify
Declared checks run against the workspace with bounded timeouts. A mission reaches VERIFIED only when every check passes.
04
Review
A read-only reviewer independently inspects the work and its evidence before completion is accepted.
Design
Durable state, machine evidence, bounded risk.
Durable mission state
Missions are recorded as versioned, JSON-encoded state on local disk. One active writer per mission, protected by a cooperative lease, with an append-only audit trail.
Machine evidence authority
Verification is mechanical: checks resolve against the mission workspace, and evidence such as ledgers and hashes is mandatory. Missing or malformed evidence fails the mission closed.
Read-only reviewer
The reviewer inspects work and evidence without any write authority over mission state. It can accept or reject; it cannot steer the outcome.
Bounded remediation
Failure handling is capped: retries are bounded and remediation cannot loop indefinitely. Unresolved states surface to a human instead of running again.
Risk boundary
RED actions require a human, once.
RED human authorization
The highest-risk class of actions is denied autonomously and dispatched only with explicit human approval. Push, deployment, and credential handling are never automatic.
Single-use, exactly bound
An approval is one-shot and binds to a canonical digest of the exact request. It cannot be silently reused for anything else.
At-most-once dispatch
An approved RED action is dispatched automatically at most once. A durable execution claim is created before any side effect and resolved only from a confirmed outcome.
Crash model
Indeterminate is not success.
Recovery by reconcile
After a crash, mission state is recovered by deterministic reconciliation, not by guessing. Stale claims can be reclaimed; unresolved execution cannot be silently redone.
Fail closed
If an approved action may or may not have run, the gate is treated as indeterminate and stays closed until a human confirms what actually happened.
No false exactly-once
Exactly-once semantics are not claimed. The plane guarantees at-most-once dispatch plus durable reconciliation when execution becomes indeterminate.
Threat model
A cooperative Level 6 boundary, honestly stated.
GMCP enforces cooperative rules: workspace writer leases, durable artifact ownership, and pre-write authorization for compliant workflows. These rules protect missions that operate through the plane. They are not operating-system file locks, and GMCP cannot stop an arbitrary unrelated process with ordinary filesystem permissions from editing a file directly. The threat model is cooperative by design, and it is documented that way rather than oversold.
- Workspace lease: one active writable mission per workspace; a second concurrent writer is refused.
- Artifact ownership: a mission's artifacts belong to it; cross-mission overwrites are refused.
- Pre-write authorization: compliant writes are authorized before they happen, then finalized only after success.
- Fail-closed verification: missing, malformed, or truncated evidence fails the mission, never passes it.
Public record
What is published and what is not.
This page describes GMCP at a public-safe architectural level. The site source, build pipeline, and this documentation are public in the source repository at github.com/EncGur/encryptedguru-site. Operational runbooks, credentials, internal topology, and recovery details are not part of the public repository.