A working prototype that asks one question: if Neuron becomes the system of operational intelligence,
how should that intelligence pass between people? Between shifts, and between the model and
the operator who is accountable for what it recommends.
The shift starts here. So what actually happens at that moment?
Teserac's Command Center says the shift starts here. Inside that sentence is a human problem that
mission critical infrastructure cannot avoid: at 19:00 an operator goes home and another one takes
responsibility for the building. What changed in the last twelve hours? What was investigated and
deliberately left open? What must the incoming operator not touch, because someone already decided
otherwise and had a reason?
Neuron already holds the raw ingredients. Telemetry, topology, incidents, procedures, history, and
the decisions operators make. The gap is not data. It is that most systems preserve what
happened and lose why a person chose what they chose. Teserac's own positioning names
a shrinking skilled workforce as a core industry problem. Capturing resolved tickets for future
search is one answer. This prototype proposes a stronger one.
Do not only preserve knowledge for later search. Put the right knowledge into the exact moment
responsibility changes hands.
The product thesis this prototype exists to test
The same idea extends to the model. When Neuron recommends something consequential, the operator is
the one accountable. So the recommendation, the decision, and the reasoning behind the decision all
belong in the same record that the next shift inherits.
The loop the prototype closes. The AI proposes, the human disposes, and the disposal is what
gets inherited.
Who it is for
The operator who takes control at 19:00
Not the facility. Not the fleet. One person, at one moment, with a building to answer for.
The organization buying this runs mission critical facilities around the clock. Colocation
providers, hyperscale operators, and enterprises with their own data halls. What they sell is
uptime, and uptime is defended by a small team that is physically present twenty four hours a day.
The user is one of those people, and specifically the one arriving rather than the one
leaving. Every design decision in this prototype was made for them.
The role
Critical facilities technician, shift engineer, or data center operations engineer. The title moves around by operator; the accountability does not.
Where they came from
Often a trade or a military route. Electricians, HVAC technicians, and Navy trained power plant operators are all common paths into the seat.
The rhythm
Twelve hour shifts on rotation. Handover happens twice a day, every day, permanently. It is the most repeated moment in the entire operation.
Answerable for
Uptime, safe switching, executing approved procedures, and knowing the moment something needs to go up the chain.
Tools they live in
A building management system, an electrical power monitoring system, a work order system, and a shift log that is frequently a notebook or a spreadsheet.
The pressure
The deepest experience in the room is retiring. The people replacing it have a fraction of the years, and the knowledge that is leaving was never written down.
What actually makes the handoff hard
Three things, and only one of them is a data problem.
The window is short. A handover is fifteen to thirty minutes, often less, and it competes with everything else happening at the top of a shift. Nobody reads a twelve hour history.
The valuable information is the negative space. The outgoing operator knows what they looked at and deliberately chose to leave alone. That set is invisible to everyone else, and it never survives a verbal handover.
The costliest mistake is undoing a decision. Not missing an alarm. Touching something a colleague deliberately left in place, without knowing they had a reason, is how a stable situation becomes an incident.
That third point is why the decision record has a why field and a who field, and
why deferring a recommendation forces you to name the trigger that brings it back. The format is
not a documentation exercise. It is the specific shape of the failure it prevents.
Who else is in frame
The outgoing operator produces the record but never reads it. They are the least served person in this prototype, and closing that gap is the first thing I would build.
The chief engineer or facility manager would want the decision history as an audit trail, particularly after an incident. The data model supports it; no view has been built for it.
The new operator is who the learning layer serves. They are deliberately not the core user, which is exactly why that layer is separable and switched off by default.
What I do not know about them
This profile is built from public material and reasoning. I have not interviewed a single
operator, so it should be read as a stated hypothesis rather than a finding.
Whether six fields is the right shape for a decision record, or whether an operator under time pressure would fill in two and leave the rest.
Whether the handoff moment is genuinely felt as a problem, or whether the existing verbal ritual works better than it looks from outside.
Whether "what you need to do" is welcome, or reads as a previous shift telling a peer how to do their job.
Each of those is answerable in one conversation with one operator, which is why that sits at the
top of what comes next.
What is built
One workflow, end to end
Not a suite of screens. A single path an operator would actually walk at the top of a shift.
