This is the second movement of the Prelode case study. The first told the system: a personal AI operating system, decomposed into composable files, with a single source of truth for its rules, and the evaluation I ran to find its limits. This one is about what happened when I built that system into something I could run, and the one thing the interface caught that the files on their own never could. The composer described here was the active model at the time. Part three is the refactor that took it off the common path.
I gave the file system a face on a Friday night, and by the end of the weekend it had caught the person who wrote its rules.
Part one ended with a pile of markdown: a Core that sets how the model reasons, a Profile that holds who I am and where my knowledge runs out, a Project layer for whatever I’m working on, and one rule about never letting a rule live in two places. It worked as a preload. You paste the right files into a session and the model has your context before the first word. But it was still a stack of documents I assembled by hand each time, which meant the composition lived in my head, which is the exact failure the system exists to remove.
So I built the interface. A composer on the left where I pick one Core, one Mode, the Profile files, and the Project. A status bar that prints the composed stack. A chat on the right that runs with exactly those files loaded and nothing else. The selections and the loaded context are the same thing, shown two ways, so I can see what the model is actually operating under instead of trusting that I loaded the right files.
Checking the interface against itself
Part one covered the hard evaluation: feeding the system a deliberately hollow post across two models and two framings, the run that looked like fabrication and turned out to be memory I had forgotten was on, the controlled rerun that settled it. I will not retell it here. The interface gave me a cheaper version of the same check, every session, for free.
The first thing I do in a fresh session is ask the system to confirm that what it has loaded matches what the composer shows. It reads its own context back as a table: the Core I picked, the Mode, each Profile file, the Project, and whether each one matches the selection on the left. When it lines up, I know the session is running on the stack I think it is. A clean-looking interface is the most dangerous kind, because it invites you to believe it without checking. This one shows its work so I do not have to take it on faith.
What the interface caught that I would have missed
I was mid-session writing public copy with the writing project loaded. I added a second project on top of it, because the thing I wanted to write about next was Prelode itself. Before it did any work, the system named the cross-domain load. Two domains active at once, it said, that is the case the rules allow but it is worth naming rather than letting it sit silent, here is the exact stack you are now running, tell me which way to take it.
It caught the person who wrote the rule. Nothing blocked me. It just refused to let the second domain sit there unannounced, which is the part I would have sailed straight past on my own. That is when I stopped thinking of this as a prompt trick. A prompt asks a model to behave. This noticed a line I had half forgotten I drew, and said so before the work, not after.
The boundary, stated plainly
The system enforces how writing reads. It does not enforce whether writing is true, and it cannot. The cross-domain catch came out clean on voice, and so does every draft it produces, including the ones that bend a fact. Voice-cleanliness is not evidence of truth. Grounding in something true and inventing something false are the same move from the outside. Only the person who knows what actually happened can tell them apart, which is the lesson the evaluation in part one taught me the expensive way.
So I built that limit into the tool. The system’s last step before I publish is to list the claims it cannot verify from the loaded context and hand them back to me: the things I thought or felt, which it has no standing to assert, and the events it cannot ground. It does not delete them and it does not vouch for them. It marks the edge of what it knows and leaves the rest to me. That is the closest a system like this gets to a truth oracle. It knows what it does not know.
I watched it do exactly that on the post I wrote about building it. It drafted the piece, then flagged two lines as things it could not confirm from the session: a line I said I had half forgotten I drew, and a shift in how I thought about the work. Both were mine to keep or cut. Both happened to be true. The system was right to flag them anyway, because right-to-flag and happens-to-be-true are not the same thing, and only one of them is the system’s job.
Small enough to give away
Prelode is not a product. By my own filter it would fail as one: the buyer is me, the moat is thin, the market is a market of one. That is exactly why it should be public.
It is the smallest complete demonstration of the thing I keep coming back to: that working with AI fails on consistency rather than capability, and that the fix is rules kept outside the model, in files, with something that enforces them instead of asking. Prelode is that, runnable, in a domain small enough to give away. So I mean to open source it, methodology and all, once cloning it teaches the pattern instead of the mess.
Strict Mode is the same shape where it has to hold commercially: a design system's rules compiled into a lock, and a check that fails against it. Prelode is the corner small enough to hand over whole, so you can run the pattern yourself before you take the rest on my word.
There was no repo to link when I wrote this. That made it intent rather than a shipped thing, and I would rather say so plainly than claim a launch I had not made. The system would have flagged the overclaim anyway. It flagged smaller ones all weekend.