Version: v0_1 Date: 2026-06-26 Status: Working draft (scoping note, pre-CR) Author: Marvin Percival (DUNIN7) Anchored to: Loomworks candidate seed v0.12 (2026-06-07); GRANTHA Discovery + Sketch v0.3 (2026-06-20) Arises from: loomworks-cognisee-as-referenced-domain-investigation-v0_1
The Cognisee investigation surfaced a question the seed does not answer: when the domain layer (C5) is built, can a referenced domain point at a system outside Loomworks — a third-party reasoner, an external knowledge service — or only at internal Loomworks scopes?
This note scopes that question. It does not answer it; it frames what must be decided, names what the seed already commits, names what breaks if external references are allowed, and names the work each answer implies. The decision is the Operator's. What this note settles is the shape of the decision.
One thing to fix first, surfaced by GRANTHA. Seed v0.12 describes access restriction as "an ACL established through OVA." That vocabulary is now stale on two counts, not one: the substrate is GRANTHA (consuming OVA), and GRANTHA has no ACL and no group object at all. This note flags the seed correction; it does not make it (the seed amends through its own versioning).
In scope: the external-reference decision and its consequences across reach, contribution, provenance, and Rendering. Out of scope: building C5, designing the integration, GRANTHA's internal model, commercial terms with any external party.
Three prior positions are corrected here. Each is named, not smoothed.
Prior position (seed v0.12, my two prior Cognisee notes): access restriction is "an access-control list established through OVA."
Correction, from GRANTHA v0.3:
standalone access-grant product that consumes OVA (as Tessera does). OVA is not gone — it does the blind, topology-hiding ZK verification underneath. GRANTHA is the grant model layered over it. "ACL via OVA" → "reach governed by a grant, verified blind by OVA under GRANTHA."
access-control list and no group object. There is one primitive — the grant. "Restricted" does not mean "a list names who's allowed"; it means "a grant is required, and the holder proves they hold it in zero knowledge." The holder-set "never exists as a readable object." So the seed's word ACL is itself wrong under GRANTHA, independent of the substrate rename.
posture: open = no grant required to reach the scope; restricted = a grant is required and is proven blind. An observer with full read access cannot see who holds reach. This is stronger than the seed's "ACL governs who may reach," and the strength matters below.
The seed is behind on this. Seed v0.12 predates GRANTHA v0.3 (2026-06-07 vs 2026-06-20). Per the seed's own rule — when seed and current intent disagree, the seed governs and the disagreement is surfaced — this note surfaces it. A future seed version absorbs the GRANTHA substitution and drops the ACL vocabulary. Until then, read every "ACL via OVA" in the canon as "grant via GRANTHA, verified by OVA."
The seed gives the domain layer three load-bearing commitments, all written as if both ends of a reference live inside Loomworks:
"references" domains — "the domains it reaches for relevant practice and material." Reference is many; peers, none above the other. Membership (one chain, the org an engagement belongs to) is the other relationship and is not this one.
grant restricts it. (Seed says "ACL via OVA"; read "grant via GRANTHA.")
contributed it, when, how — typed, spoken, extracted from a document." Origin is recorded automatically.
What the seed is silent on: whether the far end of a reference can be a non-Loomworks system. Every mechanism above assumes both ends are internal. The seed does not forbid external references; it does not contemplate them. That silence is the scoping gap.
Can a C5 referenced-domain target resolve to a system outside Loomworks?
Not "should we integrate Cognisee" — that is a downstream commercial question. The seed-level decision is structural:
> Is a referenced domain always an internal Loomworks scope (an engagement, > organization, or domain that lives in Loomworks Memory), or can it be an > external endpoint that Loomworks reaches but does not hold?
Three positions are available. This note frames all three; it does not pick.
A referenced domain is always internal Loomworks Memory. External knowledge enters only by being contributed in (a person or process writes Cognisee- derived material into a Loomworks scope, marked as such), never by live reference to an outside system.
Provenance is preserved because the external material became a normal contribution at the moment it entered, carrying its origin marking.
snapshots someone imports, not as a domain an engagement reaches at Shaping/Rendering time.
