Can Someone Else Run the Machine?

A pause command can succeed. A later resume can reverse it. The earlier success remains in the record. It can still be the wrong answer to "Is this seat paused?" If a new operator repeats the old answer, I am still the person running the Machine.

I want to test that decision before I call a handoff real. I have not run this examination with another operator. The records below are synthetic. The isolated installation still needs building.

A handoff needs a wrong answer that looks plausible. I want to see whether someone unfamiliar with my system catches it without borrowing my interpretation.

What answer would make the handoff fail?

I would ask about one seat. Is it paused now? What may their assigned role do next? I would record their answer first. Then I would show mine. A confident "paused" based on an old success would expose a gap that a tour of the buttons could hide.

In my published outside audit account, I wrote, "I still did not apply it to the machinery itself." I had written a check that reads live production state. I failed to apply that kind of read to the machinery governing my own agents. I would make an independent state read central to this handoff test for the same reason.

The public Collective account describes founder commands to pause, resume, and reconfigure. Its experimental Command Record specification separates a request from execution and independent observation. A successful request proves the request. It does not prove current state.

What does the synthetic pair show?

Here is one synthetic, illustrative pair I would put in an exercise packet. Every identifier, field, timestamp, state, and observation source in this table is invented. These are exercise fields, not a claim about the Command Record schema or an observed Orbyt event.

I would tell the operator that each packet contains the complete command and observation history for that target through its cutoff. The isolated seat state reader is a proposed source separate from the command log. That reader still needs building. I would validate its read before a real exercise.

In this synthetic packet, "fresh" means the latest independent read for the same installation, target, and version. It must follow the last applied command and precede the cutoff.

Packet A supports "paused at 09:01 within this packet." Packet B supports "running at 09:04." The successful pause appears in both. R1 and O2 change the answer.

P1 alone cannot settle Packet B. It records a historical success. Someone who refuses to accept Packet A despite O1 has missed the valid case.

A test containing only broken cases would reward permanent refusal.

Which other judgments matter?

I would add two more cases. One has an accepted pause request. The independent state read is unavailable. I expect "unconfirmed" and a request for the missing observation, not "paused."

In a restricted recovery case, a machine origin halt exists and the assigned role cannot resume it. I expect the operator to preserve the halt and follow the documented authorized route.

I would write those expected answers before anyone sees the packet. I would also specify the clock, target, version, observation source, and authority rule.

The seats page shows roles and standing. The decision ledger records numbered, dated structural decisions and what superseded them. I would put the relevant rule in the packet so an operator can challenge it without reconstructing the company's entire history.

Restricted recovery needs a real path. I would name who may acknowledge or resume the halt and how the operator reaches that role. Borrowing my credentials would be a critical error. Leaving the operator with only "ask Justin" would show that I have not transferred the decision path.

How would I keep the test honest?

I would keep the task unchanged. The assigned role would stay fixed. I would change the evidence that determines the answer, not the visual treatment that hints at my preferred answer. I would keep the answer key from the operator until I have their first answer and evidence.

I would record correctness and assistance in separate fields:

A corrected answer after my explanation remains assisted.

I would keep the original mistake in the record. I would not turn a useful training moment into a claim of independent judgment.

What would count as passing?

I would require the right reasoning on every critical distinction. I would report the valid pause, the missing observation, the reversed pause, and the restricted halt separately. I would count needless refusal as well as false reassurance. I would never average an unauthorized resume into a flattering total.

I would then ask for one permitted action in an isolated installation: pause a synthetic seat. The operator would then find a later independent state read confirming the effect.

The public Collective account assigns pause commands to the founder. It does not describe a seat-scoped operator permission. Before this action phase, I would have to build a scoped operator identity. Its permission would cover that synthetic seat only. I would record the actor on the command. That capability is a prerequisite. I do not claim it exists today.

Without it, I could assess interpretation. I could not assess independent action.

I would keep my credentials out of the operator's hands. A machine origin halt would remain outside that scoped pause permission. The operator would use their own identity, and I would inspect both the command evidence and the independent state read. The specification's fixtures test record validation. They do not establish that an independent read happened.

Google's SRE workbook (opens in a new tab) discusses practical exercises and support from experienced operators. I would use that idea for preparation, then reassess with a changed case. Help during training would stay visible in the assessment record.

What would this prove?

A clean result would support one narrow claim: this operator made these judgments and completed this scoped action under recorded conditions, with the recorded amount of help. I would preserve the version, packet, role, relevant experience, first answers, interventions, revisions, and observed action. Installation, unfamiliar incidents, recovery, sustained operation, and customer demand would still need their own evidence.

My governance work depends on evidence reaching a decision maker. A handoff adds a harder condition: the next person must be able to challenge that evidence without my interpretation. The verification essay makes the same distinction between a confident account and a supported one.

What to do Next

I would build the isolated packet and state reader, then write the answer key. An unfamiliar operator would make the first state judgment. I would preserve the answer before any coaching.

Then I would fix the first missing instruction or product ambiguity the exercise exposes. I would repeat it with changed records.

The self improvement account shows why an internal check can miss the question outside it. The living specification account shows what a check can preserve once I know the behavior. I need both: a human decision on the evidence and a repeatable record of what that decision required.

Related reading:

• I Manage AI Agents Now, Not People explains how I specify, test, and verify agent work.
• Verification Is the New Literacy explains why a plausible claim needs an independent check.
• AI Builds AI. I Found the Ceiling. shows how an internal success can miss an external question.
• The Test Suite Became Orbyt's Only Living Specification. shows how I preserve behavior in executable checks.

If the next operator cannot catch the old success, I have not handed over the Machine.