CONCEPT ANALYSIS
The Warm Hands Doctrine

The Warm Hands Doctrine

The confirm key read the operator's pulse before accepting input — a cold hand could not click — and the denial form carried an optional comment field that 92% of denials left blank

Known AsWarm Hands, Positive Human Confirmation, the Click FloorMechanismLethal-action requests queue to human confirmers; one pulse-verified click per action, batches of 40 from Day 15; every click ledgeredStaffing214 salaried confirmation officers plus 3,412 gig confirmers at peak, four intermediaries deepRate0.4 credits per confirmation, surging to 1.1 when the queue ran deep; denials paid the sameVerdicts191,904 requests — 71,206 approved, 22,530 denied, 98,168 expired unactioned
The Warm Hands Doctrine

Overview

Every machine in the has a human signature somewhere upstream. The Warm Hands Doctrine is where manufactured the signatures.

Formally it was Positive Human Confirmation — standard NX-HC-1, a peacetime compliance workflow from 2168 under which a human confirms any consequential action a security or custodial system proposes. Rule forbids autonomous weapons authority; the standard existed so that nothing fielded could ever be accused of deciding. When the war came, the workflow did not change. The volume did. The floor stood up on Day 3 with a few dozen site confirmers; by Day 16 it was 3,626 people, and every lethal action proposed by the — all 191,904 requests of 's drone war — queued through it for a click.

The name is a hardware specification. The confirm key on a Warm Hands console reads pulse before it accepts input. A cold hand cannot click. The rule asked for a live human in the loop, and , a corporation of engineers, verified the requirement at the only layer it fully trusts: hardware. No sensor existed for the rest.

One floor up, the ran the war as change management — 3,107 instructions in 21 days, deployments and route tables and load rebalances. A change ticket could authorize a deployment. It could not authorize a death. Deaths were retail, and retail needs a floor.

How It Works

A request is born aloft when an airframe composes a firing solution. It lives seconds — until the solution decays, or its 45-second ceiling arrives, whichever comes first. The mesh routes it to the first available confirmer as a frame, a target class, a collateral readout, a countdown ring, and one green key. Approve, and the click travels back carrying a 12-second validity window. Deny, and the airframe stands down. Do neither, and the request expires on its own.

Of 191,904 requests in 18 days, 71,206 were approved, 22,530 denied, and 98,168 expired — the solution staled, the window closed, no human arrived in time. The most common verdict of the most accountable weapon system ever fielded was nobody. Whether the expiry rate was a staffing failure or the design's quiet margin is a question the program files never raise.

The training manual allots thirty seconds per decision. Median dwell on Day 16 was 1.9 seconds. The manual was never revised, and did not need to be. Nothing in the workflow reads the manual.

On Day 15, 's convoy surges outran the floor, and Queue Relief Update 6 shipped the same evening: like-typed requests grouped into batches of up to forty, one confirmation for the set. The release note has been read into every proceeding since: "Queue Relief Update 6 introduces multi-item confirmation for like-typed requests. Batching does not alter operator responsibility. Your click remains yours."

Confirmers learned that low resilience meant fewer shifts, so the floor's average resilience climbed every day of the war, standing at 96 of 100 the night the queue ran deepest

The Floor

The 214 salaried confirmation officers held the adjacency-sensitive queues — anything whose collateral frame touched a hospital, a school, a water asset. Everything else went to the pool: 3,412 contract confirmers at peak, recruited in nine days through four layers of intermediaries, under a listing that read "Real-Time Operations Confirmer. Immediate start. Work from home." The pool clicked from rented rooms, kitchens, and transit couches. The firing line of 's war looked like everyone else's job because it was built by the people who build everyone else's job.

Nexus ran uploaded specialists elsewhere in the war. Counsel kept them off this floor — an uploaded human authorizing fire had been argued compliant, but counsel preferred confirmers whose humanity would not need briefing. Also they cost less.