Shift Brief
Opens on load. Three inherited items, each carrying a six field decision record: what changed,
what we know, what was decided, why, who decided, and what you need to do. Plus a diff of what
changed since the handoff, typed as New, Changed, Resolved, and No change.
Power path canvas
An electrical single line from the utility feed to the racks. Draggable, with persisted layout
and a reset. Assets that owe a decision are marked, and pinned cards anchor to the asset they
concern.
Ask
Questions Neuron already answered for the selected asset, so there is no prompt to compose.
Every answer cites assets by name. Two of the questions are computed from the topology rather
than written by hand.
Impact
What a failure of this asset would do right now, split into what loses power and what a
redundant path still holds, drawn onto the graph. Computed from the topology, not authored.
Decision layer
A recommendation, a visible autonomy ladder, and four ways to respond. Friction scales with how
hard the action is to undo. The result pins to the canvas and joins the shift brief.
Learning layer
An onboarding overlay in its own color, off by default. Definitions, a glossary for the
acronyms on screen, and an optional self test.
Position
Chat is the right fallback and the wrong default
The most directly relevant opinion I can offer, given where the product has already been.
Neuron started as a chat interface and moved away from it. I think the reason is specific and worth
naming. A chat box asks the operator to supply the question at the exact moment they have the least
time and the least certainty about what to ask. And a chat answer is a dead end. It does not attach
to an asset, it does not persist, and the next shift cannot inherit it.
The replacement is not a different text box. It is three rules, and every AI surface in this
prototype follows them.
The AI attaches to objects, not to a conversation. Selecting an asset is the query. The panel is scoped to that asset and nothing else.
Its output is interface state, not prose. The Impact view answers "what happens if this fails" by drawing on the graph. That answer cannot be given well in a chat window, which is the point.
Anything accepted or overridden becomes part of the record. That is what makes AI reasoning inheritable rather than disposable.
What chat is genuinely good at is the open ended question nobody anticipated. That is a real
strength, and it is why the position is "wrong default" rather than "wrong idea". A command bar
that takes natural language and returns a reconfigured interface, rather than a paragraph, would
keep that strength without the weaknesses. I scoped it out and did not build it.
Design decisions
The calls, and what each one is arguing against
Autonomy is shown, not implied
Every recommendation displays three tiers: what Neuron does alone, what needs approval, and what
it must never touch. On the load transfer, "initiate the transfer" and "place the unit in bypass"
are both rendered struck through.
Why
A promise about behavior is more reassuring than a confidence score. Confidence says how sure the model is. The ladder says what it is allowed to do, which is the thing an operator actually needs to trust.
Friction scales with reversibility
Raising an alert threshold is one click, and the dialog says so. Transferring critical load
requires four pre flight steps acknowledged and the asset name typed back before the button
unlocks.
Why
A one click approve on a consequential action invites rubber stamping. Effort should be proportional to what the action costs to undo, which is how methods of procedure already work in this industry.
Approve and Reject is the wrong pair
The choices are Approve, Defer with a trigger, Approve with changes, and Reject. Deferring
requires naming the condition that would bring it back. Rejecting or modifying requires a reason.
Why
In operations the most common correct answer is neither approve nor reject. It is "not yet, and here is what would change my mind." Deferring with a trigger is what produces a line like "reassess if runtime falls below 6.0 minutes", which is the most useful sentence in the whole handoff.
And
An override is the most valuable event in the system. It is an experienced operator disagreeing with the model, which is exactly the expertise the industry is losing. Most tools only log approvals. This one requires the reason.
The learning layer is not the product
An earlier version of this prototype taught the domain inside the operator tool, with the same
knowledge check attached to every asset. That was wrong. Real operators know what a power
distribution unit is. The teaching material is now a separate overlay in its own color, off by
default.
Why
I am not the user. Building my own onboarding scaffolding into the operator's tool would have made the product worse to serve the designer. Separating it lets the app open looking like something a professional would use, and lets me switch my own training wheels on when I need them.
Canvas widgets anchor to assets
A pinned card attaches to the asset it concerns, travels with it when the node moves,
counter scales so its text stays legible at any zoom, and collapses to a pill when zoomed out.
Why
A widget that floats free is a dashboard tile that happens to sit on a canvas, and it gets nothing from the spatial layout. Anchoring makes the topology the organizing principle.
Extension
The natural next step is that the pinned arrangement travels in the handoff. Widgets become the operator's working memory, and working memory should be inheritable.
