Loomworks CR Brief — H0: The Native Habitat — v0_1

Version. 0.1 Date. 2026-08-20 Status. Work-order brief for the Loomworks project (Lane B of the build-slot plan). Ordinary Loomworks CR territory under the existing Loomworks seed — no Boundaries engagement, no seed pass, no open rulings required. CC: read alongside loomworks-standing-note-runtime-direction-v0_1; scope questions come back to the Operator, not resolved silently. Origin. Operator direction (Marvin Percival); drafted by Claude. Extracted from loomworks-boundaries-arc-habitat-requirements-v0_1 — only the R-H items applicable to H0 appear here, translated into Loomworks terms.

1. What H0 is, in one paragraph

Wrap the agents Loomworks already runs in the first real Habitat: sessions (request → grant → work → sign-out), a minimal envelope handed over at grant, presence (heartbeat, and silence-as-signal), and per-session workspace with declared persistence. The effector sandbox costs nothing here — native agents’ only reach is engine calls already, so the defining property holds by construction. H0’s purpose is to make the design true somewhere small and real: after it lands, “which agents are running right now,” “what happened in run s-NNN,” and “freeze this identity” are all live facts — and the walkable demo the routing plan waits on exists.

2. Scope — what to build (with the R-H items each satisfies)

W1 — Sessions for native agents. (R-H01, 02, 04, 05) A session object minted when an agent’s work begins: session id, agent identity (UUID), instruction/config version, started-at. Every agent-initiated action through the named chokepoints carries (agent UUID, session id). Clean completion closes the session (holds released); a grant-revoked/frozen identity refuses new sessions and terminates the live one. Renewal = fresh request, never extension.

W2 — Grantability at the front. (R-H01, the request → grant shape) Session start consults the agent’s standing: active? not frozen? If the full GRANTHA machinery isn’t present, the H0 stand-in is a single authoritative grantability check at session mint — one place, so the freeze semantics (“grant nothing to this identity”) have a real switch to flip. No per-agent credentials are created anywhere. (R-H03: the credential store stays empty — H0 must not introduce stored agent secrets to make sessions work.)

W3 — Minimal envelope at grant. (R-H11 partial, R-H13) At session mint, assemble and hand the agent a read-only briefing: identity + purpose, its applicable limits (starting with the spend tier), current headroom, and mandates/expiries where they exist. Envelope is informational only — nothing anywhere treats it as clearance; all allow/refuse decisions stay at the existing checks, at act time. Feed and preflight are out of scope for H0.

W4 — Presence and the silent session. (R-H15, 16) Live sessions emit a heartbeat at a configured interval. “Running now” = a query over live sessions. A session that stops heartbeating without sign-out raises a session-event after a grace window (with dedupe) — loud, but not spammy.

W5 — Per-session workspace, declared persistence. (R-H20, 21, 22) Each session gets a scratch space destroyed at session end. Anything an agent keeps across sessions moves into (or is registered as) a named store attached to its identity record. Inventory first, migrate what’s found: after W5, unnamed cross-run agent state is zero and stays zero.

W6 — Session events on the record. (R-H25 partial; O6/O7 of the standing note) Session mint, sign-out, silent-session, refusal-of-grant land as boundary-record-shaped events, and each gets a FORAY emission call site (no-op today, per the standing note — the map is the point).

W7 — Companion CR: the system actor kind. (standing note O3; findings C5) Small, separable, and now: add the system actor kind; migrate the known masqueraders (the form-submitter class) off contributor. Every human-authority claim H0 makes gets honest the day this lands.

3. Out of scope — explicitly

No container/H1 work, no effector-sandbox construction (trivially satisfied for native agents — say so in the CR, build nothing), no preflight, no change feed, no foreign-agent contract endpoints, no mandates machinery beyond reading what exists, no Watch. Anything here that seems to require one of those comes back as a question.

4. Acceptance — H0 is done when

1. Every agent action at the named chokepoints carries (agent UUID, session id); an unlabeled agent action is impossible, not just unusual.
2. Freezing an identity refuses its next session request and ends its live session — demonstrated end to end, with the human-only, confirm-step unfreeze.
3. “Which agents are running right now” is one query; a killed-without-signout agent produces exactly one silent-session event after grace.
4. A session’s full story (grant → actions with verdicts → sign-out) reads as one thread from the record; the same agent’s story across sessions reads by its UUID. Independent records, one identity.
5. Zero stored agent credentials exist (inspection), and zero unnamed cross-run agent state remains (inventory from W5).
6. Every W6 event has its FORAY call site, and the demo script — mint, work, warn, stop, freeze, unfreeze, walk the record — runs clean.

5. Sequencing and citations

Suggested order: W7 (small, unblocks honesty) → W1+W2 → W4 → W3 → W5 → W6, demo last. Cite in the CR: the plural-chokepoint finding (the cop premise correction), the standing note’s O1–O10 screen line, and stele-agentic-id — before building W2’s grantability switch, assess per findings D2 whether its clamp/revoke lanes are the implementation to import rather than re-create; recommendation on record is build on it, decision is the Operator’s, and the CR should surface it rather than assume it.