why two Ts

i almost called it strat. one T. it is the easier word. it fits in a logo. nobody asks you about it at a party.

i kept the second T. this post is about why, which turns out to be about the whole thing, because they are the same reason.

eva stratt has two Ts

eva stratt runs project hail mary. the administrator, not the scientist. her job is to make sure the science is real before anyone bets a planet on it. she is not warm about it. she does not need to be.

her name has two Ts. i could have dropped one. it would have been fine, right up until eva saw it.

so that was out.

i used to debug things that could fall out of the sky

before this i spent about ten years on aircraft network and satellite telemetry. a wrong value there is not a ticket. it is an aircraft doing something nobody asked for, or a satellite you cannot reach anymore.

you pick up a habit there and it does not come off. every number on the screen has a provenancewhere a value came from. the chain you can name: which sensor, which bus, which transform. no chain, no trust.. you can say where it came from, which sensor, which bus, which transform. if you cannot prove the chain, you do not trust the number, however reasonable it looks.

reasonable and wrong is the bad one. that is the combination that hurts people.

most of the job is just refusing to trust a value you cannot trace.

then everyone put the value in a text file

at some point i noticed teams handing their most consequential decisions to prompts. strings. in a text file. no version. no signature. no way to know whether what shipped is what someone reviewed, or whether it got edited on a friday and the thing that broke in production three weeks later traces back to that edit.

# the value, today: a string in a text filedeny the claim if older than 30 days. keep the tone firm.# the same value, addressed and fingerprintedstratt://support/rule/refund-window@1.4.0blake3:9f2c7a... recomputed from the text, changes when it does

that was the plan. that is still the plan, at most companies.

the value had become un-provable again. except now the value is the instruction a model follows when it talks to your customer, denies their claim, or moves their money. same failure mode i spent a decade avoiding, with worse blast radiushow far a single change can reach. the set of things one edit can break before anyone notices. and a nicer UI.

i did not have an insight. i had a reflex. i have seen this movie. i know how it ends.

stratum

there is a part of NTPnetwork time protocol. how machines on a network agree on what time it is, and how far each one is from a clock that actually knows. most people never look at: stratum.

a clock’s trustworthiness is its distance from ground truth. stratum 0 is the reference, the atomic clock, the GPS receiver, the thing that does not ask anyone else what time it is. stratum 1 syncs to that. stratum 2 syncs to stratum 1. the number is how many hops you are from the truth.

the distance is explicit. that is the good part. a clock does not get to claim it is authoritative. it declares its stratum and you decide. you do not have to take its word, you can check.

a prompt library has no stratum. you open the folder and you have no idea where anything came from, who touched it last, or whether the version running is the version anyone agreed to. it is stratum-unknown, top to bottom, and nobody says so out loud.

stratt gives prompts a stratum.

every unit has a canonical address. every unit has a fingerprinta blake3 hash computed from the unit's canonical content. change one byte and the hash changes, so a silent edit stops being silent. computed from its content, so if the content changes the fingerprint changes, and the change is detectable instead of hopeful. chains compose units. the dependency graph is explicit, so you can see what an edit touches before you merge it, not after.

it does not make your prompts good. nothing makes your prompts good. it makes their provenance checkable. you stop trusting a string because it reads well. you trust the chain because you can check it. nobody bothered to do that for prompts yet.

the mark is a null route

null0. in networking, a null routean interface that silently discards every packet routed to it. the address for traffic you have decided should go nowhere. is the address that goes nowhere. the packets you send to be discarded.

it is a decision, declared, about where things go when they should go nowhere. nothing bleak about it. it is the thing keeping the routing table honest.

loud failures are easy. something breaks, you get paged, you fix it. the silent ones are what cost you. the dropped packet. the drifting clock. the quietly edited prompt. by the time you notice, it already shipped.

so the whole bet is against silent failure. signed history over rented trust.

renting trust means taking someone’s word that what you reviewed is what ran. you find out otherwise at the worst possible time. signed history means you do not take the word. the record is cryptographic, the edit is evident, and the silent change stops being silent.

that is the product. make the quiet failures loud.

so, two Ts

eva stratt would not accept a prompt library that could not tell her where a behavior came from. she would not accept “it probably did not change.” and she would not accept her own name spelled wrong because the wrong spelling fit better in a header.

a thing about provenance cannot open with a hand-wave about its own name. the name has to do the thing the product does. get it right, even when one T would have been fine for everyone who was not paying attention.

the scheme carries it. stratt://. two Ts, every time you address a unit. a small, repeated insistence that the correct version and the convenient version are different versions, and we are going to keep typing the annoying one.

what changed

for ten years i traced every value because the cost of not doing it came back as hardware that did not. then an industry decided prompts were exempt. that the instructions steering the model did not need the discipline every other serious value gets.

nothing is exempt. i stopped waiting for someone else to notice and built the layer i already knew how to build.

the next thing rewarded is going to be provability, being able to prove what you ran, what it did, and that it has not changed under you. that stops being hygiene and becomes the differentiator. i am early. i have been early to this exact problem before, in a domain where being late was not an option.

the scheme is live. the first units have addresses. you can resolve one and check the fingerprint yourself, which is the only sentence in this post i would actually like you to test.

do not trust the value you cannot trace. spell the name right. keep the second T.