Loomworks — FORAY Audit Coverage — Resolution Proposal — v0.3

Version: v0.3 Date: 2026-08-18 Status: D1–D9 remain ruled (accepted 2026-08-18) and are not re-opened. Five new decisions, D10–D14 in §11, need a word. Changes from v0.2: FORAY's response to information request v0.3 arrived and answered five of seven items outright. Three Tier-1 blockers are gone; the anchor endpoint's real contract is known, including a disclosed defect; two conventions decisions are now answerable and pass back to Loomworks to make. Change log at §13. v0.1 and v0.2 stand as siblings. Responds to: foray-loomworks-audit-coverage-requirement-v0_1; foray-response-to-loomworks-request-v0_3-v0_1. Grounded on: the Loomworks seed; architecture specification v0.4 §09; the Phase 61–63 substrate cleanup arc; loomworks-foray-mapping-v0_2; the eight FORAY instruments now held; build list v1.04.

Plain-language summary

FORAY has answered. Three things that stood between Loomworks and its first real record are gone.

The record identifier is Loomworks' to mint — no registry, no format beyond a self-chosen prefix, and LOOMWORKS is unclaimed. The two hash fields that every mapped record carried as PLACEHOLDER turn out to be vestigial: not computed, not checked, not compared to anything in FORAY's own code, and the correct permanent state of those fields. And the anchor endpoint's contract is now documented rather than guessed.

That contract carries a disclosed defect, and FORAY named it before being asked: POST /api/anchor has no idempotency protection. Two identical submissions anchor twice. Combined with the one-shot response capture already recorded in v0.2's successor request, this closes off the obvious failure response — if a response is lost, Loomworks must not retry, because retrying guarantees a second independent anchor while the first becomes permanently unprovable. FORAY's stated posture and Loomworks' own honesty discipline agree: a lost response is an operational exception for a human, not something to paper over automatically.

One further thing in the contract matters more than its size suggests. A 200 means signed and enqueued. It does not mean anchored on-chain. Loomworks must never say "anchored" on the strength of a 200, which means the system needs a small vocabulary of anchor states and a rule about which of them it may claim.

Two questions came back as Loomworks' own to answer rather than FORAY's: the exact form of the minted identifier, and how to name a foreign asset — an Anthropic API token consumed by Loomworks is not a Loomworks asset, and FORAY explicitly declines to adjudicate between the two legitimate options. Both are in §11.

Two items remain genuinely open on FORAY's side: the cross-record ruling, now escalated on the grounds that it blocks a real consumer, and the missing F4 code list. Neither blocks the work Loomworks would do first.

1. What the brief asked for

• R-1 — every room the seed names as producing transitions has a determinable FORAY posture. A stated deferral satisfies this.
• R-2 — the forward-gap sites are closed, or a reason is stated for each.
• R-3 — the cross-record question gets an answer.

Answered at §5, §6, and §7 respectively; unchanged by FORAY's response except where noted.

2. Conformance check — seed and architecture

Against the seed: no conflict. The seed names FORAY for tamper-evident anchoring of transitions and defers mechanism to FORAY's specification. Nothing here adds a commitment the seed has not made.

Against the architecture: FORAY emission belongs at the engine substrate layer, never at a surface — trust must not depend on a surface's cooperation. No emit in the Operator Layer frontend, in a render specialist's own output, or anywhere a component could decline to emit and leave no trace. Where a render specialist is external, the attestable moment is the engine's dispatch and receipt boundary.

Against the cleanup arc's canon: the reserved-location pattern with grep markers is the mechanism, and canon Principle 1 is one emit per business event, not centralized at the helper writer. Nothing here invents a new emission mechanism.

3. Reserved, not live — settled

All sixteen sites are _foray_reserved_emit(...) stubs under # FORAY_RESERVED_LOCATION markers. The mapping's own status line: documentation only, no code, no client, no emitter, no test, and POST /api/anchor never called. The 17/17 validation pass submitted hand-built records to the validate endpoint.

Consequence: every staged item is substrate preparation. No production behavior changes anywhere in Stages 1–4.

One qualification, now partly resolved. v0.2 warned that a schema pass certifies shape rather than truth, and pointed at the placeholder values as a residue to clear. FORAY's answer splits that residue in two: the F3/F8 governance placeholders are confirmed correct (§7 of the response, and §5 below), while the hash placeholders are confirmed vestigial. Neither is a defect. What remains true is narrower than v0.2 stated: a validating record can still say nothing, but at these sites it is saying the honest thing.

