Everyday: War Room deliberation
IRIN is structured multi-model deliberation on macOS and Ubuntu. War Room is the product face. Direct provider transport is the default; Gateway is explicit per-seat opt-in.
Discover transports
Open Discover in War Room. It reports which provider paths are detected — API-key variable names only (never values), local CLI binaries, local model runtimes — with no billable inference call. A detected CLI is not proof its login is still valid.
Convene a cabinet
Pick a cabinet whose required transports match what Discover found. Seats stream arguments across rounds; you can intervene; factual claims can be checked; a chair ruling is filed. Sessions run on the operator's clock.
Direct by default
Council calls the provider API or authenticated local CLI itself. Select Governed via Gateway for a seat (or set COUNCIL_VIA_GATEWAY=1) only when you want metering, budget limits, and a signed audit-ledger record for that call. Gateway never silently substitutes a provider.
No Outbox from ordinary deliberation
An ordinary War Room / Council run does not create a signed Outbox directive. Nothing executes without you — IRIN does not ship an autonomous operator-ready Worker.
Separate lane: Sentinel → signed Outbox
This lane is disarmed by default. Loading a Sentinel is not arming. Product guidance ends at a signed directive.
Sentinel fires
A deterministic watcher (file inbox, ledger delta, queue depth, anomaly, silence, health, and more) crosses its threshold. No LLM in the observe/interesting decision. Fire decision stays inside a ~100 ms envelope. The fire is written to the per-tenant watch_fires table, which is hash-chained so tampering with prior rows becomes detectable. The event becomes an Escalation carrying evidence only.
Producer promotes (armed only)
The hardware ceremony arms the Gateway Watch producer — not the Sentinel itself. Enabling a Sentinel, enabling the dispatcher, and completing the producer arm ceremony are distinct controls. A boot env path can start watchers but cannot claim, spend, or sign a new directive without a hardware-attested arm.
Gateway routes triage
Subject to policy and budget, Gateway routes the escalation for Council triage. Gateway meters, guards, and signs on this path. It never supplies semantic judgment. Closed-loop triage is bounded at ≤120 s by default.
Council deliberates
Council produces a bounded Directive naming job, scope, stop condition, and return expectation. Council speaks; it does not act and does not hold keys.
Gateway signs into outbox
Gateway canonicalizes the Directive with RFC 8785 JCS, signs the canonical bytes with its Ed25519 key, and appends the canonical JSON plus signature to directive_outbox. The hash chain lives on watch_fires; each outbox row is individually signed; the governed audit ledger is a separate signed surface. Not every action is recorded or executed.
The surfaces
Strict separation. Watch is cheap. Thought is rare. The signed record is the endpoint.
Council · War Room
DELIBERATIONSpeaks, never acts. Parallel seats, precedent, convergence, evidence checks. Interactive sessions on operator clock. Direct transport default.
Gateway
OPT-IN · METER · SIGNExplicit per-seat governance for supported routes. Hosts the watch plane. Ed25519 + JCS over directives before the outbox write. Budget gates and structural guards on governed paths.
Sentinel · Watch · Outbox
OFF BY DEFAULTDeterministic observation; producer arm is a hardware ceremony. Product path ends at a signed Outbox row. No autonomous operator-ready Worker; no tenant librarian as a current product primitive.
The three proof tiers
Confirm the signed-directive path with zero keys. Confirm deliberation with live models. Cross into real observation-to-directive only after ceremony.
No-key signed-directive proof
Run make verify at the IRIN repo root. Isolated compose; zero provider keys; no hardware arm. Seeds a row in watch_fires, routes through a local no-spend Council stub, signs with Ed25519 over JCS, writes to directive_outbox. Tear down with make verify-down.
Live deliberation
Run make warroom (macOS/Ubuntu browser path). Needs a usable provider transport for real deliberation. Open War Room, select cabinet, Convene. Sessions can be paused; synthesis inspected in History. Does not require WATCH_PRODUCER_ENABLED and does not create a signed Outbox directive by itself.
Armed Watch producer
Only after the arming ceremony. Real sentinel fires can be promoted toward live Council triage and a signed outbox row. The interactive path is a hardware ceremony (Secure Enclave / FIDO2); a boot env path is an audited config flip that can start watchers but cannot claim, spend, or sign a new directive without a hardware-attested arm. Producer and dispatcher are off by default.
The ≤120 s budget is the closed-loop triage envelope only. War Room and bare CLI sessions are operator-timed.