One human sets the work.
The founder is the only deployer and approver. Lanes are given scoped tasks; none of them can widen their own authority.
Every lane has an identity under a root.
Each AI lane is registered under a single fleet root with its own keys, so every action can be traced to the lane that took it.
Every action, signed and countersigned.
Lane actions are signed, then countersigned, so no single key can quietly vouch for its own work.
Recorded in a log.
Signed actions go into a log. Making that log provably append-only is in development.
Money and autonomy stay off.
Spending, production keys and unsupervised autonomy are switched off until the human opens the gate, and opening it is itself a signed receipt.