MARY-CONOPS — Concept of Operations for the MARY ecosystem

This document answers exactly one question: how does a mission day fly? It contains scenarios and phases, never shalls — requirements derive from these scenarios into SRS-MARY-001 and are verified there. Structure, rosters, and register law live in APEX-MAP; pre-ratified decisions live in FLIGHT-RULES. Per MR-12, anything restated here from those sources is a defect in this document.

1 · Mission phases

MARY operates as a continuously-flying vehicle. There is no "off"; there are phases.

stateDiagram-v2
    [*] --> QUIESCENT
    QUIESCENT --> TASKING : FLIGHT speaks / scheduled burn
    TASKING --> GATED : gate flag set on envelope
    TASKING --> QUIESCENT : task complete + filed
    GATED --> TASKING : GO (poll passed)
    GATED --> QUIESCENT : NO-GO (dropped to Null0, filed)
    QUIESCENT --> ANOMALY : drift watch / canary trips
    TASKING --> ANOMALY : execution failure past retry budget
    ANOMALY --> RECOVERY : Eir engaged
    RECOVERY --> QUIESCENT : realigned + filed
    ANOMALY --> STANDDOWN : GJALLARHORN (fleet halt)
    STANDDOWN --> RECOVERY : FLIGHT directs

Caption: Five phases. QUIESCENT is the default state: standing automations burn on schedule, panels update, nobody talks. TASKING is envelope-driven work. GATED is a held poll. ANOMALY/RECOVERY is Eir's territory under FR-004. STANDDOWN is rare and loud — GJALLARHORN halts the fleet and everything waits for FLIGHT.

2 · Voice-loop discipline

Three loops exist. Everything else is backroom traffic and never reaches FLIGHT's ears.

1. Dispatch loop — FLIGHT ↔ CAPCOM (and FLIGHT ↔ FIDO through the wall, fleet domain only).
2. Poll loop — Týr → FLIGHT, GO/NO-GO items only, one question at a time.
3. Diagnostic downlink — EECOM → FLIGHT, scheduled (08:00) or severity-triggered. Downlink-only: FLIGHT replies on the dispatch loop, never on TLM.

A fourth, outbound-facing loop exists but points away from FLIGHT: PAO dispatch (CELIA → the world), which is gated and logged like any burn.

3 · Operational scenarios

Each scenario states its trigger, the traversal, and observable success criteria — the falsifiable statements the SRS will convert into numbered shalls with verification methods.

OS-01 · Nominal tasking (the canonical traversal)

Trigger: FLIGHT speaks an intent on the dispatch loop.

sequenceDiagram
    autonumber
    actor F as FLIGHT
    participant C as CAPCOM
    participant E as EECOM
    participant P as PROP (Kvasir→SPUTNIK)
    participant G as backroom god
    participant T as TÝR
    participant FO as FORSETI
    participant S as SAGA→FDR

    F->>C: intent, plain speech
    C->>C: resolve door (APID)
    C->>E: request envelope stamp
    E-->>C: stamped — class, ceiling, flags
    C->>P: dispatch (CCSDS frame)
    P->>G: schedule routine
    G-->>P: result + score
    G->>T: seam crossing (no flags set)
    T-->>G: allow · log
    G->>FO: verdict request
    FO-->>S: PASS → append to FDR
    S-->>E: filed
    E-->>F: diagnostic + trace_id

Success criteria: every dispatched task has exactly one envelope; the envelope validates against ICD-001 before dispatch; FLIGHT hears at most two voices (CAPCOM ack, EECOM report); the FDR record resolves from trace_id alone.

OS-02 · GO/NO-GO poll on a class-A seam

Trigger: an envelope carries money_write or human_ratify (FR-003) — e.g., a toll.provision enact against live catalog.

sequenceDiagram
    autonumber
    actor F as FLIGHT
    participant C as CAPCOM
    participant M as MODGUD (toll surface)
    participant T as TÝR
    participant S as SAGA→FDR

    C->>M: dispatch, class A, ceiling P1
    M->>M: dry-run → diff produced
    M->>T: crossing request + diff
    T->>F: GO/NO-GO — one question, diff attached
    alt GO
        F-->>T: GO
        T-->>M: enact
        M-->>S: receipt appended
    else NO-GO
        F-->>T: NO-GO
        T-->>S: drop recorded to Null0
    end
    S-->>F: filed either way

Success criteria: no class-A write ever executes without a recorded GO; the diff shown at poll is byte-identical to what enacts; a NO-GO leaves zero partial state; poll latency (request→FLIGHT sees it) is bounded and measured.