4. The attestation principle (unchanged, ruled at D1)

> Attest transitions that enter the record or leave the system. Do not attest derived computation.

FORAY proves a system's record of a transition has not been altered since. Something recomputable from an already-anchored source needs no independent anchor. What needs anchoring is (a) the moment something enters the record as fact, (b) the moment a human authority approves a state change, and (c) the moment something crosses out of Loomworks into the world.

Worked example, unchanged: CR-2026-225's embedding rows get no emit — a vector recomputed from an anchored assertion proves nothing the assertion does not already prove.

5. Room postures (R-1, ruled at D1/D2)

Memory — emits; refine to per-business-event, and it is also a forward-gap site. One generic write path carries roughly twenty event kinds — the shape canon Principle 1 moved away from. The object id, engagement id, actor id, and actor kind are all in scope at that site and none reach the payload, which is why its F3 is the placeholder. Consequential transitions are commit, revise, retract, discard. Held drafts and derived projections do not emit.

Manifestation — derived; emits on Operator approval only. Organization is reproducible from anchored Memory plus a timestamp. The Operator's approval is the attestable act. Whether such approvals exist as distinct state transitions today is a Step 0 finding.

Shaping — derived; emits on Operator approval only. Same shape, same reasoning.

Rendering — the real gap; first room wired. Rendering is the boundary; once something has left, Loomworks' record of what it sent is the only account that exists. Mode A attests the render act and its result. Mode B attests the specification's production and handoff, not the artifact — Loomworks does not execute a Mode B render and must not attest an outcome it did not produce. Where the specialist is external, the emit sits at the engine's dispatch and receipt boundary.

Governance-shaped records are correct as they stand. FORAY confirms the zero-amount, placeholder-F3/F8 form is the expected shape for non-monetary events under the Root's governance column, and that the schema's non-empty-string requirement against no genuine value is a known tension explicitly not read as a defect. Loomworks stops treating these as something to resolve.

6. The forward gaps (R-2, ruled at D3)

Close them all. In every case the identifier is in scope at the call site, and at the settings sites it is passed into Loomworks' own audit write one line above the FORAY emit and then dropped.

Three items beyond the brief's count: the suspension site's read-before-flush ordering defect (a correctness bug, D8); the duplicated emit construction at the two settings sites (a shared payload builder, not a centralized emit); and Memory's own gap, the largest in the set.

Why first: touches no new room, changes no architecture, blocked by nothing, and it is the prerequisite for any cross-record linkage.

7. Cross-record references (R-3, ruled at D4) — status updated

Loomworks' answer stands: yes. Its memory model is corrections-preserved and provenance-threaded; if its own memory can walk those links while its attestation cannot, the audit trail is structurally weaker than the record it attests.

Current wire: strictly in-record (E7). The mapping's recheck established that under the single-Action record shape an in-record reference cannot exist at all — no second component for a reference to resolve against.

Status change: FORAY has escalated Validation Scope R2 for an Operator ruling, explicitly on the grounds that it now blocks a real cross-project consumer rather than internal adaptor-program work, and has recorded Loomworks' independent architectural reasoning as corroboration arriving from a separate starting point. Loomworks' stated refusal to commit an adaptor design to in-record-only while R2 is open is noted and stands.

Consequence for sequencing: Stage 6 stays deferred and stays outside Stages 1–4. Permit → linkage at emit time, no record-shape change, Stage 6 collapses into the earlier stages. Keep the narrowing → multi-component records, a real change to the per-call-site emitter design.

8. The external contract, now known

Recorded here because the emitter is built against it, not against documents.

| Aspect | Contract | |---|---| | Auth | Authorization: Bearer <token>; one shared token, no per-client identity; 401 on bad or missing | | Mode off | 404, checked before auth — the route denies its own existence | | Idempotency | None. Two identical submissions anchor twice, with fresh salt and window each time | | Rate limits | None on this route | | Sync or queued | Queued. 200 = signed and enqueued | | Success body | status: 'enqueued', jobId, txHash, leafSalt, expectedAnchoredValue, address, fee, spentUtxo, extension | | Failures | 413 over 1 MiB body; 400 empty body; 500 construction or binding failure | | Response custody | Delivered exactly once; nothing recoverable from FORAY afterwards | | component_hashes / merkle_root | Vestigial — not computed, not checked; permanent sha256:PLACEHOLDER |

9. Emitter design constraints

These follow from §8 and bind the emitter whenever it is built. They are constraints, not decisions — each is forced by the contract.

