How we hold ourselves to it
We run the company on the same machinery we sell.
oddly is largely built by governed agents. Hundreds of merged changes a month, and not one reaches production without the same gates we sell. Every change an agent proposes resolves to a disposition, and every determination leaves a record you can replay. This page states that discipline plainly, and links the live surfaces that carry the receipts.
Every change resolves to a disposition
Receipt: the audit trail →Deny, escalate, and auto-execute are named stages in our executor, not a diagram of intent. The deny path is a hard refusal rather than a hold: an agent capped at reversible changes that emits an irreversible one is a policy violation, and the layer refuses it before the approver is ever consulted.
The whole loop fails closed. An authorizer that cannot establish authority does not execute, it escalates. Too few samples, an unreadable evidence class, an unconfigured policy: every uncertain path lands on escalate to a human, never on execute. Denied by default is the resting state, not the exception.
The record is the hard part
Receipt: the estate map →Naming a human gate is easy. The record is the hard part: a deadline, a decision format, an approval bound to the exact bytes it approved, and a trail you can replay. Consent attaches to content, never to a change number, so new bytes need new authority. An approval on an older version does not carry to the next one.
That record was the first thing we built, because without it a human gate is the appearance of oversight without the substance of it. Every live change and every merge reports up to a person who approves, and each carries its own receipt you can open.
Gates a machine may never release
Receipt: the build log →Some classes of change can never be released by a machine, and the rule that names them is code, not a policy note: the same function decides in the pipeline and in the merge gate. A change to access control, to the machinery that governs the agents themselves, to a data path that touches a paying brand, or to money movement is held for a person by construction.
What is withheld is published too, not only what is granted. A permissions list shows what was given. Our register also shows what was refused, and one grant is marked permanently ungrantable: no agreement rate can ever earn it, because a hold ends when a person ends it.
What we will not claim
- No certification. oddly is not certified against any standard, meets no supervisory expectation, and there is no auditor who will ask us for an attestation. We do not imply one exists.
- No regulator relationship. oddly is not supervised by any authority, is in scope of none, and has no relationship with any framework's authors. Where a public body has described the shape of a runtime governance layer, our claim is only that we built that shape first, for our own use.
- No borrowed words for what we have. Our operational record is attributed and complete, and we call it that. We do not dress it in stronger language than the bytes support.
- No number we cannot show. If we cannot show the working, we do not print the figure. The store-level results live on the proof page, computed, never asserted.
The store-level receipts live on the proof page.
This page is how we govern the agents that build oddly. oddly also runs its own stores on its own product, and that ledger is public: plays executed, whether the value covered the subscription, and the guarantees as measured counts.
Hand an agent real authority. Keep the receipt.
The uncomfortable question is not whether you need a runtime authority layer. It is whether you can prove what your agents did last Tuesday. See how oddly would read your own store, read-only until you decide otherwise.
Start watching, freeFree forever to watch. No card. Read-only until you decide otherwise.
Every determination named here leaves a record you can replay. We publish what our agents are permitted to decide, on what evidence, who granted it, and what takes it back.