Understanding is not permission
“Move dinner to 10:00 and tell everyone” combines reasoning with consequences. Orbit has to find the event, understand who is affected, prepare the update, and know when a real commitment requires your say.
The dangerous shortcut is to ask “should I do it?” and, after the user says yes, let the model construct the action again. The approved description and the executed payload can drift apart.
Why Vulcan?
Vulcan is the Roman god of fire, metalworking, and the forge. Pluto can reason about what should happen, but Vulcan is where a proposed shape becomes a real object in the world: an email sent, a calendar event changed, a commitment made.
A forge is powerful because it is constrained. Vulcan does not improvise after approval; it executes the exact stored action the owner saw. The name reminds me that turning intent into reality deserves its own workshop, its own rules, and a receipt when the work is done.
The proposal freezes first
Orbit’s capabilities use strict schemas. When Pluto proposes an external write, Vulcan canonicalizes the arguments, assigns risk, encrypts the payload and human-readable preview, and hashes the exact bytes before asking for approval.
The approval contains the owner, conversation, action identity, and stored payload hash. When you approve, Vulcan executes the stored encrypted payload. It does not accept a fresh model-authored replacement at that stage.
- The preview describes the action that is actually stored.
- Approval is bound to one owner and one verified conversation.
- Approvals expire instead of becoming permanent ambient permission.
- A repeated proposal reuses its idempotency identity rather than multiplying the action.
Risk belongs in policy
Not every write deserves the same interruption. Low-risk actions can execute automatically when policy allows. Sending email, deleting calendar events, or changing an event in a way that can notify another person crosses a clearer boundary and requires short-lived approval.
That decision is made by typed action policy, not by whether the model sounds confident.
Receipts close the loop
Execution is not complete because a request left Orbit. Vulcan records the provider result as an encrypted receipt, while Orbit returns a concise human result to the conversation. Retries can recover the same action without quietly repeating it.
The result is a conversational approval flow with a hard technical boundary underneath it: the user sees one concrete commitment, approves those exact bytes, and gets confirmation of what the provider accepted.
Trust should survive a model mistake
Models will misunderstand things. The goal is not to pretend otherwise. The goal is to design the action boundary so a misunderstanding is visible before it becomes somebody else’s calendar event or inbox message.