Loomworks — the ungated-chat disclaimer, scoped — v0.1

Date. 2026-08-11 · Author. Claude Code (read-only scoping). Operator: Marvin Percival. Fence. Read-only. Nothing built. Engine read at 64610b4. The ruling applied. Option 3: the Companion may produce prose with a governed equivalent, and must say plainly what it is not — chat text, not a Shape, no provenance, not in Memory or the record. The two questions the Operator asked answered here, from the code; neither decided.

Question 1 — where the disclaimer belongs

The path that needs it composes nothing today. The ungated route is the converse pipeline's path (b): general_conversation (or any misroute that collapses to it) → assemble_prompt → generate_response (responder.py) → the reply is model prose end to end. The four server-composed branches (cold-open greeting, completeness check, delegated responses, orient) all bypass the responder; no server text ever attaches to a responder reply.

Two server-composed seams exist that could carry it. Both are real in current code:

1. The post-generation prose seam. Step 6b of the pipeline (converse.py:1300, the CR-2026-127 blank-reply fallback) already modifies response.companion_message server-side after the responder returns and before turn-recording. A disclaimer attached here is deterministic server text: it persists inside the turn's content, re-renders on reload with no surface change, and — worth naming — enters the classifier's prose-only history as pinned text, which is the direction B-86 wants history to move. Its weakness: to the reader it is typographically indistinguishable from model prose; and it rides in the same string the model authors, so "prose contradicting the disclaimer in the same message" remains constructible by the model's half.

1. The structured side-channel. The setting_changes precedent (family: held_items, matched_files, sources, organized_view): a new field on ConverseResponse, rendered by the surface as a distinct element the model cannot touch, persisted for reload via the companion turn (the B-52 answer_sources dual-write shape, including its empty-vs-null discipline — absent must stay distinguishable from fired-false for every turn written before the CR). Its weakness: it needs surface work in /Users/dunin7/loomworks (the live frontend; loomworks-ui is the stale one), and it does not enter the classifier's prose history at all — it stabilizes nothing for B-86.

1. The system-prompt layer is already occupied and already insufficient. general_conversation.md carries the CR-2026-199 no-claim paragraph today; E0127 shows what it constrains and what it doesn't. B-85 unpinned exactly this seam. Consistent with the Operator's parenthetical: not a candidate.

The structural summary: both real candidates satisfy "server-composed." They differ in which guarantee they give — seam 1 guarantees the words are always present in the record of the conversation (and pins classifier framing); seam 2 guarantees the Operator sees a marker the model cannot overwrite (the same prose-vs-chip reasoning as the B-87 mechanism note). They compose: the B-87 scoping's tune_setting finding is the worked example of claim-carried-both-ways. Which to take — or both — is the CR's design decision, not made here.

Question 2 — fire on every prose artifact, or only where a governed equivalent exists

The finding that reframes the choice: the two scopes nearly coincide, and neither is detectable deterministically.

• "Has a governed equivalent" excludes almost nothing. The governed set is TIER_1_CAPABILITIES (delegation/schema.py): produce_specification, produce_artifact, initiate_render, commit_notes. produce_artifact is open-ended by design ("report, storybook, etc."), and the ungated-production brief already established the bypass exists wherever the artifact is text. So "prose artifact with a governed equivalent" ≈ "prose artifact." The qualifier does not narrow the firing set in practice; it only changes what the disclaimer may truthfully say about a governed path existing.

• Either scope needs a detector the server does not have. At composition time the server holds: the Operator's message, the classified intent, and (post-generation) the reply text. The classified intent cannot be the trigger — general_conversation is precisely the misroute label, and E0127 fired through it. Detecting "this reply is an artifact" therefore means either a heuristic on the reply text (length, markdown structure — arbitrary, gameable) or a second LLM judgment on the reply — a new probabilistic layer.

• Selective firing recreates the defect at the firing decision. Once the disclaimer fires selectively, its absence becomes a claim ("this reply is not artifact-shaped / is governed"), and that claim is held by the detector — a probabilistic layer. That is the same weakest-layer shape the ruling moved away from, one level up. Per the failure-kind-suppression property, a missed detection reproduces E0127 silently, now with the added implication of having been checked.

• The unconditional version is the only fully server-held one. Every sentence of the ruled disclaimer — chat text, not a Shape, no provenance, not in Memory or the record — is true of every path-(b) responder reply, artifact or small talk. Fired unconditionally it stops being an artifact disclaimer and becomes channel provenance: no detector, deterministic, honest on every turn. Its cost is weight — a repeated sentence on every chat turn is noise in prose form (seam 1), while as a standing surface marker on companion chat turns (seam 2) it is one label, not a repetition. The scope question and the placement question are therefore coupled: unconditional favors the structured marker; selective would demand the prose sentence but requires the detector.

• Server-composed branches need none of this. Denials, acks, orient, the all-claim replies: already server-truthful; the disclaimer's subject is the responder path only.

Reported, not decided. The one direction this scoping flags for the Operator's weighing: unconditional-on-the-channel + structured marker is the only combination with zero probabilistic links; every selective variant contains a detector.

DUNIN7 — Done In Seven LLC — Miami, Florida — v0.1 — 2026-08-11