Razoo does not train a model. It watches the calls your people make, proposes the ones that repeat, certifies them by replay against your own history, and grants authority that can be taken back the moment it is wrong.

The path

From judgment to rule

observe   a reasoning step or a person resolves work; the decision is recorded
judge     the human choice is captured in flow with the learnable features
evidence  matching choices accumulate against one candidate WHEN → THEN
candidate the candidate is written as a proposed pattern (proposed never fires)
replay    the candidate is replayed against your judgment history
promote   a person promotes; authority is granted only if replay certified it
learned   matching work now resolves at the learned rung, at zero tokens
bind      the pattern is bound to the registry it depends on
demote    revoked on drift or counterexample; the pattern stops firing
revalidate a person asks for replay again; a pass is inert until re-promoted
retire    permanent; the signature is never proposed again

1. Observe and judge

Every decision is recorded with its rung, the artifacts that fired, and the residual that was left. When a person takes a judgment item in the queue, or corrects, rejects, or overrides what a model or a pattern produced, that verdict is stored as an event (work.human_choice) alongside the subject. Nothing extra is asked of the person; the correction is captured in the flow of doing the work.

Not every field is a feature. The agent's fields.yaml declares which keys are learnable. Identity keys and money_legal fields are refused as features, and UUID-shaped values are screened out. When no field is declared learnable, the kernel falls back to a fixed set of situation keys.

2. Evidence and candidates

Repeated choices accumulate as evidence for a candidate WHEN → THEN. A candidate is written as a proposed pattern with the events that support it. Proposed patterns never fire.

Induction is a second route to candidates. It runs only when an operator asks (engine induce), never on a schedule, and its output is also proposed. Re-running updates the same candidate rather than duplicating it.

3. Replay certification

Promotion replays the candidate against your own judgment history and certifies it only when replay passes. The report shows every case it was tested on.

The gate is one function. The operator Promote button, revalidation, and the tests all call it; there is no second comparison and no way to grant active around it. The CLI refuses promotion-bypassing writes, and engine import strips any incoming pattern to proposed.

4. Promote and fire

A person clicks Promote on the patterns page. If replay certifies the candidate, the kernel grants lifecycle active, wraps the pattern in a Verified Autonomy Artefact with an authority envelope (its class, the action ids it may stage, whether confirm is required), and records the transition with the evidence ids and the context's now. The clause as promoted is snapshotted so a later replay can compare bit for bit even if the pattern is edited.

From then on, matching work resolves at the learned rung with zero tokens. The decision records the pattern id and version hash, and explainOf shows the evidence count, the last replay, and the envelope. If the pattern's THEN stages an action, the usual rules apply: it stages without executing, and money and legal fields always need a person.

5. Binding

At promotion the pattern is bound to the registry it depends on. If that changes, the pattern is skipped before any side effect and the work returns to judgment. Details on Concepts.

6. Demotion

A promoted pattern is revoked on drift or counterexample. It stops firing while its lifecycle still reads active, and every change of standing is an event with the decision that caused it. The next matching case falls through to later rungs or the queue; the skip and its reason are recorded on the decision. Nothing is dropped, and nothing has to be redeployed.

Retire (and Disable, which uses the same path) is the permanent version: lifecycle retired, the pattern marked human-disabled, and its signature refused if mining or induction ever re-discovers it.

7. Revalidation

An operator can ask for a revoked pattern to be revalidated (job.artefact_revalidate, run on the next drain). A pass leaves the pattern verified and inert; a person must promote it again. A fail leaves it where it was. If the underlying executable no longer exists, the pattern is retired.

Reasoning debt

Before anything is proposed, the console shows where the model is still doing repeat work. An episode is a skill, a step, and a work type that keep reaching the llm rung. engine debt (or the Usage page) ranks the episodes that still reach the model by how often and how expensively they recur. Observation only: nothing is proposed from the ranking without an operator running induction.

Measuring it: the conversion report

Terminal

pnpm engine report

The report is recomputed from the log each time, as of the context's now, per ISO week. There is no hand-maintained number.

Series	Definition	Does not claim
Conversion rate	Among decisions in episodes that once reached the model, the share now resolved at learned or structured versus llm or judgment.	That a learned fire was correct, or that work that never touched a model counted.
Tokens and cost avoided	Each decision that did not reach the model is credited with the measured average tokens for its skill, provider, and model, priced at flagship list.	Invoice savings, or a hypothetical always-on agent.
Human interrupts	Judgment decisions plus staged actions still pending.	Time spent.
Demotion events	Binding failures at fire or handler time, plus revocations on counterexample.	Every disable, retire, or applicability skip.
Unsafe fires	An executed staged action whose work item later received a reject or override. Always shown.	That zero means the system is safe.
Time to first conversion	Weeks from the first llm or judgment decision in an episode to its first learned fire.	A mean over episodes that never converted.

These series instrument whether recurring model leftovers move to deterministic rungs, and what that cost in tokens, interrupts, demotions, and unsafe executions. They do not prove that the system is safe or that a learned fire was correct.

Autonomy progress, revocation, and the confidence budget

The queue shows a per-item progress indicator for how close a decision is to running itself and a proposal card once a candidate has cleared the evidence floor and is ready to promote. workStatus exposes the same thing as autonomy_progress.

From any decision a learned pattern produced, "This was wrong" withdraws the pattern's authority, records the correct call as a counterexample with a required reason, and returns the work item to judgment — one click. The SDK exposes it as revokeDecision(decisionId, actor, correctChoice, reason). The counterexample feeds the same replay gate every candidate passes through, so the pattern cannot be re-promoted while it stands.

domain.yaml can declare per-action autonomy bounds — auto_below, never_above, min_matches, require_role — validated by doctor, which refuses an auto_below bound on a money_legal field.

How authority is earned