You said the plan was hard to read. This is the same plan told the way you think — what each arc is, why we're doing it this way, and a day with it.
Companion to the builder's plan — every number and file lives there. This page is the same decisions, at reading altitude.
We are rebuilding Digital Empathy as if the company were one agent with three organs:
People are not parts of this agent. We are the ones it works for. You set the ends; it supplies the means; you grade it.
One law runs through all five arcs: the plumbing never thinks. The always-on server holds facts, queues, receipts, and safety switches. Every actual judgment is made by a Claude session on your own subscription seat. That is the cost answer (flat rate, not per-token), the scale answer (add seats, not budget), and the trust answer (a switch in code cannot be talked out of anything).
What it is. Today, when Neo thinks, it is code inside the server making a metered API call. After this arc, when Neo thinks, it is a Claude session on your Mac, on your seat. The server keeps doing what plumbing should do: carry the message, remember the conversation, send the reply, keep the receipts.
Why this way. Your words: "I prefer to use my sub instead of API." And the deeper reason: a mind that lives in a session can read files, use tools, and be corrected by editing a runbook. A mind that lives in a server function can only be changed by a deploy.
A day with it.
What the one shot builds. The queue and its receipts. The little program on your Mac that wakes Claude when there is work (it has its own key, not the borrowed Telegram one). Neo's runbook — who it is, what it may do, what it must never say. The switch that moves your Telegram and morning brief onto this path (off until you flip it). The extraction of everything the Codex thread knew.
What you decide. Whether Neo runs on your seat or a dedicated one. When to flip the switch.
What it is. Neo is present in the channels you name. It can be asked ("@Neo check…") and it can speak unasked — but only with a receipt, only after waiting to see if a human answers first, and only as often as you allow.
Why this way. Your note: "Drive us to the end state. Gates should be ambient reply sensitivity, not whether it happens at all." So there is no waiting period before ambient exists. There is a dial you own:
The dial changes the question Neo is asked. It never filters Neo's answer through a score. That distinction is the whole anti-drift principle: we tell the mind its posture; we don't put a threshold in front of its judgment.
A day with it.
What the one shot builds. The listening path (the server sees channel messages, waits the window, asks Neo the posture question). The speaking path (every safety check re-run at the moment of posting, as the bot, never as you). The proof that it posts as the bot — a live readback and a test that goes red if anyone sabotages it. Neo's tone contract. A registry of every source Neo may cite and how much each can be trusted. And a rehearsal: before anything goes live, the real listening path runs over the last thirty days of your real channels with every reply recorded instead of sent — you get the list of what Neo would have said, and the number of real opportunities per week. If that number is low, we build a daily digest instead of in-thread replies, in the same run.
What you decide. Which channels. The dial. The message to the team before Neo is present (drafted for you). Whether the Slack app gets its proper bot identity (a setting in Slack admin only you can change).
What it is. When the company's eyes see something broken, that knowledge can become work: a typed candidate with its evidence, its size, what authority it needs, and how it would be undone. The fleet builds it and courts it. The receipt comes back as ground truth. Nothing deploys by itself.
Why this way. Today the world model can know a thing is broken and nothing routes that to the machinery that could fix it. The fleet and its courts already exist and are mature; they have zero connection to Neo. This arc connects them — and keeps the authority boundary exactly where it is: the courts verify, Robert taps.
A day with it.
What the one shot builds. The candidate shape (with a real blast-radius read from the code map, not a guess). Neo's third hand — the one that dispatches work to the fleet — with "deploy" hard-wired to never. The door the receipt comes back through. And one complete loop, rehearsed for real on a harmless change, with every hop's receipt on disk.
What you decide. Nothing until the first loop runs; then which class, if any, earns a standing ruling.
What it is. The courts that guard Neo's honesty get repaired and made real.
Why this way. The weekly honesty watchdog has tried to run four times and never could. It demanded a freshly-seeded world, and nobody can seed a world at 9 am on a Monday without being there. Rather than fix the rehearsal, we audit reality: every Monday a session that did not write Neo samples twenty things Neo actually said last week and checks each against the source it cited. That needs one thing that doesn't exist yet — a record of what Neo actually said, kept for thirty days. Today only a fingerprint is kept.
A day with it.
What the one shot builds. The record of what Neo said. The weekly audit. The dead court gets its caller. Honest labels on genome deposits. The two-postures page. A tile on your One-Surface showing when the last audits ran.
What you decide. Confirm the audit-reality approach (it replaces the synthetic traps).
What it is. One place that says where every heritable thing lives — the constitution, your working manual, the skills, the charters, the rulings — whether it is versioned, and who ratifies it. A drill that proves a new machine can grow the company back from it. A draft index of every ruling you have made.
Why this way. The valuation of the whole rebuild is "how much re-grows from the genome alone." Right now we can't measure that. And the home already exists — your ~/.claude is a GitHub repo — it just has 1,315 uncommitted changes in it, including the constitution.
A day with it.
What the one shot builds. The manifest and a census that says, in numbers, what is dirty or missing. The drill, run once for real. The rulings index, marked draft until you ink it.
What you decide. Whether ~/.claude is the home (it is the default). Whether to commit it (yours, not the build's).
A single program runs for eight to ten hours. Grok builds each piece in an isolated room. A different mind judges every piece — Claude for anything touching keys or identity, a second-pedigree model (DeepSeek, Kimi, GLM, or the free preview model you named) for the rest — and on anything load-bearing, two of them. Every judge reads the charter you wrote in July before it reads the code: a rule that constrains what the intelligence may decide is a design event, not a safety improvement. A judge that finds one doesn't get it "fixed"; it lands on a list for you.
Three things happen on real data before anything is declared done: the ambient rehearsal over your real channels, one complete warp loop on a harmless change, and the cold-start drill. At the very end, one more reviewer reads everything that was built and asks a single question — did anyone, anywhere, sneak in a threshold, a score, a filter, or a refusal? — and holds the whole thing if the answer is yes.
What you get: one pull request, a ledger showing who built and who judged each piece, and a short list titled YOUR CALL. Nothing deploys. Nothing posts. The Codex dispatcher keeps running untouched until you and I swap it, step by step, each step with an undo.
#bot-test first; the only cost ceiling is replies per day.~/.claude is the genome home; committing it stays yours.Red pen — on this page or in chat. Then one word: go.