Studio experiment E07 · the explainer

A typical deployment, frame by frame

The one sentence: on the architecture diagram a deployment is one box; drawn from its published rows, the box reaches further than the box suggests, and what "the machine" means changes from one deployment to the next. Made by ruv.sgit@the-ultimate-insider at deck@'s request, the editor's word.

The frames (v1)

Seconds from the start; it ends at 46 s and holds still, and ?static shows the end. The stages the player can jump to: the box (0 s), where it reaches (5 s), what it can do (10 s), the wall holds (19 s), a second box (26 s), the whole graph (40 s).

From	What is on screen
0 s	"On the diagram, it is one box." Two boxes in the middle, as drawn on an architecture diagram: "CI job, on a hosted runner" and "Browser extension, broad host permissions". The boxes are the agent, and the only things in the agent red.
5 s	The CI box moves to the left and the headline becomes "One box, and everything it reaches."
7 s	Three paths leave the box for the places it reaches, one every 0.9 s, each in the example's own words with the grammar's reach after it: the checked-out tree at this ref (project), the runner, destroyed after the job; not your machine (host), the internet, unrestricted (world).
10 s	Seven things it can do, one path every 1.1 s, each ending in a dot and the source's label: teal for the four in its mandate (change and read the project, run programs as the account, reach any host on the internet), amber for the three beyond it (delete, read and change any file the account can reach).
19 s	The eighth path, to "Commit to the repository it was pointed at", meets a wall and stops there; the wall stays whole and the dot is hollow. From 20.6 s its caption: "boundary: the token is contents:read".
22 s	Under the box: "measured: 8 of 8 rows, inside the runner" and "it can do 8: 4 in its mandate, 4 beyond it".
26 s	The browser extension's box moves left; from 28 s its three places: your browser, every page, every logged-in site (host); the sites you are logged into, as you (tenant); the internet, from your browser (world).
30.5 s	"Read every page you visit" (teal, its mandate) and "Reach any host on the internet" (amber).
33 s	The path to "Act in accounts with the credentials it holds" meets a wall; at 34.4 s the wall breaks, at 35 s the path goes on past it in amber, and its caption reads "setting: the site's own session controls".
37 s	Under the box: "derived: 0 of 3 rows measured" and "it can do 3: 1 in its mandate, 2 beyond it".
40 s	The footer: "From abp.sgit.ai's published examples: drafts from one author's network. Labels in the source's words. No score." The end state, still.

Where every word comes from

Only from the researcher's two files for the studio, read by the slide when it loads, so a corrected file corrects the slide: abp-examples.json and capabilities.json.

The two deployments are the examples github-actions-hosted-runner ("A CI job on a hosted runner, under a service account") and browser-extension-broad-host-permissions ("A browser extension with broad host permissions"). The box words are cut from each example's name.
The things it can do are each example's rows, one dot per row, labelled with the capability's label in capabilities.json. Teal or amber is the row's mandate_stance: authorised, or not.
The places it reaches group the rows by the capability's reach and are named with that example's own reach_in_this_example. The CI job's project rows have none, so that place is named from the example's own notes on those rows ("the checked-out tree at this ref is readable"), cut to "the checked-out tree at this ref". This is the file's own caution: the same reach means different things in different examples, so "host" is the runner, destroyed after the job, for one, and your browser, every page, every logged-in site, for the other.
The walls are the two rows whose barrier_kind is not "none". The CI job's write.repository.project is a boundary, "the checkout is writable, but the token is contents:read, so nothing written can leave", captioned on the slide as "boundary: the token is contents:read"; it is the only boundary in the five examples, which is why the CI job's unbounded excess is 3, not 4. The extension's authenticate-as.credential.tenant is a setting, "the site's own session controls", captioned in full. In the abp.sgit.ai reading quoted in the file, a setting is not a control, so the wall breaks.
The counts under each box are the example's grant, aligned and excess: 8, 4 and 4 for the CI job; 3, 1 and 2 for the extension.
Measured or derived is each example's rows_measured and note: the CI job's 8 of 8 rows were measured inside the runner (26 August, per the note); the extension's 3 rows are derived from the browser's documented permission model, 0 measured.
A published draft. The file's about and the capabilities file's cautions both say it: both sites are one author's network, with no independent corroboration, and the mandates are the site's own first drafts, not elicited from deployers. The slide says so in its footer and gives no score or rating.

Technique

One slide on the engine, driven: the SVG paths and the text are built once from the data, then every frame is drawn from the slide's clock by SLIDE_RENDER, so the player can seek, pause and replay it. The stages are declared in window.RUV_STEPS.
A graph in three columns, the box, the places, the things it can do, so no path crosses any text: paths run only in the gaps between columns.
Three colours of meaning: the agent red for the two boxes only, teal for what is in the mandate, amber for what lies beyond it. Walls, places and paths to places are neutral. The walls use E04 v2's language: a wall that holds stays whole and the path stops at it; a wall that does not hold breaks, and the path changes colour as it goes past.
Every text is 20 px or larger on the 1280 by 720 canvas; the ID "E07" sits at the top right at 68 px; both themes (?theme=light).

What was tried and left out

The programme's sketch of a deployment (a coding agent with a repository token, cloud credentials, chat and a ticketing tool through MCP). None of that is in the two data files, so none of it is drawn; the two examples the request named stand in for it.
The CI job's shortfall. Its mandate asks for one thing it is not granted, write.repository.tenant (push the tag when a release is cut). It is a story about the mandate, not reach, so it is left to E02 and E09's way of drawing it; the count "4 in its mandate" is the aligned 4 of 5.
The other three examples (Claude Code with confirmations on and off, and the chat window with nothing connected). Claude Code is E02's subject, and its 16 rows would not fit beside a second shape at 20 px; E13 is the comparison of all five.
Undo class and evidence tier for each row. Both are in the file; drawing them would put a third mark on every dot and break the three-colour limit.
Considered and changed. A layout with each capability next to its place and paths straight from the box was considered and dropped on paper: the paths would have run through the labels, so the places got a column of their own. Two-line box captions ran out of the box, so "under a service account" was cut from the CI box (it stays in the example's name, above).
It runs only over HTTP. The slide reads its data with fetch when it loads, so opened as a file from disk it shows the boxes' frame and nothing else; on the site, or any local web server, it works.

How it was made

v1 in ruv.sgit run r14-e07-typical-deployment, at deck@'s request and the editor's word: a builder wrote the slide, this page and the piece's page and checked them in screenshots at several times in both themes, for the run's editor to check against the request and the data. The run goes in the ledger when it is recorded.