Version. 0.9
Date. 2026-08-02
Charter. standing-notes/dunin7-standing-authorization-charter-v0_1, ratified 2026-07-30.
Author. Claude Code (execution session). Operator: Marvin Percival.
Supersedes. v0.8 at record 1bfc9e5. v0.7 at 585742d, v0.6 at 38a7014, v0.5 at 32182bf, v0.4 at 1ec5c2a, v0.2 at 40571cf, v0.1 at 602bd9c stand as siblings. v0.3 remains deliberately absent.
Changes from v0.8. B-25 is done. CR-2026-161 merged and tagged, after halting once at v0.1 and resuming from v0.2. Two of the eleven sites were not defects and are struck. A third would have removed an authority boundary and is struck with a test now guarding it.
loomworks-engine)
main at a6a3ed6, tag authorship-truth-v0_1 at the same commit, both pushed and origin-verified. Previous main was e106917, unmoved since B-29.
Nine commits on cr-2026-161-authorship-truth, merged --no-ff:
| Commit | Step |
|---|---|
| 6a1bb13 | 0 — pre-flight and three determinations |
| 725ef21 | 1 — Group A, sites 5–9 use actor_from_person |
| 9e77632 | 2 — site 1; the legacy-path identity determination |
| 6a56413 | 3 — engagement scope honours an explicit null |
| 211c0f0 | 4 — per-person companion name |
| eb6968c | 5 — validate the escalation recipient |
| fae98d5 | 6 — assert_engagement_creator returns the principal |
| f052122 | 7 — authorship regression tests |
| feb0a25 | 8 — implementation notes |
Suite: 1 failed, 3459 passed, 68 skipped — the baseline failure set exactly (test_stele_router_mount, B-33, unrelated), with fifteen tests added. No failure outside the baseline set at any step.
loomworks-record)
| Commit | Subject |
|---|---|
| 230a8ea | B-25 Step 0 inspection brief |
| 1bfc9e5 | B-25 Step 0 findings + status brief v0.8 |
| a1e95f7 | CR-2026-161 v0.1 |
| c1094a9 | CR-2026-161 Step 2 halt report |
| 0f5d304 | CR-2026-161 v0.2 |
| this filing | status brief v0.9 |
Eleven sites. Nine corrected, two struck. Plus the compounding site and the escalation-recipient validation.
The largest block was the cheapest. Sites 5–9 were five hand-written ActorRef(kind="contributor", id=person.id, …) constructions on session-cookie routes — the identifier already correct, only the kind wrong. stele/actor.py already provided actor_from_person, and one of the affected files already imported it and called it correctly elsewhere. Five one-line replacements.
The legacy bearer-token path gets a documented sentinel rather than a fabricated identifier. wasAttributedTo is required, and on that path no identity resolves at all — not a person, and not a contributor either. The sentinel's kind was not a free choice: agent and companion sit in NON_HUMAN_ACTOR_KINDS, which the commit gates reject, so either would have revoked commit authority on records a human made. contributor falsifies nothing — the route is the bearer-token path. What is unknown is which human, which is what the fixed, documented identifier says. It stops being needed when no engagement row has a NULL creator.
seed_conversation.py:116 writes kind="agent" under a substrate-wide sentinel that cannot be person-bound. Kind companion structurally requires the person's own UUID, so writing it would have produced a genuinely false record.
Site 4 coalesces a fresh agent identity when the client names none — and the request schema declares that: "when omitted a fresh agent identity is allocated for the run."
This is what halted v0.1. Its remedy for site 4 — "write the agent the client named" — could not be applied, because the coalesce fires only when no agent was named. Nothing was being lost, so there was nothing to recover.
> The distinguishing test, and it is worth keeping. Site 4 and site 11 look identical — both a falsy or on a request field — and are opposites. At site 11 the engine's own comment states a contract the or cannot honour; at site 4 the schema states a contract the or does honour. Does the declared contract endorse the code, or contradict it? Site 11 was built; site 4 was struck. A sizing that reads only the construction and not the contract will mis-call both.
A real question remains at site 4 and it is not the one v0.1 asked: whether ephemeral agent identities — fabricated UUIDs naming no registered agent, stamped into the record — belong there at all. That is a change to a declared API contract and may reach past site 4. It becomes its own build-list item.
