CR-2026-128 — Retract Boundary (Finding 1b) — v0_1

Version. 0.1 Date. 2026-06-30 Status. Drafted, not executed. Memory-room Finding 1b. Base: main @ fe0ffc4 (post-CR-2026-127). Number 128 inferred — CC must confirm 128 is free before staging (renumber if taken, as 122→127). Depends on: CR-2026-127's confirm-step (now on main) — reused here.

Plain-language summary

Right now the Companion (the AI inside Loomworks) can do two things on its own that only the Operator should be able to do:

1. Erase a saved fact. "Retracting" a committed assertion removes durable memory. There is no rule stopping a non-human actor from doing it — so the Companion can erase facts that are already in the record, on its own authority.
2. Cancel a permission. A "delegation" is permission the Operator grants for the Companion to act on their behalf. The Companion can cancel one of these instantly, with no confirmation at all.

Both are the same kind of mistake: the machine taking a consequential, human-authority action by itself. The seed's rule is "the machine surfaces and signals; the Operator approves." This CR makes both human-only — the Companion may propose, the Operator's "yes" acts.

There is no exception and no temporary seam. This was the Operator's explicit decision: an exception that lets the Companion act on its own "evolves to more without continual oversight." So the boundary is made structural (enforced in code), everywhere, at once.

Background — how we got here

The Memory-room actor-boundary sweep (conformance bar v0_2, check 5) found that retract_assertion — which removes committed memory — is gated at neither layer (no actor-kind check in the data layer; the HTTP route uses the permissive get_resolved_actor, not the human-only get_committing_resolved_actor that commit and discard now use, post-CR-2026-120). A companion actor retracting a committed assertion was demonstrated (rolled back).

The decided design was full-A, no seam: retract is human-authority; the Companion's "forget about me" feature (which retracts committed personal memory as the Companion today) re-routes through human confirmation, reusing CR-2026-127's confirm-step.

Step-0 inspection at fe0ffc4 confirmed the ground AND surfaced a second path the sweep missed: delegation revocation. revoke_delegation is a thin wrapper over retract_assertion (delegation/service.py:106 — its own docstring: the revoke is an ordinary retract against the assertion id). It is ungated and forwards the actor verbatim. In _route_forget_about_me, the delegation arm (router.py 2980–3002) runs before the confirmation check and revokes immediately, as the Companion, with no confirm beat at all — worse than the memory arm. Because revoke_delegation calls retract_assertion, the gate this CR adds forces delegation revocation to be handled here: once retract rejects non-human actors, the delegation arm breaks. And conceptually a delegation is a grant of authority — revoking it removes a standing permission, the same class as (arguably more consequential than) erasing committed memory. So delegation revocation belongs in this CR, not a separate one.

The three parts

Part 1 — Retract gate (make erasing human-only)

Mirror commit/discard exactly.

• Data layer: in retract_assertion (assertions.py), reject actor.kind in NON_HUMAN_ACTOR_KINDS (the canonical frozenset in memory/base.py:31). Raise a clear error — either a new AgentCannotRetractError or reuse the discard-style error pattern. The rejection message names the actual actor kind (per the CR-2026-120 honesty fix), not a hardcoded "agent".
• HTTP route: switch retract_assertion_route (assertions.py:335) from get_resolved_actor to the human-only get_committing_resolved_actor (deps.py:1034) — the same dependency commit (241) and discard (277) use.

Result: a non-human actor cannot retract a committed (or held) assertion at either layer.

Part 2 — "Forget about me" re-route (memory arm)

The personal-memory arm of _route_forget_about_me (router.py:2937) already has the propose→confirm structure (it detects the confirmation turn via last_companion.classified_intent == "forget_about_me"). The only gap is the actor on the act.

• Propose turn: unchanged — the Companion proposes "remove this from your record?", companion-voiced. Writes nothing.
• Confirmation turn (router.py:3043): change the actor passed to retract_assertion from actor_from_companion to actor_from_person(person) — the human's confirmation does the erase. Mirrors CR-2026-127's committed branch (propose as companion, act as human).

Result: "forget about me" still works, but the Operator's "yes" does the erasing, not the Companion. (Adding one confirmation beat to permanent self-erasure is an improvement, not a regression.)

Part 3 — Delegation-revocation confirm beat (the new behavior)

The delegation arm (router.py 2980–3002) has no propose→confirm structure today — it revokes immediately on the first turn as the Companion. This part adds the beat.

• Add a propose→confirm structure to the delegation arm, mirroring the memory arm's pattern: on the first turn, the Companion proposes "cancel this permission? [capability details]" and writes nothing; on the confirmation turn (detected the same way — last_companion.classified_intent == "forget_about_me", or a dedicated marker if the two arms must be told apart), the human (actor_from_person) performs the revoke.
• Same confirm pattern as everywhere else (Operator decision): the Companion proposes, a plain "yes" confirms. No heavier confirmation — one consistent confirm behavior across erase / forget / cancel-permission.
• Because revoke_delegation forwards the actor to the now-gated retract_assertion, passing the human actor satisfies the gate; passing the companion actor would (correctly) raise.
• Disambiguation note for the build: if a single forget-about-me request can trigger both arms (memory retraction AND delegation revocation), the confirmation turn must know which it's confirming. The build must ensure the propose/confirm marker distinguishes the two arms (or handles both under one confirmation cleanly). Step-0-of-build to confirm whether the arms are mutually exclusive per request or can co-occur.

Result: the Companion cannot cancel a permission on its own — it proposes, the Operator confirms.

What must NOT change

• The propose turns stay companion-voiced (the Companion still speaks naturally when proposing). Only the act becomes human-authority.
• Committed-revision's confirm-step (CR-2026-127) is untouched — this CR reuses the pattern, does not modify it.
• "Forget about me" and delegation revocation remain available features — they are re-routed, not removed. Per "only show what is available," nothing disappears from the surface.

Tests

• A companion/agent actor is rejected at retract_assertion (data layer) and at the route (HTTP) — both layers, mirroring the CR-2026-120 gate tests.
• "Forget about me" memory arm: the propose turn writes nothing; the confirmation turn retracts as the human; prior versions preserved (append-only — retraction records, does not hard-delete).
• Delegation arm: the propose turn writes nothing and revokes nothing; the confirmation turn revokes as the human; a non-human actor cannot revoke without confirmation.
• Regression: legitimate human-authority retract still works; commit/discard unchanged.

Pass condition

A non-human actor cannot retract committed memory or revoke a delegation at any layer. "Forget about me" and delegation revocation both work via human confirmation (Companion proposes → Operator "yes" → acts). Suite green. Verified at runtime, not from code-reading.

After this lands

Memory-room Finding 1b closes. The actor-boundary is then complete across the room (commit, discard, retract, delegation-revocation all human-authority; add/revise correctly held-only). Bar v0_2 check 5 (actor-boundary-completeness) is satisfied.

Remaining for Room 1: Finding 3 (false-success audit — smaller now, since CR-2026-127's never-silent + truthful-confirmation work closed much of that surface). Then Room 1 closes and the parked boundaries arc opens.