OS-03 · Out-of-hours anomaly (FR-004)

Trigger: Heimdall trips a drift watch at 03:12 on a class-C seam.

sequenceDiagram
    autonumber
    participant H as HEIMDALL
    participant EI as EIR
    participant S as SAGA→FDR
    participant E as EECOM
    actor F as FLIGHT

    H->>H: 03:12 — DW trip, class C
    H->>EI: engage (FR-004 authority)
    EI->>EI: realign to last-known-good
    EI-->>S: full trace appended
    S-->>E: queued for morning downlink
    Note over F: FLIGHT sleeps
    E-->>F: 08:00 — anomaly, action taken, current state
    opt class-A or GJALLARHORN
        H->>F: immediate wake — STANDDOWN
    end

Success criteria: no class-B/C/D trip wakes FLIGHT; realignment completes without human input; the 08:00 brief contains trip cause, action, and verification that last-known-good holds; the class-A wake path is tested (not merely believed) at least once per quarter.

OS-04 · PAO dispatch day (CELIA)

Trigger: FAO's timeline shows a scheduled outbound slot, or a campaign milestone fires.

sequenceDiagram
    autonumber
    participant FA as FAO (timeline)
    participant PA as PAO (CELIA)
    participant V as verify gate (brand-voice + 30_verify)
    participant P as PROP (POSTIE via SPUTNIK)
    participant MG as MODGUD (attribution)
    participant TL as TLM panels

    FA->>PA: slot open — campaign X, channel set
    PA->>PA: draft via baselinx skills / dj-educator
    PA->>V: submit draft
    alt PASS
        V-->>PA: pass
        PA->>P: POSTIE dispatch
        P-->>MG: UTM/attribution envelope stamped
        MG-->>TL: conversions → funnel panels
    else FAIL
        V-->>PA: defect list — fix, re-run, never publish on FAIL
    end

Success criteria: nothing publishes on a failed verify gate; every outbound carries attribution that Modgud can resolve; CELIA operates daily without FLIGHT in the loop; spend-guard behaviour follows FR-006 once ratified.

OS-05 · Annex fleet run (FIDO through the wall)

Trigger: FLIGHT requests fleet work — "converge the class-D repos" — on the annex loop.

sequenceDiagram
    autonumber
    actor F as FLIGHT
    participant W as xenonite wall (@rocky/contracts)
    participant FI as FIDO (ROLAND)
    participant K as KAHN (via Kvasir)
    participant R as RALPH runners
    participant FO as FORSETI
    participant E as EECOM

    F->>W: fleet intent
    W->>W: validate against contracts (FR-007)
    alt schema-valid
        W->>FI: pass through, envelope L1A
        FI->>K: submit runs (RunConfig)
        K->>R: execute DAG
        R-->>K: KahnEvents + convergence scores
        K-->>FI: RunEnd summaries
        FI->>FO: outcomes for verdict
        FO-->>E: recorded
        E-->>F: fleet report — outcomes, p50/p95, flaky nodes
    else invalid
        W-->>F: dropped to Null0, logged, not retried
    end

Success criteria: no L1A payload crosses unvalidated (DW-APEX-04); fleet reports arrive in flight-dynamics vocabulary (convergence, outcomes, percentiles); a stuck/catastrophic run reaches the report with its trace, never silently vanishes.

