usage-bands since 8.4.14
Operator-visible
- C0 Observe
- C1 Advise · Assist
- C2 Steer · Act
- C3 Hold
Six bands on one runtime. Not six SKUs. Not a vendor gallery.
Cognitive OS / governed agent control plane
Models advise. Gates decide.
TUCE is the control tower for coordinated intelligence. Multi-model routing treats API and open-source models as traffic. Truth-layer consensus is how they agree. Origin isolation is the airspace law. Fail-closed promotion is the only runway that ships. A hybrid kernel — transformers reason, classical reliability refuses — then commands origin-isolated partners without merging them.
TUCE is intelligence infrastructure with a will: routing, truth-layer consensus, origin-isolated multi-tenancy, and fail-closed promotion. It is not a merged database of every app, not a chatbot, not a framework gallery. Each partner keeps its origin, data, and checkout.
TUCE sits above the developer’s graphs and below the enterprise security boundary. Framework-agnostic. Models advise. Deterministic gates decide.
Kernel 8.4.9 stores the shape of the holes. CHECK before answer. FLAG refuse. Veloce hops. Flywheel relearns after a recorded handshake. Promotion still holds. Kernel 8.4.9 is a console tab, not a marketing product line. Website 8.4.19 is prism-live — official TUCE AI™ mark at retina on chrome. Waves 2–5 remain: cheap path when it meets, command not merge, no actuation, C4 cannot self-promote.
Where it sits
Above the graph. Below the boundary.
TUCE sits above the developer’s graphs and below the enterprise security boundary. Framework-agnostic. Models advise. Deterministic gates decide.
Framework-agnostic
LangGraph, CrewAI, and the rest can sit underneath. TUCE does not replace your graph. It governs what that graph is allowed to promote.
Dual-authority
Privileged acts require dual authority: the human or session principal and the agent identity must independently authorize. Missing either fails closed. The intersection of permissions is what actually fires.
The scarce value is not that it can run an agent. It is that policy, identity, promotion, and the digital thread can become the system of record for autonomous work. Residue is the switching cost. Architected for that; not claimed as fleet-scale SoR today.
Infrastructure, not a wrapper
Routing. Consensus. Isolation.
TUCE is the control tower. Models are traffic. Routing is the lattice. Consensus is the truth layer. Isolation is the airspace. Promotion is the only runway. Fifteen origin-isolated partners are destinations on that map — not the tower itself.
Multi-model routing
API and open-source models are traffic. Cheap path first. Compound when residual risk demands. Play it as Route Lattice — the Living LLM Mesh, TUCE-named.
Play itTruth-layer consensus
Models advise. They do not get to declare Done. Overlap, conflict, SAT, isolation. Play it as Truth Gate.
Play itOrigin-isolated multi-tenancy
Each partner is its own airspace. Canaries do not cross. Isolation Score is a local canary, not an air gap. Mesh Fabric is the lattice.
Play itSTRIDE and Statement of Applicability are engines on this origin — Threat Weave and Applicability Map. They are aligning work, not ISO or SOC 2 certificates. Cost × latency Pareto is Efficiency Front. None of these are visitor-count proofs.
Isolation Score is a local canary test between origin boxes — not an air-gapped gateway and not a SNARK. Origin isolation is the law; the tool is the analogue you can play.
Live path
TUCE → VEMO publish gate
Intent is stated on this floor. The refuse-and-publish gate lives on VEMO. Status writes back. That is the seamless-integrate proof — one named path, not a slogan. Authors never grade themselves on EngOS.
90-second operator voiceover · transcript
TUCE is the control tower for coordinated intelligence. Multi-model routing treats API and open-source models as traffic. Truth-layer consensus is how they agree. Origin isolation is the airspace law. Fail-closed promotion is the only runway that ships. Models advise. Gates decide. Fifteen origin-isolated partners hang off that tower — VEMO for marketing, EngOS for certified desks, Flywheel for relearn, MSP, Florida property, FieldQuote for trades, Remin Care for wholesale body care, and the rest — each on its own origin. Intent hits a gate. The owning partner executes. Writeback returns. Nothing silently merges.