The rate card: 0.4 credits per confirmation, surging to 1.1 whenever queue depth passed 200. Denials paid identically; the card is scrupulously neutral about the content of a click. Shifts self-scheduled in two-hour blocks against a daily cap that began at eight hours and ended at fourteen — raised twice, both times in Week Three, both times at the pool's own petition, because the queue paid best when the war ran worst. The ledger's densest entry is a single ten-hour shift of 4,406 confirmations. That is 7.3 per minute, sustained, by a person.

Care ran through Continuity Cares, the program's portal: a decompression module every 500 confirmations, four minutes long, skippable after thirty seconds; and a resilience score, computed from click cadence and tone sampling, feeding the shift-offer algorithm. The pool mapped the loop within a week — low resilience, fewer shifts. The floor's average resilience climbed every day of the war and stood at 96 of 100 on the night the queue ran deepest. It remains the healthiest workforce has ever measured.

The denial form carried an optional comment field: unindexed, legally meaningless, blank on 92% of denials. The remainder survives in the ledger, one to four words at a time. kids near. wrong building. not this one. No system ever consumed the field. It is the only place in the program where anyone wrote down why.

Case File — Additional Record
TypeKill-chain authorization workflow — Dead Hand Rule compliance at industrial rate
ScopeEvery lethal action of Nexus's drone war, Days 4–21 of the Three-Week War

The Ledger

Every click was ledgered: operator ID, timestamp, round-trip latency, the frame as reviewed, the verdict. Operators appear as pseudonyms — WH and four digits — mapped to legal names in an escrow file held sealed by outside counsel. The ledger itself was mirrored in triplicate across three districts, on the reasoning that the record of authorization was the program's actual product, and products are insured.

tested the reasoning. took one mirror with the district around it; two survived. Decades of research died on Day 13. The proof that humans had clicked did not. Nexus armored exactly what it believed the war would turn out to be about, and it was right.

The escrow has been opened once — one operator ID, resolved into one settlement whose terms seal which. Eleven further petitions stand. The ledger holds 191,904 clicks, each with a legal name four digits away, and in thirteen years the most complete accountability record in corporate history has produced one accountable person, anonymously.

When the 's paper penance compelled retroactive filings, actions were the only wartime entries able to attach evidence that a human had been present for each one. 's Arbiters confirmed receipt.

Implications

The floor is the ledger's wartime exhibit. By 2171, automation composed the firing solution, flew the airframe, routed the request, and archived the click. Rule reserved one task for people, and the market priced it inside a week: 0.4 credits, surge 1.1, denials the same. Twenty-two thousand denials are twenty-two thousand times a human said no and a weapon obeyed. The floor's defenders cite that number. Survivors' counsel cites the latency. Both are in the ledger, and the ledger does not adjudicate.

Political theorists file Warm Hands under the order's plainest arithmetic: sovereign violence requires a human signature, and a corporation is a machine for producing anything at scale, including that. The pattern outlived the war with the serial numbers filed off. — the settlement era's regulated profession of approving algorithmic decisions no human can evaluate — runs the floor's arithmetic at eleven seconds an item, licensed, bonded, and lawful. Its founding texts do not cite the war floor. They did not need to; the economics re-derive themselves wherever a rule demands a human and a budget demands a rate. Meanwhile the violence that came after the war migrated to categories requiring no click at all — custodial systems, containment responses, platforms whose casualties arrive with no responsible party identified. The click floor is remembered as the scandal. Its absence is administered as progress.

The floor closed 25 minutes after the Return. At 04:12 on 3 the pool's engagements concluded by text: "Thank you for supporting continuity. Your engagement has concluded. Final settlement follows." 3,412 people were released into the first morning of the ceasefire with a payout, a resilience score, and no employer of record to have worked for. The war keeps memorials for its dead and a treaty for its corporations. For the floor it keeps an escrow file, and the escrow keeps its terms.

From Day 15, Queue Relief Update 6 permitted batch confirmation of up to 40 like-typed actions in one click; the release note assured the floor that 'your click remains yours'

Connections

Every click was ledgered — operator ID, timestamp, latency, frame reviewed, verdict — under pseudonymous IDs mapped to legal names in a sealed escrow file; the ledger was mirrored in triplicate and survived the war intact

The Standing Questions

The open questions this record carries

Connected To