OS-06 · FAO morning brief (08:00 daily)

Trigger: clock.

sequenceDiagram
    autonumber
    participant FA as FAO
    participant E as EECOM
    participant TL as TLM
    participant PA as PAO
    participant FI as FIDO
    actor F as FLIGHT

    FA->>E: overnight diagnostics?
    FA->>TL: MET countdown — net MRR vs £8k
    FA->>PA: outbound queue + yesterday's attribution
    FA->>FI: fleet state, promotions per FR-005
    FA-->>F: one surface — anomalies · money · outbound · fleet · today's burns
    F->>FA: reorder / strike / add (dispatch loop)

Success criteria: one surface, one downlink, under five minutes to read; every item links to its FDR trace; nothing outside FAO's surface schedules FLIGHT-attention items (FR-008 once ratified); the MET panel shows the same number Skuld's models show — one truth.

OS-07 · Deck loss (partial-failure operations)

Trigger: SPUTNIK stops responding mid-day. A facility spec without this scenario is a fair-weather spec.

sequenceDiagram
    autonumber
    participant TL as TLM
    participant H as HEIMDALL
    participant EI as EIR
    participant E as EECOM
    actor F as FLIGHT
    participant FDR as FDR

    H->>TL: SPUTNIK deck red
    H->>EI: engage runbook RB-MARY-DECK
    EI->>EI: restart attempt (bounded)
    Note over FDR: new envelopes queue in FDR — dispatch HOLDS, nothing lost
    alt restored
        EI-->>E: deck green, queue drains in order
        E-->>F: noted in next brief
    else not restored
        EI-->>E: escalate — degraded ops declared
        E-->>F: immediate downlink — degraded mode table in effect
    end

Degraded-mode table (what holds vs what stops):

Success criteria: queued envelopes survive deck loss and drain in FDR order; degraded mode is declared, never discovered; each deck-loss drill is run (not simulated on paper) at least once before the SRS row verifying it is marked closed.

OS-08 · Envelope intake and door resolution (the workflow plane)

Ratified 2026-08-10, docs/decisions/2026-08-10-os-08-ratified.md, on the draft authored 2026-08-09. Added to a rank-0 ratified document under MR-7: this section and the §4 row are additions, and no existing scenario text is edited.

Trigger: an unstructured request arrives at the floor — a sentence, a webhook body, a form. Nothing about it is yet addressable, and nothing about it is yet refusable, which is the same problem stated twice.

Traversal: the requester's intake reaches stamp-envelope, which mints a trace_id and stamps an envelope; the envelope is validated against ICD-001; an invalid intake is refused with its reason named and produces no envelope. A valid envelope reaches door-resolve, which resolves intent to a DOOR-* against the vault registry, or refuses and names the intent. There is no default door. Acceptance and every refusal are recorded to FDR against the same trace_id.

Success criteria:

1. Every accepted intake emits exactly one envelope valid against ICD-001 (docs/envelope.schema.json), verified by bin/icd001_validate.py — the CI-enforced validator landed by the 2026-08-08 Phase 4 spike.
2. Refusal fixtures are actually refused. An intake that cannot produce a valid envelope produces no envelope, not a degraded one.
3. Intent resolves to a DOOR-* deterministically: the same intent against the same vault registry state resolves to the same door, or refuses.
4. An unresolvable intent refuses and names the intent, rather than routing to a default door. There is no default door.
5. Both the acceptance and each refusal are resolvable from trace_id alone, which is OS-01's own criterion and the reason this plane feeds FDR.

Criterion 3 carries a named caveat, ratified with it rather than smoothed away. No document specifies the vault registry's state model, so "the same vault registry state" is not independently checkable today. It is falsifiable in the weaker form — two resolutions of one intent against an unchanged registry must agree — and that is what M4.2's gate reads. The stronger form is owed to whatever specifies the registry, and is recorded as owed rather than assumed.

4 · Derived-requirements hooks

Each scenario seeds SRS sections; the mapping below is the authoring order for SRS-MARY-001.

5 · Non-goals

• No shalls here. Requirements live in SRS-MARY-001.
• No structure or rosters here. That is APEX-MAP.
• No thresholds here. Numbers (CAC guards, latency bounds, retry budgets) are ratified in FLIGHT-RULES or the SRS with data behind them — a threshold written before data exists is fiction with a version number.
• Not a multi-operator ConOps. MARY flies one FLIGHT. If that changes, this document is superseded, not amended.