Loomworks — raw-message grant extraction ahead of routing, scoped — v0.1

Date. 2026-08-11 · Author. Claude Code (read-only; pure-function sweeps, no LLM, no writes). Operator: Marvin Percival. Fence. Read-only. Engine read at 64610b4. The ruling applied. B-86's classifier change does not rise; the remedy is extract_delegation_grant on the Operator's raw message ahead of intent routing — the grant path stops depending on routing at all. The Operator's three questions answered here; none decided.

Question 1 — where it sits in the pipeline

Two positions are constructible; one has a precedent.

Post-classify, pre-route (step 4a) — the redirect_orient_recall_misroute shape: a deterministic function inspecting the raw message overrides where the turn routes, applied to the final classified intent before route_intent. The classifier still runs, so the turn's stored classified_intent forensic survives (the B-81 teardown lesson: that column is the record of what happened), and every existing consumer of classified.intent (completeness gate, creation-history scoping, turn recording) is untouched. Cost of the extraction position itself: zero change.
Pre-classify short-circuit — recognition before the classifier; a recognized grant skips the classifier LLM call entirely. Saves one Haiku call on grant turns only; costs the forensic label (or requires a synthetic one) and touches every consumer that assumes classification ran.

The dispatch target exists either way: CR-2026-200's grant branch (hold the delegation in the personal engagement, server-composed ack naming capability/scope/approval-mode, pointing at the held card). One ordering fact the CR must handle: extract_delegation_revocation exists and "you can't render" matches both the grant prefix (\byou can\b matches before the apostrophe) and the revoke prefix — revocation recognition must run first, or grant recognition must require no-revoke-match.

Question 2 — what it costs on every turn

Effectively nothing. The extractor is compiled-regex searches plus ≤34 case-insensitive substring scans over one chat message — microseconds, no LLM, no DB, on every turn. The no-match path (the overwhelming majority: see Question 3's corpus figure) does nothing else. A match triggers what the gated path already triggers today: one held-assertion write and a composed ack. Position 2 above additionally saves a classifier call on match turns.

Question 3 — what else the sentence could mean, measured

The structural fact first, because it reframes the risk: the recognizer alone can never mint authority. Authorization reads committed delegations only (service.list_delegations: payload->>'state' = 'committed'); the conversational grant lands held, visible, with an ack naming what was understood, and waits for the Operator's commit — and even a committed per_action delegation still raises an approval card per action. The Operator's commit is the semantic confirmation the regex lacks. A false capture's whole blast radius is a wrong ack sentence plus a spurious held card — bad (the ack asserts "you granted" about ordinary speech: itself a truthfulness-family shape, so the surface cannot be waved off), but never silent authority.

The theoretical surface is wide, and the wideness is structural. The prefix and the action are matched independently and unanchored — _GRANT_PREFIXES.search() anywhere in the text, action substrings anywhere in the text, in either order; and "render" matches as a bare substring inside words. Today that laxness is masked by the classifier gate (extraction only runs after routing already landed on remember_about_me/add_knowledge — the LLM has implicitly read the sentence as being about the Companion). Ahead of routing, the mask is gone. Constructed battery (each 3-second-plausible Operator speech; all matched as grants):

| Class | Example | Captured as | |---|---|---| | Prefix/action in unrelated clauses | "You can find the render settings in the project page." | initiate_render | | Same | "You may want to look at how we render the homepage." | initiate_render | | Substring inside a word | "you can never make me surrender this project." | initiate_render | | Mention/quotation | "What happens if I say you can draft specifications?" | produce_specification | | Third-party report | "I told Sarah you can draft specifications now." | produce_specification | | Question form | "you can draft specifications?" | produce_specification | | Negation (dual-match) | "I don't think you can draft specifications yet." | produce_specification + revoke | | Distant prefix | "Feel free to skim the notes I asked Priya to take notes on." | commit_notes |

The observed base rate over all real Operator speech to date is zero. Sweeping the extractor over every operator turn in the dev database — 412 turns, the platform's entire conversational history — produced exactly one match: E0127's genuine grant sentence. 0 false positives in 411 non-grant turns. The wide surface is constructible, not (yet) occurring; the phrasings that trip it are natural but rare in this Operator's actual usage.

Mitigation classes, enumerated not chosen. (a) Adjacency + word boundaries — require the prefix immediately (or near-immediately) before the action, and boundary-match actions: kills the clause-separation, distant-prefix, and substring-in-word classes wholesale, at near-zero false-negative cost (every genuine grant form in the battery and in E0127 has the prefix adjacent). (b) Revoke-first ordering — disposes of the negation dual-match. (c) Question-mark guard — cheap, partial (kills "you can draft specifications?", not the embedded-question mention). (d) The mention/quotation class survives all lexical guards — it is the irreducible residue, and it is exactly what the held-not-committed structure absorbs: the wrong ack invites "no — commit nothing," and nothing was. The CR's design work is choosing among (a)–(c) and deciding how the ack is worded so the residue reads as a proposal, not a fait accompli.

DUNIN7 — Done In Seven LLC — Miami, Florida — v0.1 — 2026-08-11