Version. 0.1
Date. 2026-08-21
Filed beside. foray-reference/loomworks-contribution-credential-event-log-bypass-v0_1.md. That document is not edited — this sits next to it, per the never-overwrite discipline.
Occasion. standing-notes/loomworks-standing-note-two-records-and-what-crosses-between-them-v0_1.md, STANDING, ruling CR-2026-231 §6.
The original finding described the defect correctly and named it imprecisely. It found that contribution_credentials writes via raw SQL, calls append_event nowhere, and produces no memory_events row for issuance, claim, or revocation. That description stands, unedited, at the document beside this one.
What was missing was the frame to judge it against. Read against Memory alone, the finding reads as "this should be in Memory and is not." The standing note supplies the frame that was missing: Loomworks keeps two records, not one — Memory, for knowledge about an engagement's subject, and the substrate operational record, for facts about what the system did. A credential's lifecycle is the second kind. agent_lifecycle_events (CR-2026-231) is the pattern for exactly this kind of fact, done correctly: an actor, a timestamp, a FORAY reserved location, no engagement required.
> "This is what the credential bypass gets wrong, and naming the split names the defect precisely: contribution_credentials is an operational record written by raw SQL with no actor, no reserved location, and no event. It is not wrong for being outside Memory. It is wrong for being outside both."
The defect was never "outside Memory." credit_flows, agent_sessions, and now agent_lifecycle_events are outside Memory too, and none of them is wrong for it — DR-05's non-erasure and the seed's provenance commitment both extend to the operational record, and each of those three tables honours them. contribution_credentials is the one table in that family that honours neither: no actor column, no provenance, no reserved location under O7, unattested by either record.
Nothing about the finding's facts. The original document's trace is unedited and remains the citation for what the code does.
Everything about what closing it means. The fix is not "route credential writes through append_event" — §2 of the standing note is explicit that engagement-scoped machinery is the wrong tool for a fact with no settled engagement, and a credential's lifecycle is exactly that shape (issued before any claim, held by whoever redeems the token). The fix is the agent_lifecycle_events pattern: an actor, a timestamp, append-only rows, a FORAY reserved location — landing the credential lifecycle in the operational record it already belongs to, with the attestation it currently lacks.
Not authorized here. This note names what closure means; it does not open the work. The original document's status stands: a finding filed for record, no fix authorized or implied.