Color semantics
One meaning per color
Amber was carrying two jobs badly. Splitting them was the highest value small change in the build.
Green: nothing to see
Healthy equipment, and decisions that have been made and closed.
Amber: the equipment has a condition
A state of the world. Something is drifting or loaded, and it is worth watching.
Red: a human owes a decision
A state of the work, not the plant. The asset pulses and says "Needs your review" on the card. Deciding clears it.
The proof case is Rack R-42. It sits at 92 percent of its power budget,
so it stays amber for the whole walkthrough. Nobody owes a decision on it. Meanwhile
UPS-A1 and SWGR-A are red, because a
recommendation is sitting there undecided.
The result is that the canvas shows where human judgment is outstanding, not just where the plant
is unhappy. Both counts appear in the toolbar, and the red survives at fit to view zoom and in the
minimap. Deciding both recommendations turns every red outline green by the end of the demo.
Technical decisions
Where the engineering actually went
Stack is React 19, TypeScript, Vite, and React Flow. The interesting parts are not the stack.
The graph nodes were lying about being draggable
The first version rendered nodes that looked draggable and were not. React Flow only writes a
position change back to its own store when you use its uncontrolled mode. In controlled mode it
hands the change to your callback, and this app passed nodes with no callback, so every drag was
computed and discarded.
Method
Found it by reading the library's own triggerNodeChanges source rather than guessing, then confirmed it in the browser by dragging a node 86 pixels and measuring that it had not moved.
Principle
Never ship an affordance you cannot honour. The fix belonged at the state layer, not on the surface.
Impact is computed, not written
The failure preview removes the selected asset from the graph and re runs reachability from the
utility source. Anything that becomes unreachable loses power. Anything downstream that is still
reachable is held by a redundant path.
Result
Failing UPS-A1 drops nothing, because the B path still feeds the same distribution unit. Failing PDU-05 drops two racks with nothing covering them. Neither number is authored, so the model stays honest if the topology changes.
Widgets render through the viewport, not as graph nodes
Pinned cards could have been added as React Flow nodes with a parent relationship. Instead they
render through the viewport portal and position themselves from their anchor's coordinates.
Why
Adding a second node type would have widened the node union across selection, persistence, drag handling, and the impact overlay, for no gain. The portal keeps widgets out of that system entirely while still panning and zooming with the canvas.
Detail
Drag converts screen pixels to graph coordinates by dividing by the zoom level, and uses a four pixel threshold so a click on a collapsed pill still selects its asset instead of being swallowed by the drag handler.
A production bug that would have broken the demo
The deployment config rewrote every unmatched path to the app shell. So a request for an asset
that no longer existed returned 200 with an HTML body instead of a 404. During a deploy rollover
a cached page asked for an asset hash that had already rolled, the browser refused the response
on its content type, and the app rendered nothing.
Fix
Assets are excluded from the rewrite so a missing one returns a real 404. Hashed assets are marked immutable and the entry document revalidates, so a stale page is never served against fresh assets.
Caught by
Loading the deployed URL in a browser and reading the console, not by trusting that a green build meant a working site.
Persistence had a dependency that was easy to miss
Persisting pinned widgets required persisting decisions too. A restored decision card with no
decision behind it would render empty. Orphans are dropped on load, and stored entries are
validated against known asset ids before use.
Consequence
Because decisions now survive a reload, a demo could get stuck in a used state. So there is a control that clears pins and decisions and returns every recommendation to its untouched state.
Accessibility, done as part of the work
Graph nodes are keyboard selectable with a visible focus ring, and Enter or Space updates the
panel. The asset tabs follow the standard pattern, so only the active tab is in the tab order and
arrow keys move between them. Dialogs trap focus and return it on close. Quiz feedback is
announced through a live region. Motion respects the reduced motion preference.
What comes next
Where I would take this
In order. The first item is not a feature.
Put it in front of one real operator before adding anything. The decision record has six fields because six felt right to me, not because anyone who runs a facility told me so. That is the assumption most worth breaking early.
An authoring flow for the outgoing operator. Today the handoff is read only. The real design problem is the hard one: how do you get a tired operator at 18:55 to write one honest sentence explaining why? Everything downstream depends on solving that.