Interactive analogue
Watch a promotion hold.
Job: publish a campaign. Models already advised. Gates have not. This is an analogue — VEMO remains the live refuse-and-publish origin.
01 Route
Passed · cheap path
02 Perceive
Passed · blind spots named
03 Steer
Held · drift vs golden
04 Judge
Waiting on you
Pass policy and the examiner, then Promote. Promote early and the hold fires. Refuse is first-class.
Waiting. Models have advised.
Wave 4 · probe only
Spatial pilot. Restore drills. Read-only twins. No actuation.
Immersive-vr probe only. iOS Safari has no reliable session — the 2D lattice is the experience. Dry-run restore stores a checksum. Twin writes refuse. F26–F32, F36, F47 will not fire.
Spatial
XR hop held. No Vision Pro badge. GIS not copied.
Restore drill
Production keys unchanged. Ticket close is not evidence.
Read-only twins
Hashes, not records. Twin ≠ live origin.
Wave 5 · then PEFT
Verified playbooks, then authorized PEFT. C4 Recur cannot self-promote.
01
Verify playbook
Author ≠ approver. Evidence digest + regression suite.
02
Record handshake
A handshake id that was never recorded is not a handshake.
03
Adapter supply check
Signed, checksummed, eval-gated, canary/shadow/live.
04
Authorized PEFT
Weights after handshake. Never silent merge.
05
C4 cannot self-promote
Research lock. Promote remains F08 after Hold.
F08 · the only runway that ships
Promote is not a Sage band. It is a digest-bound decision after Hold.
Weighted CEI cannot hide a failed noncompensable gate. Author ≠ approver. Stale digests refuse. Public analogue ≠ private examiner. Kernel 8.4.9. Website 8.4.19.
01
Hold sat
Humans sit Steer and Hold. skipHitl cannot open Hold.
02
Author ≠ approver
The person who wrote the change does not stamp it.
03
Digests bound
Code, dataset, policy, evidence — each ≥ 8 chars. Bundle is FNV of the four.
04
Noncompensable gates
M17 committed = 0. Isolation ok. Eval clean. Not stale (M19).
05
PromotionDecision
schema tuce.promotion/v1. Advisory promotionOk is always false.
Never: same person in both seats. Never: PTG2 as a ship stamp. Never: Hold labelled Promote. Never: skipHitl on email, pay, deploy, delete, or sage_gate.
One enum · three vocabularies
Hold can fire at any C-band. Promote is F08 after Hold.
Do not use C-band and verdict as synonyms. Humans sit Steer and Hold. Recur writes the lesson after the hold, not instead of it. C4 is not in the enum.
verbs, not verdicts
Manual F21
- C0 observes
- C1 drafts
- C2 stages for confirmation
- C3 acts only inside a bounded envelope
Hold can fire at any C-band. Recur writes the lesson after the hold, not instead of it.
per-invoke verdict
decideHitl
- auto
- interrupt
- refuse
Verdict is not a renaming of C-band. skipHitl cannot open Hold.
Sage C0–C3 · six bands
Humans sit Steer and Hold. Not every hop.
Six bands on Sage C0–C3. They are not six SKUs and not a vendor gallery. HITL that queues every gated hop is a design failure. Models advise. Gates decide. Humans sit Steer and Hold. Promote is F08, not a Sage band. Manual F21: C0 observes / C1 drafts / C2 stages / C3 acts only inside a bounded envelope. decideHitl verdicts are auto|interrupt|refuse — not a renaming of C-bands.
Four planes
Control. Data-Render. Execution. Proof.
Hybrid kernel: transformers reason; a classical reliability layer isolates, executes, and refuses. MATLAB-era numerical, control, and simulation stay deterministic and are called as tools.
Nine-station cognitive loop
Promotion is a gate.
Hard promotion hold is the default. Refuse is first-class. A completion verifier rejects bare “Done.” Press a station.
