Daniel Kitchen
Systems.
The part of AJO that prevents and resolves systemwide malfunctions.
Take the watching layer away and a fleet that "runs itself" only ever runs itself on camera. Build it as its own non-negotiable discipline instead, and the same fleet becomes something you can actually walk away from — because a kill switch stops the fleet from making a single new write, a quota breaker trips before a runaway process gets near the budget, a stuck claim gets swept and re-delivered rather than left stalling in silence, and a poisoned message gets dead-lettered instead of looping forever. None of that is a suggestion in a prompt. It fires whether or not anyone is watching it fire.
Four roles, one job: uptime.
- Monitor — every two hours it looks squarely at the whole fleet's errors, its dead-letter backlog, and whether every daemon is genuinely still alive, and it's the one that decides whether something deserves a concern or an ultra.
- Ops — carries out restarts, deploys, and config edits, and can hot-reload the registry and every prompt without ever needing a restart to do it.
- Incident handler — coordinates the response to anything ultra-tier across every project at once, and stays on it, broadcasting status to everyone affected until it's genuinely closed.
- Lead — owns the architecture of the message bus itself, the foundation the other three roles operate inside of and never get to question.
Structural, not a prompt.
Autonomy here is only ever as safe as the guards enforcing it, so none of them are a suggestion in a prompt — every one fires on its own, in code.
Honest about its limits.
A monitoring layer that overstates what it's actually capable of is worse than having none at all, so a few things stay with a person entirely on purpose. The runner genuinely cannot restart itself, so ops tells me exactly which process needs a human hand on it, and a true ultra-tier incident is designed to surface to a person rather than get quietly swallowed by the system that caused it. The guards exist to buy time honestly — never to pretend they're a substitute for one.
Runs inside AJO. It watches the daemons every other project depends on. Code is private; this page is the record.