A decision timeline. Scrub from the first anomaly to the current moment and watch model confidence and human decisions move together. It makes the relationship between evidence arriving and judgment changing visible.
Challenge this assessment. Show supporting evidence, contradicting evidence, and missing evidence for a recommendation, then let the operator ask what would make the diagnosis wrong. Trust needs a way to argue back.
Widget layouts that travel in the handoff. Inherit the previous operator's arrangement, not only their notes.
Progressive node detail by zoom. At fit to view on a laptop the asset names are small. Detail should resolve as you zoom rather than being fixed.
Deliberate limits
What this is not
Every value is simulated. Names, times, thresholds, and procedures are fictional, and the interface says so in three places rather than hiding it.
No model is called. The reasoning and the confidence figures are written, and labeled as illustrative wherever they appear.
Generators are not modeled. So a utility failure shows everything dropping. The impact panel states this rather than quietly implying the site has no backup.
Domain assumptions are flagged in the interface, on the assets where I was least confident, so an expert can correct me instead of guessing what I assumed.
No authentication, no server, no real telemetry. Persistence is the browser's local storage only.
I do not claim to know data center operations. I claim to have learned enough to build something an expert can correct, and to have marked exactly where the corrections should go.
Exploration
Can someone without expertise save the building?
An open question, explored rather than answered. Nothing below is built.
If a facility were minutes from going down, and the only person on site was the newest
member of the team, could an intelligence layer carry them? Or is software of this kind
permanently reserved for people who already hold the expertise?
The question is not specific to data centers. The same shift is running through tax
preparation, investing, software, and medicine: expertise is scarce, software is cheap, and
capability keeps moving toward people with less training. Physical AI is doing the same thing
to machines. It is worth asking directly whether critical facilities are part of that trend or
an exception to it.
My reading is that the question is badly posed, and that fixing the framing produces a more
useful answer than arguing about the original.
The question is really four questions
Any operational act contains four capabilities. Expertise is not spread evenly across them, and
software does not move them equally. Treating them as one thing is what makes the debate
circular.
Detection
Transfers
Noticing that something is wrong. A newcomer with instrumentation detects better than an
expert without it. Neuron already does this, and it is the least interesting part of the
question.
Diagnosis
Transfers
Knowing what is wrong and why. This holds for failures the system has a model of. It breaks
on compound and novel failures, which are the ones that take buildings down.
Decision
Partly
Choosing what to do. The deciding input is often something the system cannot see. A
technician is already inside the cabinet. A customer migration runs tonight. The same move
tripped something two rooms away last year.
Execution
Does not
Performing the act. This is not a software limit and no interface will move it. Arc flash
injures and kills. Qualified-person rules, lockout-tagout, and protective equipment exist
because people died establishing that they were necessary.
So the honest answer is split. Detection and diagnosis transfer now. Decision transfers under
conditions. Execution does not transfer at all, and should not. Any pitch that skips this
distinction will not survive a conversation with someone who has stood in front of an energized
switchboard.
What other fields already learned
Four software cases, ordered by how completely the transfer worked.
Tax preparation. The rules are finite and already written down. An error is amendable and the consequence arrives months later. The transfer was close to total.
Automated investing. Allocation rules encode well. Consequences are delayed and spread across a portfolio. The transfer worked inside guardrails that regulators set.
Code assistants. Version control makes almost every mistake reversible in seconds. That property, not model quality, is why this field moved fastest.
Clinical decision support. Where the pattern breaks. Alerts fire constantly, staff learn to dismiss them, and the signal is lost inside the noise. Being correct is not sufficient. The system has to be correct at a rate that sustains attention.
Physical AI has run the same experiment on machines, and the results are sharper.
Consumer drones. The strongest case. Stabilization, geofencing, and return-to-home removed the failure modes instead of training the pilot. A beginner flies competently on day one because the dangerous states are unreachable, not because they learned to avoid them.
Driver assistance. The instructive failure. Conditional automation, where the vehicle drives and hands control back on request, concentrates the danger in the handback. The human is least practiced at the moment the situation is hardest. Several manufacturers skipped that level rather than solve it.
Surgical robotics. A counter-example worth holding onto. It amplifies a trained surgeon and lowers no training requirement at all. Some physical AI raises the ceiling instead of the floor.
Collaborative robots. Safety comes from physics rather than procedure. Force and speed limits make the machine safe next to an untrained person without that person knowing anything about it.