1. Custody capture is part of the anchoring act. The anchor call and the durable capture of its full response are one unit; no anchor is acknowledged until its custody package is stored. The emitter stays asynchronous with respect to the originating transaction — commit availability never depends on an external API — but it is not fire-and-forget. This invalidates the CR-2026-225-shaped dispatch v0.2 assumed.
2. No retry on uncertain failure. With no idempotency at the endpoint, a retry after a lost response guarantees a second independent anchor while the first becomes permanently unprovable. A submission whose outcome is genuinely unknown is an operational exception surfaced for a human decision — never a silent retry. This matches FORAY's stated posture and Custody Model v0.6's internal requirement for an unreproducible aggregate.
3. Retry only where the outcome is known. A 400, 413, or a pre-send failure is safe to handle programmatically — nothing was anchored. A lost or ambiguous response is not.
4. 200 is not "anchored." Signed and enqueued is not broadcast and not confirmed. Nothing in Loomworks may claim anchored state on the strength of a 200 — see D11.
5. Body size is a real limit. 1 MiB. Rendering records carrying specification content could plausibly approach it; the emitter measures before sending rather than discovering it as a 413.
6. Do not parse stack. FORAY states it is debugging output with no stable contract. Failure handling keys on status codes only.
7. Do not distinguish "disabled" from "does not exist." The 404-before-auth behavior makes that distinction unavailable; the emitter treats 404 as "anchoring unavailable" and says exactly that.
8. Leave the hash fields as placeholders. Permanently, by FORAY's confirmation.

10. Sequencing and queue posture (D5, unchanged)

Filed and sequenced behind the engagement-recall follow-through; not queue-jumping. Recorded at build list v1.04.

| Stage | Work | Status after FORAY's response | |---|---|---| | 0 | Step 0 inspection: sites and available data at HEAD; whether Manifestation and Shaping have distinct Operator-approval transitions; Rendering dispatch and receipt boundaries; the suspension ordering defect | Unchanged | | 1 | Conventions | Shrunk. F1 minting and asset schemes are answered by FORAY; what remains is Loomworks' own picks — D10, D12, D14 | | 2 | R-2: close the forward gaps, including Memory's; fix the ordering defect; de-duplicate the settings construction | Unchanged | | 3 | R-1 Rendering: emit sites at dispatch and receipt boundaries, Mode A and Mode B distinguished | Event-kind naming now interacts with FORAY's owed F4 list — D13 | | 4 | R-1 Memory refinement: per-business-event sites | Unchanged | | 5 | R-1 Manifestation and Shaping: approval-act emits, or stated deferral recorded | Unchanged | | 6 | R-3: structural references | Blocked on FORAY's escalated R2 ruling; deferred as before | | 7 | The emitter itself: live transmission | Newly scopable — §8 and §9 give it a real contract. Not before Stage 2 |

Stage 2 is small enough for a single change request. Stages 3–5 want their own scoping note; Stage 7 certainly does.

On R-1 satisfaction: a stated deferral satisfies it, but every room's posture must be recorded in the record, not merely decided in conversation.