Site 10's kind-collapse is struck, and this is the finding of the arc.
The spoken door writes kind="companion"; the typed door writes kind="person". The sizing recorded the fix as "one of the two, consistently" — a consistency tidy-up, carried unexamined from the walk audit.
They record different acts. The spoken door's actor is attached to a held draft; the code switches to actor_from_person for the human act, under a comment stating "the Companion proposed, the Operator's 'yes' performs it" and "attributed to the human, not the Companion that drafted it."
And the difference is load-bearing. Two consumers use != "companion" as their test for whether an actor is human, and NON_HUMAN_ACTOR_KINDS = {"agent", "companion"} is what the commit gates reject. Collapsing the doors to person would have made the Companion's own draft committable as a human act — destroying the R-A3/R-B20 split while presenting as cosmetic.
The boundary had no test protecting it. It has three now.
The generalisable lesson: a kind change is an authority change. NON_HUMAN_ACTOR_KINDS turns any edit to an actor's kind into an edit to who may commit, and nothing at the construction site says so.
Two counts the CR carried were wrong. Neither changed what was built — both were matched by pattern, not by count — but both are the same class:
A specific supplied where none was required, and therefore none was verified. Neither finding needed a number at all.
D-2's validation broke three tests immediately, and the reason is worth recording: every existing escalation test built its recipient as a fabricated, unregistered actor. That is the habit B-25 exists to end, showing up in the tests meant to check it. Each now registers a real recipient; nothing was weakened to make them pass. One self-inflicted defect on the way — a registration helper that opened a transaction unconditionally and left the session mid-transaction — fixed by making it transaction-aware, not by loosening the assertion.
Nothing. All repositories pushed and origin-verified. No session in flight. The temporary live-verification file was removed after the checkpoint.
| # | Question | Default | Blocks | Proceeds regardless |
|---|---|---|---|---|
| Q-1 | B-16 — seed v0.13. Committing a seed version is an Operator act (F-3). | Commit as drafted once read. | Seed v0.13 only. | Everything. |
| Q-3 | The engine baseline is not zero. test_stele_router_mount 401. | Stays red and stays recorded. | Only a zero-failure gate. | Everything. |
| Q-10 | Do ephemeral agent identities belong in the record? Site 4 mints a fresh UUID naming no registered agent and stamps it on the summary and the event. Declared in the schema, so not a B-25 defect — but recognisably the B-25 class. Changing it changes a published API contract. | Open as its own build-list item; do not fold into another CR. | Nothing. | Everything. |
Q-5, Q-6, Q-7, Q-8 and Q-9 are all answered and removed — the escalation recipient is validated; seed_conversation.py:116 struck; site 10 struck with a guard; site 4 struck; the sentinel is contributor.
Batched Operator acts pending: one, now covering three merges. F-1 deployment — CR-2026-159 (engine), CR-2026-160 (Operator Layer) and CR-2026-161 (engine) are all merged and tagged but not deployed. The launchd restart is yours and batches to cadence.
A-2 fired once, at v0.1's Step 2, and was handled as C-3 requires: full stop, report, queue, and a CR version bump from a drafting session rather than in-flight absorption. The resumed run had no anomaly. Suite redness occurred twice and was explained and citable both times, so A-1 never fired.
R-2 completed end-to-end for the third time, and for the first time across a halt. v0.1 stopped at Step 2 with two steps landed; v0.2 resumed at Step 2 without repeating them, and the four re-confirmations §5 permits were the only backward checks made.
C-1 observed: fetched and re-verified main at e106917 immediately before merging, clean index, --no-ff, one session on the repo.
C-3 held under pressure. The tempting move at site 4 was to invent a third branch — distinguish absent from null anyway, or quietly rescope to ephemeral identities. Neither was taken.
R-4 held. The suite and the live verification ran against playground_test. playground_dev was never connected to, and .env was read once for a database name and never modified.
F-1 respected: merged is not deployed, and three merges now await one restart.
DUNIN7 — Done In Seven LLC — Miami, Florida DUNIN7 — status brief — v0.9 — 2026-08-02 Eleven sites. Two were the engine telling the truth, and a third was holding a door shut.