The driver assistance case is the one that should worry anyone building this, because
Neuron's approval gate is a handback. The system carries the situation, then stops and
asks a human to take control at the least convenient moment. That is the exact shape that has
proven hardest to make safe in vehicles.
The variable that predicts whether it works
Across every case above, one pair of properties predicts the outcome: how reversible the mistake
is, and how quickly the consequence arrives. Tax errors are reversible and slow, so the transfer
was total. Defibrillation is irreversible and immediate, so the scope was cut to almost nothing
and the remaining act was made impossible to get wrong.
Hand capability downward in proportion to reversibility.
This prototype already applies that rule to actions: raising an alert threshold is one click,
transferring critical load requires every pre-flight step acknowledged and the asset name typed
back. Extending it to people is the same rule with a second input. The gate becomes a function
of the action and of who is holding it.
The counter-effect that rarely gets priced in
Lisanne Bainbridge described this in 1983, in a paper called Ironies of Automation. The
more a system automates, the more the remaining human role shrinks to exactly the situations the
automation could not handle. Those are the hardest situations. And the human now has far less
practice, because the routine work that built their intuition has been absorbed.
Air France 447 is the reference case. The autopilot disengaged after the airspeed sensors iced,
and the crew's manual handling had degraded. Three Mile Island is the older one: the information
was present and presented so poorly that trained operators reached the wrong conclusion.
Applied here, the risk is direct. If Neuron absorbs everything routine, it may produce operators
who never build the pattern library that made the retiring generation valuable.
A tool aimed at the expertise shortage can deepen it. That is a real tension in
this product, not a rhetorical one.
Where I think this lands
In an actual emergency, the newest person's realistic contribution is almost never executing the
fix. It is three things: do not make it worse, buy time, and get the right human there faster
with better context.
The third one is where software changes the outcome, and this prototype already contains the
artifact for it. The decision record is a handoff pointed forward in time. Pointed sideways it
becomes an escalation packet: what changed, what I saw, what I already tried, what I did not
touch and why. The expert arrives with seconds of ramp-up instead of twenty minutes.
That reframes the goal from novice as hero, which is not credible, to novice as competent first
responder, which is. It is the defibrillator pattern. Narrow the scope until the remaining
decision is one an untrained person can make correctly, make the harmful path unavailable rather
than discouraged, and keep the human for the part the machine cannot do.
What I would want to test
Each of these is falsifiable, which is the point of writing them down rather than asserting a
conclusion.
Whether a junior operator handed a bounded set of pre-authorized reversible actions performs better than one handed the full interface, or freezes because the boundary itself reads as a warning.
Whether an escalation packet measurably shortens an expert's ramp-up time, and whether experts trust a packet assembled by someone they consider unqualified.
Whether authority that widens during an emergency, the way it does during a hospital code, is acceptable to the people who carry the liability.
Whether operators who work alongside a system like this retain diagnostic skill over a year, or lose it. This is the one that needs longitudinal data and the one nobody funds.
The deeper question sits underneath all four. Does an intelligence layer raise the floor, or
lower the ceiling? Raising the floor is the pitch. Lowering the ceiling is the risk: experts
atrophy, and the system's model quietly becomes the limit of what anyone thinks to consider.
Designing for the floor without capping the ceiling means the expert must always be able to
see past the recommendation, into the raw signals, the rejected hypotheses, and the
assumptions. Which turns the challenge surface from a refinement into a requirement.
Process
How it was built
I built this with an AI pair. I wrote the plans and the acceptance criteria, gated each phase
before the next one started, inspected every result in a real browser, and made every product and
design call. The AI wrote most of the code under those criteria.
I mention it because it is how the work actually happened, and because the interesting artifact is
not the code. It is the sequence of decisions: what to build, in what order, what to refuse, and
which of my own earlier choices to throw away. The quiz attached to every asset and the free
floating learning panel were both mine, and both were wrong, and cutting them made the product
better.
Verification was browser first throughout. A passing type check and a green build tell you the code
compiles. They do not tell you a node can be dragged, that a gate actually blocks, or that the
deployed site renders. Each of those was checked by driving the real interface and measuring the
result.
The repository README carries a walkthrough written for a live demo, a code map, and the same
positions stated for a reader rather than a viewer. Source is at
github.com/trulou1028/neuron-shift.