11. New decisions for ruling

• D10 — The F1 form. FORAY ruled F1 adaptor-minted, no registry, prefix self-chosen, LOOMWORKS unclaimed. Loomworks picks the rest. Lean: LOOMWORKS_<namespaced-kind>_<source-key> — the namespaced kind already used in the reserved emits, then the originating system's own key, which is the same value F2 carries. It is legible, collision-free within Loomworks by construction, and needs no separate minting machinery or state. Rejected alternative, recorded: a random or hash-derived suffix — shorter, but it makes an identifier whose job is retrieval and citation unreadable, and adds a generator where none is needed.
• D11 — Anchor state vocabulary, and what Loomworks may claim. Lean: three states — enqueued (a 200 with custody captured), anchored (on-chain confirmation observed), unprovable (response lost or outcome unknown). Nothing in Loomworks says "anchored" without the third-party confirmation that word implies; surfaces and Companion replies use the state actually held. This is the server-composed-truthfulness discipline applied to attestation: the system says what it knows, not what it hopes.
• D12 — The unprovable path. Lean: an unprovable submission is recorded as such against its own row, surfaced to the Operator as an operational exception, and never retried automatically. Re-anchoring is an Operator act, deliberately, because a re-anchor is a second on-chain artifact and that is a consequential state transition — Operator authority, per the standing commitment. Rejected alternative, recorded: automatic bounded retry — the ordinary answer, and wrong here, because the endpoint's missing idempotency turns it into guaranteed duplicate evidence.
• D13 — Offer Loomworks' event kinds to FORAY's owed F4 catalog. FORAY filed the F4 list as owed and said explicitly that inventing one without checking it against Loomworks' sixteen sites risks immediate revision. Lean: produce a short contribution document listing Loomworks' current namespaced kinds plus the Rendering kinds Stage 3 would add, offered as input to FORAY's catalog work. Meanwhile Loomworks proceeds with its own namespaced kinds and reconciles when the catalog lands — Stage 3 is not blocked on it.
• D14 — Foreign asset naming. FORAY says both an issuer-specific prefix and a generic PROVIDER: prefix are legitimate and declines to adjudicate; the requirement is only that the prefix name something real about provenance. Lean: issuer-specific where the issuer is knowable (ANTHROPIC: for an Anthropic API token), PROVIDER: only as the fallback where it genuinely is not. It carries more truth, and the two sites in question have a knowable issuer.

Rejected alternatives from earlier versions, still recorded: wire all four rooms uniformly; defer R-2 until the room work settles; attest Mode B render outcomes; treat the identifier-minting gap as an emitter-build detail.

12. What this proposal does not do

It does not draft a change request, design emit payloads, or name call sites in the unwired rooms. It does not settle whether Manifestation and Shaping have distinct Operator-approval transitions — a Step 0 finding. It does not schedule Stage 7 or design the custody store. It does not rule on FORAY's escalated R2, which is the Operator's to make on the FORAY side.

13. Change log

v0.2 → v0.3 (FORAY's response absorbed)

FORAY's response-to-loomworks-request-v0_3-v0_1 answered five of seven items; two remain owed on FORAY's side.

1. Three Tier-1 blockers cleared. F1 is adaptor-minted with no registry (LOOMWORKS unclaimed) → D10 is now a Loomworks pick, not a FORAY question. component_hashes and merkle_root are vestigial — not computed, checked, or compared anywhere in FORAY's own anchor path — and the placeholder is their correct permanent state. The anchor endpoint contract is documented in full at §8.
2. New §8: the external contract, tabulated, because the emitter is built against it rather than against prose.
3. New §9: eight emitter design constraints, each forced by §8. The first — custody capture inside the anchoring act — invalidates the fire-and-forget dispatch v0.2 assumed on the CR-2026-225 pattern. The second and third are the consequence of FORAY's disclosed no-idempotency defect: no retry on uncertain failure, retry only where the outcome is known.
4. Five new decisions, D10–D14. D10 (F1 form), D11 (anchor state vocabulary and what Loomworks may claim), D12 (the unprovable path, Operator-authority re-anchoring), D13 (offer Loomworks' kinds to FORAY's owed F4 catalog), D14 (foreign asset naming). D1–D9 unchanged and not re-opened.
5. §3's placeholder qualification split. Governance placeholders confirmed correct by FORAY and no longer read as residue; hash placeholders confirmed vestigial. v0.2's broader warning is narrowed accordingly.
6. §5's governance paragraph added; §7 updated with R2's escalation and FORAY's recording of Loomworks' reasoning as independent corroboration.
7. §10 gains Stage 7 (the emitter itself), newly scopable now that a real contract exists; Stage 1 shrinks to three Loomworks-side picks.
8. Unchanged: the attestation principle and every room posture derived from it (D1, D2); R-2 first (D3); R-3's answer (D4); queue posture (D5); substrate-only emit placement (D6); the conventions stage's existence (D7, D9, now narrowed); the ordering-defect fix (D8).

v0.1 → v0.2 (preserved)

Mapping evidence read. Reserved-versus-live settled as reserved stubs — all staged work is substrate preparation. New §8: no identifier-minting convention exists (D7, D9). Memory's posture sharpened — it is also one of the worst forward-gap sites. Two items added to the R-2 stage: the suspension-site ordering defect (D8) and the duplicated settings construction. R-3 sharpened from data gap to structural ceiling. Sequencing extended to seven stages.

DUNIN7 — Done In Seven LLC — Miami, Florida Loomworks — FORAY Audit Coverage — Resolution Proposal — v0.3 — 2026-08-18