ARCHITECTURE BLUEPRINT ¡ END-TO-END FLOW
How a trusted plan gets built
The model proposes once — then code and an adversary dispose. Every number is cited to a real source, machine-checked, adversarially reviewed, or honestly abstained. Nothing ships unverified.
LEGEND
a step in the pipeline
a trust gate (verification)
file.ts a real file in the repo
REFUSES blocks the plan if unmet
The Truth Layer
— the inputs every prescription must trace back to ¡ how knowledge is retrieved
🧍
intake.yaml
Who the athlete is. Training maxes, injuries, weekly floors, schedule anchors, time caps.
people/<name>/intake.yaml
↳ every load the plan leans on resolves back to a number here.
📚
corpus/*.md
The cited knowledge base. One claim per bullet, each tagged [id][authority][source]. StrongFirst ¡ Bryan Johnson ¡ Jack Daniels.
corpus/<authority>/*.md ¡ corpus/INDEX.md
↳ the retrieval substrate — the only knowledge the model may cite.
🛂
authority.registry.yaml
Who is allowed to back a claim. Active vs. stub authorities, each with a cite-prefix (SF, BJ, JD…).
authority.registry.yaml
↳ only status: active authorities may be cited. Adding a coach = 1 entry + 1 corpus file.
📝
feedback.yaml
What actually happened. Logged sessions and how they felt — returns from the daily loop & app sync.
people/<name>/feedback.yaml
↳ closes the loop — feeds the next block. (see the living loop below)
assembled into one prompt ↘
The Ritual
bun run coach block
— lint → generate → verify → verify → ship ¡ read left-to-right
01
Corpus Lint
Before anything runs: prove the knowledge base is sound.
src/verify-corpus.ts
✓ every bullet well-formed
✓ ids unique
✓ authority is active
✓ source pointer present
02
Generate
ONE LLM call. Prompt = intake + feedback + registry + all corpus bullets + a precomputed training-max table. The model writes program.json.
src/generate.ts ¡ claude -p
• loads precomputed → can't invent numbers
• must cite every line
• 3 retries · parse-or-fail · 20-min timeout + heartbeat
the model proposes — it never gets the last word.
03
L1 ¡ Deterministic Gate
~47 CHECKS
Rules in code, not prompt-hope. Each prescription is re-derived and re-checked:
STRUCT schema valid · 4 wks × 7 days · recovery day · unique ids
CITE every line cited ¡ resolves ¡ authority active ¡ no fabricated coach names ¡ {NEEDS_*} only in deferred[]
GUARD weekly floors met (strength / Z2 / Z5 / mobility) ¡ ledger honest
LOAD load_kg = round2.5(TM × %) · no 1RM-test ask
INJ forbidden lifts never prescribed (compiled from injuries)
TIME each session fits the time cap ¡ schedule anchors honored
src/verify-L1.ts
REFUSES one FAIL → the block cannot render.
04
L2 ¡ Adversarial Gate
≥2 ROUNDS
Two fresh Claude calls argue over the plan:
🕵️ Auditor
sees only the artifacts. Files objections — evidence must be a real bullet / rule / intake path, or it's downgraded.
🛡️ Defender
concedes → revises program → re-runs L1, or rebuts with a citation.
src/verify-L2.runner.ts
verdict → CONVERGED · IMPASSE · ESCALATE
06
Ship Gate + Render
The do-today plan is written only if:
✓ L1 = 0 failures
✓ L2 = CONVERGED
Views render deterministically from program.json — they can't drift from the verified plan.
src/render-views.ts
REFUSES else no user plan is produced at all.
🎉 Verified Block
user-view.md
do-today plan: loads in kg, effort (RIR) cues, what to log.
expert-view.md
the why: trust table, how each weight was derived, honest abstentions.
only on IMPASSE / safety ESCALATE ↓
05
L3 ¡ Human Adjudication
The backstop. When the two AIs can't converge, a human writes a reasoned adjudication that can override — shipping as CONVERGED (L3-adjudicated). Never an automatic pass.
bun run coach review ¡ reviews/<date>-L3-review.md
then you live with the plan ↓
The Living Loop
— the plan changes only through the same gates it shipped under
💬 Daily Chat
Talk to the coach in the Claude desktop app.
/today /debrief /log /sync /block
↳ any request to change the plan is routed to the adjust gate — chat can't edit the plan directly.
⚙️ The Adjust Gate
THE ONLY WAY THE PLAN CHANGES
Bounded mutation: stage a copy → apply one patch → re-run L1 → promote or discard. Every change is logged.
ALLOWED PATCHES
swap days ¡ scale session ¡ substitute exercise ¡ move session ¡ skip session
FORBIDDEN
TM changes ¡ floor changes ¡ intake / corpus edits ¡ moving a schedule anchor
src/adjust.ts ¡ runs/<id>/adjustments-log.md
↳ a change that would break a rule is rejected with the exact failing L1 rule — nothing saved.
🔄 App Sync
Push the verified block to Hevy (routines) + Garmin (workouts). Pull your actuals back into feedback.yaml.
src/sync/hevy.ts ¡ src/sync/garmin.ts ¡ src/sync/floors.ts
↳ floors.ts compares your measured week against your declared minimums.
feedback.yaml flows back to the Truth Layer → the next block is built from what really happened.
① Trusted plans
The model proposes once; code and an adversary dispose. A deterministic gate, an adversarial gate, a human backstop, and a ship gate stand between generation and you.
② Knowledge retrieval
A curated, cited corpus + a registry of who is allowed to speak. Cite-or-abstain: a claim resolves to a real source bullet from an active authority, or it's honestly parked as {NEEDS_AUTHORITY}.
③ Verification
Invented numbers, fabricated coach names, broken citations, violated injuries, over-cap sessions — all caught in code, then re-attacked by a blind auditor. Break one citation and the plan won't render.
This is a domain-agnostic trust engine
— swap the corpus & the rules; the architecture holds.
Truth Layer (cited sources + registry)→ single generation→ deterministic gate→ adversarial gate→ human escalation→ ship gate→ bounded mutation
The model never gets the last word. Fitness today — compliance, legal, medical, finance tomorrow.