Four sub-score entities, not one. The assessment tool holds all four scores in a single entity and gets away with it because one process computes them serially. Under T1's independent cadences, four writers against one entity is last-writer-wins — the hourly volume write would clobber the nightly narrowness write. Splitting them is what makes the reducer-as-a-view design work at all.

The trigger is not the work. A timed action has no journal and no steps — on failure it re-runs from the top, indefinitely by default. So each trigger does exactly one thing: start the run. The run is a workflow, which is what makes "resumes at the last completed step" above true rather than aspirational. There is no workflow that orchestrates all four; each scorer runs on its own schedule, and the view recomputes whenever any of them writes.

How often is "every tick"? Engineers must decide this, and it is the biggest open question on this slide. It sets how many workflow instances exist at once, so it is a cost decision before it is a correctness one. The instinct to batch is probably wrong: with a large fleet under evaluation, many small incremental runs are likely better than few large ones — a long cadence lets a backlog of un-scored agents build up, and the deeper that backlog, the staler every verdict downstream of it. Start frequent and incremental, then measure.

Sanitization — and where it must not be applied. Akka's sanitizer masks matched patterns (email, phone, card, IBAN, IP, plus custom rules) and can be called from any component, not only an agent. Enable it on logs, where it costs nothing, and apply it to the A2 judge call if that judge is not served in-VPC — the one place in T1 where text leaves the boundary.

Do not sanitize before tokenizing or embedding. Masking rewrites the text, and this workflow exists to measure text: a masked span changes the token count that A4 prices, shifts the vectors A1 and A3 cluster, and can alter the extracted template. It would corrupt the scores silently, since nothing would fail. Measure first, sanitize after.

The substrate branch is not a flag. Own-GPU launches a training job against capacity you schedule and writes a checkpoint to your store. Managed tuning posts a job and hands back an adapter, and has no capacity reservation at all. Only the training step differs; dataset build, augmentation and the exit check are common to both.

The exit check is not T4's first rung. This asks whether the run produced a usable checkpoint — converged, no collapse, better on the trainer's own validation split. Whether it beats the incumbent is a different question, asked by T4 on different data. Conflating them is how a bad candidate reaches real traffic.

Containment is authorization, not prompting. The rollout runs as a scoped, read-and-sandbox-only projection of the real persona's identity and tool access. Reversible in-workspace tools run for real inside an ephemeral clone; irreversible or external tools are mocked. Enforced at the authorization layer — never by trusting the model. Akka's guardrails do not implement this: they inspect text at the model boundary, and this is an access-control question.

Train must equal serve. If the rollout harness differs from the harness at serving, the reward optimizes an environment that does not exist. Prefer driving the real vendor harness in the loop, and snapshot workspace state rather than model I/O alone.

Promotion is one intent, which is what makes rollback cheap. This workflow does not write the routing table; it asks. The gateway applies the change atomically, so undoing it is the same size of change — no drain, no redeploy. A rollback that costs more than a promotion does not get used in an emergency.

Some holds are deliberate. A candidate stops at its last passed rung when the agent is high blast radius, or when cost improves while quality is only level. A person decides that; no threshold does. The candidate keeps its evidence while it waits.

One writer, by design. T4 asks on promotion, S3 asks when a model decays, a person asks on approval — and the gateway makes every change. That is what gives the routing table a single ordering and a single audit trail. A second writer would make rollback ambiguous exactly when it matters most.

Escalation is configuration. The low-confidence signal is whatever a person configured for that agent: an exact check where the task allows one, a confidence threshold, or a judge call. There is no default, and an agent without a policy simply never escalates automatically.

S2 acts, T4 judges. On a canary dip S2 reverts the split to the incumbent immediately, without waiting for the control plane, and only then reports the breach. T4 owns the saga and records the verdict; S2 owns the safety action. Splitting it this way means the fast path is never blocked on a slower one.

Shadow costs money and shows nothing to users. Every shadow request is a second inference that is scored and thrown away. That is the price of a risk-free comparison, and it should be a deliberate, bounded spend rather than a permanent background cost.

A cliff and a slide are different events. Sharp degradation is handled without asking anyone: emit a revert intent and re-open training. Gradual drift is a person's decision — retrain, or return the agent to the frontier for good — and the agent keeps serving while that decision waits. Automating the second one would either revert too eagerly or too late.

Measured against the retained standard. The acceptance evidence from promotion is kept precisely so this comparison is against what the model proved. Re-deriving a baseline later would let the standard drift along with the model.

Scrub before persist, and drop on failure. PII and secrets are removed at the boundary, before anything is written. If scrubbing fails the trace is dropped rather than stored unscrubbed — the record is allowed to have a hole in it, but never a leak. This is the natural home for Akka's sanitizer, which masks matched patterns and can be called from any component.

Governance tags travel with the trace. Regulated status and training consent are written onto the record here, at capture. That is what lets T1 veto an agent months later without re-deriving where the data came from — and it is why a wrong tag at this step is a compliance failure rather than a scoring error.

Two onboarding paths, two levels of control. Pointing an agent at the gateway gives inline steering, enforcement and capture. The log forwarder gives capture and audit only — there is no steering until that agent is proxied, and the difference should be explicit to whoever is buying.