Station
Routing
Pick the path. Cheap first. Compound when residual risk demands.
API and open-source models are traffic. Framework-agnostic: your graph can sit underneath. TUCE governs which lane is allowed to run — not which library you wrote the graph in.
Play Route LatticeOperator surfaces
Five surfaces of one runtime. Not five products.
Cognition floor
Six operational menus. Not dashboards.
The menus are the operator UI over the fail-closed control plane. Perceive → Dispatch → Seat → Steer → Judge → Learn. Press a verb.
Perceive
Forethought
Perception before commitment. Blind spots named.
Pre-flight sandboxes. Simulated tool calls. No real network write until perception is scored. Degree before expensive compound.
Play Blast RadiusPrivate examiner
The suite is the definition of correct.
The private examiner captures a trajectory as an incident. The suite becomes the definition of correct. Models can swap. External scores never promote.
The floor explains itself: inline help, journeys, protocol. Operators are not dropped into a mute board.
Why you stay
Residue is the switching cost.
Seven gravity categories are reasons to live here daily — not seven products. Open one.
What TUCE is not
Say these. Do not hedge them away.
How work moves
Two layers. One runtime.
The kernel loop decides. The partner hop executes. Intent → gate → partner → writeback sits under promotion physics — not instead of it.
Kernel loop — open a station
Partner hop — open a station
Isolated origins. Shared command. No silent data merge. PHI, raw trading advice, tenant records, and wholesale orders stay on the partner that owns them.
The floor
Named modules. The rest lives in the console.
Each card is a door. Partner photography lives on the ecosystem page. Hormone atmosphere is an operator analogue, not a medical device.
UAOP neural floor
HAVEThe live command surface. Sixteen-lobe atmosphere, routing beams, hormone-state analogue — not a medical device. Protocol UAOP 8.4.6.
OpenMulti-model routing
HAVEAPI and open-source models as traffic. Cheap path first. Play Route Lattice — the Living LLM Mesh, TUCE-named.
OpenTruth Gates
HAVEClaim ↔ evidence. External scores never promote. Highest-leverage home with Agent OS and the tools bus.
OpenOrigin isolation
HAVEIsolation Score is a local canary between origin boxes. Checkout stays on the product. TUCE does not merge the family.
OpenPrivate examiner
HAVEIncident captures a trajectory. The suite is the definition of correct. Models can swap.
OpenDream builder
HAVEBlank-slate dual-cone builder path. A TUCE module of one runtime — not a second product, not a tracker.
OpenFlywheel relearn
PARTNERNeuromorphic maps write improved routes back to the floor. Afterthought handshake.
Open originVEMO refuse-and-publish
PARTNERThe marketing partner will refuse a bad send. Chat cannot self-approve.
Open originEngOS certified desks
PARTNERAuthors never grade themselves. The swarm seats the desk.
Open originInstall
Add to Home Screen. Not a store listing.
HAVEThe mobile install is Add to Home Screen from console.tuce.app. TUCE is not an App Store or Play Store consumer listing. Partner origins may list later, on their own checkout. This page does not sell a headset, a calorie app, or a wrapped website.
HAVE. This is the install. Never an iOS consumer SKU. Chromium can prompt; iOS is Share → Add to Home Screen. Metrics on this page are this browser, not a conversion rate we invented.
This browser
- display-mode
- browser
- beforeinstallprompt
- not fired
- appinstalled
- no
- path
- idle
Trackable funnel: eligible (beforeinstallprompt) → prompt shown → accepted/dismissed (userChoice) → appinstalled → standalone display-mode. iOS cannot fill the first three. We do not print a sitewide install rate we did not measure.
Action
Not yet eligible in this browser. Chromium waits for an engagement window. iOS is always manual.
Questions
Straight answers.
The control tower for coordinated intelligence. Multi-model routing, truth-layer consensus, origin-isolated multi-tenancy, and fail-closed promotion. A hybrid kernel commands origin-isolated partners. The OS is the definition. The family is the upsell.