Skip to content
Mehridian

An AI layer with almost no room

Seemorgh operator console · Overview · 1 The crossing · 2 Sensors · 3 Fusion · 4 AI layer · 5 Checks · 6 Beyond the scenario

The console has two AI surfaces. AI Watch sits in the selected track’s panel and summarises what the track rests on. Scenario Copilot offers approved review questions about the selected track. Both are backed by a small local model, Qwen 3 4B, served by Ollama on the same machine. The model never writes a word that reaches the screen, and in the recorded replay it made no real choice at all.

One AI request, end to end. The browser sends only a timestep, a track ID and an optional question ID. The loopback-only local analyst fetches the frame from FUSE itself; a fixed catalogue picks the situation; Qwen 3 4B sees a small packet and returns slot IDs only; a validator requires exact fields and exact slot sets; server-owned templates are filled with frame values. Any failure shows a labelled deterministic answer instead.

Part of the Seemorgh operator console project.

The fences

The design question was not “how much can the model do?” but “how little can it be allowed to do and still be useful?”

  • The browser can’t ask for much. A request carries a timestep, a track ID and, for Copilot, an approved question ID. There is no free text, and the body is at most 2 KB.
  • The service fetches its own evidence. It binds only to the local machine, fetches the frame from FUSE itself, and checks that it is the requested timestep and is marked as scenario evidence.
  • A matcher, not the model, decides the situation. A fixed catalogue is tried in order: crossing integrity for the hostile, then for the friendly (both t=67–81); priority hostile track; limited-evidence unknown track; supported friendly track; then “track unavailable” and “frame unavailable”.
  • The model sees a small packet. It gets the track’s classification, priority, number of sources, contributing systems, σ, confidence and crossing flag, and for crossing cards the previous frame’s values. It never gets coordinates, raw reports, map state, field evidence or browser text.
  • The model answers in a fixed shape. Ollama runs it at temperature 0, with thinking off and output constrained to a JSON schema. It is told to choose and order only the supplied identifiers. One request runs at a time, with a 45-second timeout. Prompts and output are never logged.
  • The reply is validated exactly. The fields must be exactly right; the card, track and contract version must be repeated; the evidence and uncertainty keys must be non-empty subsets of the allowed ones; the question must be the approved one asked; and each list of display slots must be exactly the allowed set, in some order.
  • The server writes the text. Validated slot IDs are looked up in the card’s templates and filled with values from the current frame.
  • Anything else falls back. If the model is missing, busy, slow, malformed or invalid, the Copilot shows a labelled deterministic answer and Watch keeps its deterministic content.

How much choice is left

Follow the validation through and the model’s freedom is close to zero:

  • Every card has two display slots per panel, so the only display choice is which of two sentences comes first.
  • The evidence and uncertainty keys are recorded with the answer but not shown.
  • Each card has a single review question.

That was the point: to show that a model can sit in front of an operator with no path by which it could add a number, a claim or a recommendation. The cost is that it adds almost nothing either.

The AI Watch panel for FT-001 at t=74: a crossing-integrity card labelled RECORDED LOCAL MODEL DRAFT, qwen3:4b, validated slots, recorded 2026-10-27, an evidence-boundary card below it, and the approved review question at the foot of the panel

AI Watch at t=74, a detail from the same recorded t=74 capture. The label names the model, says the slots were validated, and gives the recording date. Open the full t=74 capture.

What the fifteen recordings show

For the replay, the model was asked once per situation and track, the same rule the live console follows. Five situations, each with a Watch summary, a Copilot summary and a Copilot question, made 15 requests. They were run on 27 October 2026 with no retries.

SituationTrackRecorded atWatchCopilotCopilot question
Priority hostile trackFT-001t=0ValidatedValidatedValidated
Limited-evidence unknown trackFT-002t=0ValidatedValidatedValidated
Supported friendly trackFT-003t=0ValidatedValidatedValidated
Crossing integrity, hostileFT-001t=67ValidatedValidatedValidated
Crossing integrity, friendlyFT-003t=67ValidatedValidatedFallback

Fourteen answers passed validation. The fifteenth, the question about the friendly track during the crossing, didn’t, and the console showed its labelled deterministic answer instead. The service doesn’t log why a reply fails, so the reason isn’t known. The same question also fell back in the 24 October acceptance pass.

In all fourteen accepted answers, Qwen returned the slots in the catalogue’s own order and named every allowed key. Its output is indistinguishable from echoing the allowed lists back. So the recording shows the contract holding and the fallback working. It doesn’t show judgement, because the model had none to exercise.

Answers are reused across a situation: every frame from t=67 to t=81 shows the crossing answers recorded at t=67. The numbers in the sentences come from the frame on screen; only the slot choice is the t=67 one.

The Copilot's approved review question about FT-001, "Does the fetched frame still show one hostile and one friendly track separately?", and its recorded answer card below it

Scenario Copilot: an approved question and its recorded answer. Open the full Copilot capture.

This is the hostile track’s crossing answer: it was recorded at t=67 and is reused at t=74. Qwen chose the review_context slot, so the console showed that slot’s fixed sentence. The slot selection passed validation, but the displayed answer did not resolve the question: it restates the question’s scope. The track table in the same frame does answer it.

The other “reasoning” surfaces

  • The reasoning brief is not a model. The brief in the track panel comes from the REASON service’s deterministic offline fallback, recorded per timestep. Neither the local model nor Gemini wrote it.
  • The Gemini canary ran once and is gone. Gemini reasoning over the fused picture ran as a private canary on GKE Autopilot in July 2026; nothing from it is in the replay. Beyond the scenario has the details.

What would make the model worth having

Give it a real but bounded choice, and measure whether it helps. For example: several alternative evidence slots per card, from which it picks the two most relevant to the frame, with operators judging the choice against a fixed order. Until a test like that is run, the honest description of this layer is a safety contract with a model attached, not an AI that explains tracks.

Limits

  • One recording. Fifteen answers, recorded once at temperature 0. They don’t show latency, variability or behaviour on other inputs.
  • Synthetic only. The service refuses anything but the scenario’s frames, and binds only to the local machine.
  • No operational use. Nothing the AI surfaces show recommends or carries out an action; every question is framed for human review.

Basis: the local analyst service, scenario matcher and catalogue at the export commit named in the replay README (private source); the 15 recorded answers, their index and capture log, and the 91 recorded briefs in the public replay data; the replay README’s recording details (Ollama 0.40.11, qwen3:4b, temperature 0, one run); and the console acceptance record of 24 October 2026.

Previous: How FUSE builds one picture · Next: How it was checked · Back to the overview