The work you do not see.

1. Modality-Routed Perception

Route each input to the engine that perceives that input best, not to the cheapest API.

The industry pitch is "one API, every model" - route to the cheapest token. That is vendor routing. DreamerOS routes by what each engine is best at perceiving. Claude reads composition, narrative, and emotion. GPT reads optics, light physics, and materials. Gemini reads color, space, and balance. Perplexity grounds facts in citations. Grok pressure-tests creative risk. The unit of competition stops being a token and starts being a calibrated answer.

The first lived instance: before any pixel generates on an Elite image, three engines co-author a single master brief. The synthesizer braids the surviving contributions into one directive that none of the three authored alone. That braided brief becomes the base intent for every quorum candidate.

Live today: Constellation Step 0 ships in the gateway at gateway/app/constellation_brief.py, gated by IMAGE_CONSTELLATION_ENABLED, default on in production as of 2026-06-25 (HC confirmed). Wired and held back: the broader cross-modality routing matrix is the next sprint, not a claim of completeness today. See the philosophy entry.

2. Connector As Turn

Every external system call runs through the same intent checks as a chat turn, not a webhook with a key.

The industry treats connectors as plumbing - paste a token, the data flows, the model reads whatever comes back. DreamerOS treats every connector ingest as a turn. The same pipeline that checks a chat message checks an external read: intent shaping, integrity checks, fidelity contract, signed receipt. A connector is not a side door around the checks. It is the same checks applied to a different input source.

The spine is wired. The /connect surface lists every connected provider. The next bite closes the loop for every read path: signed receipt per ingest, drift surfacing per provider, end-to-end coverage of the read-side checks. Until that ships for a given connector, this page does not claim it as live.

Live today: the connector inventory and the gateway-side write-path through the chat pipeline. Shipping next: end-to-end read-side checks per provider. The honest framing matters more than the marketing copy. See the philosophy entry.

3. Sense-Agnostic Integrity Protocol

The Five Pillars bind every input modality, not just text.

Industry guardrails stop at text. Role-based access, redaction, and content filters are all calibrated to characters. Voice, image, file, and connector ingests pass through with a different rulebook, often none. DreamerOS extends the Intent Fidelity Protocol across every sense. The same Five Pillars - Anchor Before Analysis, Verified Not Trusted, No Silent Drift, Compound Over Linear, The Human Conductor - bind a transcribed voice note, an uploaded image, an absorbed file, and a connector read.

Coverage today, honest per modality:

The contract: Five Pillars bind every modality. The receipt: the coverage row above. We update this table when a row moves, not when marketing pressure asks for it. See the philosophy entry.

4. Digital Buoyancy: Ballast

The reading that treats spending less on the deeper model as a warning worth a look, not automatically a win.

Every cost dashboard in this industry tells you when you spent too much. Almost none of them tell you when you have quietly stopped spending enough. A ship riding high in the water looks efficient from the dock. It is also unstable the moment weather comes in, because the weight that keeps it steady is the weight that is missing. DreamerOS watches your own use for the same pattern: a workspace that has quietly stopped reaching for the deeper model on the calls worth getting right, architecture, security, the decisions that are expensive to get wrong, looks like a saving on a spreadsheet. It is closer to running light.

Ballast compares your last seven days of reaching for the deeper engine against your own trailing four-week average, never against anyone else's account. A steady week reads as well ballasted. A sharp rise reads as running heavy, which is information, not a violation. A sharp fall reads as riding high, and that is the state almost nothing in this industry names, because every tool built to watch your spending is built to be happy the moment the number goes down. The method is borrowed from how training load is read in sports science and adapted for this use, so it stays quiet rather than guess: too little history, and it says nothing at all instead of a number it cannot stand behind.

Live today: Ballast ships inside Digital Buoyancy on your dashboard, folded into the reading of whether you are still steering rather than sold as a separate score. Named honestly: the comparison is measured against your own history, not a validated safety threshold, and that caveat travels with the number every time it shows. See the philosophy entry.

1. Code wired

Every change goes through pull request review. The PHP syntax sweep on every page runs on every pull request, so a typo cannot ship a 500 to a customer. Imports resolve, lint is clean, the change actually parses.

2. PR-body and title are honest

An em dash audit fails any pull request title or body that contains an em or en dash, because spaced hyphens are the canon. A metadata cleanliness check refuses pull requests whose body cites file lines that no longer exist in the diff. The narrative around the code has to stay true to the code itself.

3. Operational secrets stay out of public docs

A Crown Jewels scanner runs on every change to the canon and the public docs. If a contributor accidentally pastes a token path, a vendor playbook, or an internal attack surface into a public file, the scanner catches it before merge. The public canon stays sellable; the operational internals stay private.

4. Deploy guard refuses unsafe infrastructure changes

The FTP deploy is jailed into the document root. Past incidents proved that climbing out of the chroot or writing to a nested directory takes the site down. The deploy guard refuses any change to the deploy config that would do either. The infrastructure cannot regress through a quiet edit.

5. LLM grader reads the change (advisory, not blocking)

An LLM grader scores the pull request for hallucinated claims, missing held-back scope, and citation drift. We read the verdict as advice, not as a gate. A red grader verdict does not block merge by itself, because graders drift faster than the codebase does and we do not want a model upgrade to silently raise our merge bar. The human conductor still owns the merge decision.

6. Deploy lands and the site is live

Push to main triggers the Apache FTP deploy. The cache purge fires after sync. The deploy log carries the merged SHA. Nothing is claimed live until the merged commit is the one serving traffic.

7. Six-row walk: done means customer-usable

The P37 walk is the finish line: code path connects, deploy is live, customer can reach the capability at the intended tier, the capability delivers what the directive promised, no surface oversells it, and failure is observable. If any one row is false, the change is PARTIAL or OPEN, never DONE. Pro and Elite customers can ask their AI for a row-by-row receipt against any DreamerOS capability they depend on; the audit log holds the signed turn that produced the walk.

The deep read: How We Ship walks the six-row P37 contract and names the gates above with the same "advisory versus blocking" honesty we use everywhere else on this page.