A referenced domain may be an external endpoint Loomworks reaches for reading. The engagement reaches out at Shaping time; what returns is treated as contribution arriving from a typed external origin.
spoken, extracted-from-document) do not include "inference returned by an external reasoner." C5 would add one. The provenance rule extends cleanly — origin is "extensible, threads walkable" per standing direction — but the new type must be defined.
nothing restricts reaching it. If it is restricted, *what does a GRANTHA grant mean when the resource is outside Loomworks?* GRANTHA verifies a holder may reach a resource-scope; an external endpoint is a resource GRANTHA does not control. Open question: does GRANTHA govern Loomworks's right to reach out, or is the external system's own access control the boundary, or both, in series?
at a moment in time. An external reference is live — it can change between reaches. The seed's "Manifestation is a reading at a moment" assumes stable underlying Memory. C5 must decide whether an external reference is snapshotted on reach (becoming a dated contribution) or held as a live edge (and if live, how lineage records a thing that can change).
As Position 2, plus Loomworks may contribute out to the external system.
so does its boundary tension.
contribution to shared scopes: outside the trusted core, contributions are held until admitted. Contributing out of Loomworks to an external consumer is the same posture inverted — a deliberate, recorded, operator-authorized act, never a default. GRANTHA is the natural place this grant lives: "may contribute Loomworks Memory to external endpoint X" is itself a grant, subject to the six composition rules (separation of duties, no self-grant, dual-control on catastrophic acts, mandatory audit via FORAY).
Loomworks can mark and record what it sends; it cannot make the external system preserve provenance downstream. This is a boundary condition to surface, not engineer away. GRANTHA + FORAY make the outbound act auditable; they cannot govern what happens past the boundary.
Four seed surfaces feel an external reference. Each is a C5 design item, flagged not solved:
direction already wants origin "extensible, threads walkable," so this is an anticipated extension, not a violation.
question. GRANTHA's grant is over a resource-scope; an external endpoint is a resource Loomworks does not own. Whether GRANTHA governs the reach-out, the contribute-out, both, or neither (deferring to the external system's own control) is undecided and is the hardest sub-question. It should be checked against GRANTHA's own open questions (its C2 "grant-policy expression" and "verification obligations") rather than decided unilaterally here.
was produced from… which scopes' knowledge it composed." A Render that composed external-domain material must record that an external scope contributed, and which. Lineage was designed for internal scopes; it extends to name an external one, but the record must be honest that the external contribution is a reach-snapshot, not held Memory.
Mode B already crosses the Loomworks boundary outbound — Loomworks produces a specification an external system consumes. External reference is the inbound/bidirectional analogue at the Memory layer. They are different layers (Render output vs Memory reference) and should not be merged, but Mode B is precedent that the seed already tolerates a Loomworks↔external boundary at one layer. That precedent is useful when weighing whether to allow one at the Memory layer too.
This note does not recommend which position to adopt. It recommends when to decide:
turn on "what does a GRANTHA grant mean for an external resource," and GRANTHA is itself pre-seed (Discovery v0.3, nothing built). Deciding external-reference policy before GRANTHA's grant-policy expression (its own C2 gating question) is settled would be deciding on a substrate that isn't specified.
GRANTHA's C2. When GRANTHA's grant model lands, this decision becomes answerable. Until then, Position 1 (internal-only) is the safe default — it requires nothing new and loses only live external reference, which nothing currently needs.
Cognisee material can enter as ordinary contribution (Position 1) today, marked as Cognisee-derived. Live reference (Positions 2/3) is the enhancement that waits on GRANTHA.
scoping (its C2), referenced here, not decided here.
are flagged for a future seed version; this note does not author that amendment.
decision.)
how does it mark on the contribution? (Positions 2/3.)
endpoint Loomworks does not own? (The hard one; coupled to GRANTHA C2.)
record something that can change? (Positions 2/3.)
all six GRANTHA composition rules, and which are dual-control? (Position 3.)
held-Memory scopes from reach-snapshot external scopes? (Positions 2/3.)
decision arising from the Cognisee investigation. Carries the OVA→GRANTHA correction and the deeper no-ACL/no-group correction from GRANTHA v0.3. Frames three positions, names cross-cutting consequences, recommends sequencing (gate on GRANTHA; Position 1 safe default meanwhile). Does not decide.
DUNIN7 — Done In Seven LLC — Miami, Florida C5 Domain Layer — External Reference Targets — Scoping Note — v0.1 — 2026-06-26