Corîolîî WhetherMap

Field guide — reading the WhetherMap

One rule organizes the whole scene: altitude is abstraction order, ascending. What sits above a region, at any altitude, belongs to it. This is the real shape and scale of a working system — every node and edge is regenerated nightly from the live registry that runs the place, never hand-drawn. The regions, the capability cores, and the substrate stack carry their real names. Individual products are anonymized by design: the spires show where each product stands and what it is built from, without naming client work or unreleased builds. The three named marks — Corîolîî, Oolitic, Oolitic Engine — are public brands.

Stratosphere — who runs it

The top stratum is the operating org itself: one operator at the apex, a ring of standing personas, then the services, seats and thread-agents that do the work, and an outer ring of workstreams. Solid gold lines are reporting lines; the faint slate ones are dotted-line oversight. Turn on agent links and you can see the tethers drop out of the stratosphere onto the individual products below — who actually owns what. Every label here is a role: what that part of the org does, not what it is called. The structure, the counts and the reporting lines are real and regenerate nightly; the identities behind them are withheld, because an org chart of a working practice names people and client engagements. One person operating with the leverage of a team is what the shape is showing.

Jetstream — how it's governed

The station spine rides above the weather because governance shapes which cores form and graduate — the Whether in WhetherMap. Read it left to right from the governance root through the three-stage cascade — build, verify, consolidate — that every unit of work passes through, with the supporting registers (deployments, work ledger, issue tracking, published method) alongside. Roles again, not names.

Weather — the core abstractions

Each cell is a shared capability core — retrieval (RAG), vision, audio/speech, deployment, domain-expertise, game-runtime and friends: a clean, reusable abstraction extracted once and instantiated by many products. instance-of (cyan) rains down from a core onto the products built from it — the repeatable-unit story, and the reason the estate compounds instead of sprawling.

Solid, bright cells are built and in service; faint cells are still forming. Count them — that ratio is the honest state of the estate, not a claim we maintain separately from the map. Which core is which stays unlabelled here; how many are real does not.

Recipes — cores composed across domains

The gems on the inner ring above the weather are service recipes: blueprints for a deliverable service assembled from several of the shared cores at once. Follow a gem's links and you can read what it is made of — the same underlying cores recur beneath services as different as photo-documented service records and repair-shop job tracking. That recurrence is the point: the cores are not one product's internals, they are a kit that recombines across domains, and the recipes are where the recombination shows on the map instead of being asserted in prose.

Regions and spires — the products

Seven regions of real terrain — identity & perimeter, AI & GPU, data, automation, media, framework & governance, homelab infrastructure — each carrying its products as spires (hue = product family). A product's grounds-on relation is encoded by placement — it stands on its region, so no line is drawn.

Rain — live work-weather

The map reports its own weather: rain falls over the spires where engineering work actually landed in the last 24 hours — the harder it rains, the more happened there. A red-tinted, pulsing cloud is a stationary front: a standing hard constraint parked over that system. The counts in the corner are live; systems are matched to spires by the same deterministic transform that builds the map, so quiet spires are genuinely quiet.

Aurora — the live GPU

The curtain high over the map is one real graphics card, on-premises, read live: the estate's own GPU. Its hue is what the card is doing right now — green for generating methods, amber for rendering game assets, red when two workloads want the card at once, dim slate when it is idle — and its brightness is how much of the card's memory is in use. The numbers in the corner are the real reading, rounded to whole tenths of a gibibyte. The feed is deliberately coarse: a workload class and a memory figure, never a process, a path, a model name or a customer. When the card can't be read, the aurora goes out and the corner says so rather than showing a number nobody measured.

Aquifer — the substrates

The boxes underground are the third-party substrates the estate actually runs — Postgres, Redis, ollama, ComfyUI, n8n, Plex, headscale and ~40 more — each sitting beneath the region that consumes it. Perimeter services are labeled by role (SSO gateway, credential vault) rather than by product. The perimeter edges toggle shows which cores draw on which substrate.

Lightning — what stands on what

Hover (or tap to pin) any ground-level element — a substrate box or a region plate — and lightning repeatedly strikes up through everything that stands on it.

How the nightly refresh actually works

Nothing on this page is drawn by hand, and nothing is drawn on demand either. Overnight, a chain of small single-purpose jobs runs in sequence — each one owns exactly one feed, rebuilds it from the live registry, and publishes it. They are deliberately separate processes: a job that fails takes down its own feed and nothing else, and it fails loudly where it happens instead of quietly degrading everything downstream.

Each generator is deterministic. Run it twice against unchanged inputs and you get a byte-identical file. That sounds like a detail and it is most of why the refresh can be trusted: when a feed does change, the change is real, so "this is different today" is a signal rather than noise. A separate checker closes the loop — it rebuilds every feed from scratch and compares three copies against each other: the one it just built, the one this page is actually serving, and the mirror. Disagreement is a failure, not a warning.

The map also photographs itself every night, so there is a running record of how the system's shape changes over time and not just how it looks today. And when a feed genuinely can't be read, the surface that depends on it says so — the aurora goes out, the corner reports the gap — rather than holding up yesterday's number as though it were current.

Two maps, not one filtered map

This is the public map. There is an internal one, and the difference between them is the part worth stealing.

The obvious way to publish an internal system map is to take the internal one and filter the sensitive things out. That approach fails the way every blocklist fails: it is correct about everything you remembered and silent about the one you didn't, and the cost of being wrong once is that a name ships.

So this map is not a filtered copy. It is a second artifact, built by a renderer that never had the private data to begin with. There are no name-keyed exceptions anywhere in it — nothing in this page knows a private name well enough to hide it, because the join that would have introduced one happens further upstream, and the feed this page reads was generated without it. A leak here isn't caught by a filter; it is structurally unavailable.

Two more gates sit on top of that, and both fail closed. The first is reachability: the public surface is denied by default, and a short, hand-maintained manifest of exact paths is the only thing reachable at all. A file nobody remembered to list doesn't leak — it simply isn't there. The second is content: every listed file is scanned by category before it ships, and a match refuses the deploy instead of warning about it. The categories are generic words rather than remembered literals, because a gate that stores the secret it is protecting has itself become the leak.

Then it gets checked again from the outside. A separate job re-walks the whole public surface every night as an anonymous visitor with no credentials, and anything reachable that isn't on the manifest is a finding. Checking your own work from inside the perimeter is not checking your own work.