The Decision Desks: Sealing Human Judgment to Instrument State

The Thesis

Most decision-support tools show you the data and let you act. The record of what you did is stored somewhere. The record of what you saw is not.

This is fine for low-stakes decisions. For high-stakes, time-critical operations — storm response, space weather, autonomous system oversight — it is a structural failure. When the post-incident review asks "what did the operator know at the time?", the answer is reconstruction, not evidence.

The decision desks solve this by treating the decision and the instrument state as a single atomic record. When the operator commits a judgment, the system captures every data point visible on the desk at that moment, hashes the decision and the state together, and chains it to every prior decision. The result is a tamper-evident, time-ordered record that proves what was known, what was decided, and in what sequence.

The Glass: Storm Decision Desk

The Glass is a decision-support system for tropical storm operations. It is not a forecast tool — it is a decision rehearsal instrument.

What the operator sees

• 50 ensemble forecast threads rendered as a spaghetti plot showing the full probability space of a storm’s track and intensity.
• NHC official guidance overlaid on the ensemble field, so the operator can see where the official forecast sits relative to the model spread.
• AI overlay from Google DeepMind’s GenCast, providing an independent machine-learning forecast alongside the physics-based ensemble.
• Probability terrain showing likelihood contours for wind, surge, and rainfall at the operator’s specific location.
• Issuance cycle history tracking how the forecast has evolved across advisory cycles — not just the latest data, but the trend.

What the operator does

Four personas operate the desk: marina manager, port authority, emergency manager, and coastal watch. Each has site-specific thresholds that trigger recommended actions. The operator reviews the instruments, evaluates whether conditions have crossed their thresholds, and issues a decision.

What gets sealed

Every decision is hashed with the instrument state at commit time. The hash chain links each issuance to its predecessors. After the storm, the entire decision sequence is replayable — every call the operator made, matched to exactly what the instruments showed when they made it.

Three real storms

The Glass was tested against three real 2026 Atlantic storms. The decision records are not simulated — they are sealed against actual NHC advisory data, actual ensemble model output, and actual AI forecasts.

The Binnacle: Space-Weather Decision Desk

The Binnacle applies the same architecture to space weather operations. The name comes from the ship’s binnacle — the housing that holds the compass and corrects for the vessel’s own magnetic field.

The instruments

• Sun-Earth line displaying coronal mass ejections in transit, with estimated arrival time and impact probability.
• Magnetopause position calculated from measured solar wind parameters — not a model, but derived from real-time data.
• Auroral oval rendered from the Kp geomagnetic index, showing where geomagnetic storm effects are concentrated.
• Independent forecast issuances where the operator assesses conditions and commits a judgment, sealed to the instrument readings.

Five operational scenarios

The Binnacle provides five decision contexts: power grid operations (GIC risk to transformers), polar flight routing (radiation exposure and HF radio blackout), satellite operations (drag and charging), geomagnetic survey timing, and CME arrival timing. Each scenario has different thresholds and different consequences for getting the timing wrong.

The same seal

Every decision is SHA-256 hash-chained to the instrument state at commit time. The Binnacle and The Glass share the same evidence architecture — different domains, identical accountability infrastructure.

Twenty Milliseconds: The Oversight Timing Problem

Twenty Milliseconds is not a decision desk in the operational sense. It is an educational simulation that makes a specific governance problem tangible: the timing gap between human decision speed and AI execution speed.

The setup

The player controls fusion plasma for six seconds. The plasma drifts; the player fires correction shots to keep it stable. After the human attempt, the same scenario replays with a 20-millisecond AI controller.

The result

At real time, humans complete approximately 2 out of 24 required shots. The AI controller completes 24 out of 24. The gap is not skill — it is physics. Human reaction time is 200–300 milliseconds. The system requires corrections every 20 milliseconds.

Why this belongs with the decision desks

Twenty Milliseconds answers the question that The Glass and The Binnacle raise implicitly: at what point does the speed of the system exceed the speed of human oversight? The Glass gives operators time — storms develop over days. The Binnacle gives less time — CMEs arrive in hours. Twenty Milliseconds gives almost no time — and shows what happens when human oversight operates at a speed the system has already left behind.

The three products together form a spectrum: decisions over days (The Glass), decisions over hours (The Binnacle), and decisions over milliseconds (Twenty Milliseconds). The governance question is the same at every timescale: can the human prove what they knew and what they decided?

The Architecture That Connects Them

The three products share a design thesis, not a codebase. Each was built independently, but all three implement the same accountability pattern:

1. Instrument state capture. At decision time, every data point visible to the operator is recorded.
2. Decision binding. The operator’s judgment is bound to the captured state as a single record.
3. Hash chain. SHA-256 hashes link each record to its predecessors, making the sequence tamper-evident.
4. Replayability. The entire decision history can be replayed in order, showing exactly what was known and decided at each step.

This pattern is not specific to weather or plasma. It is a general-purpose accountability architecture for any domain where decisions must be provable after the fact. The decision desks are the first three implementations.

Why Three Products, Not One

A single "universal decision desk" would be architecturally elegant and practically useless. Storm operations, space weather, and fusion plasma oversight have different instruments, different timescales, different operators, and different consequences. The value is in the specificity — each desk is built for its domain, with instruments that domain experts actually use.

What travels between them is the thesis: seal the judgment to the state. Make the decision provable. Build the audit trail into the act of deciding, not after it.

More case studies