payload/provenance separability verdict — MIXED (§8); (2) the resulting correction to the tokenization recommendation — it protects structured identity, not self-identifying content (§9); and (3) the crystallization into a single frame — confidentiality posture as a declared, enforced, laddered engagement property, now in its own standing note (§10). The v0.1 sections are preserved; §§8–10 are the amendment. Per Discovery discipline, the prior framing is preserved alongside the correction, not smoothed.
What this does. Lays out every credible way to protect content at rest while still letting the Companion reason over it, places each against regulated-domain requirements, and records where the inquiry converged: a declared confidentiality-posture property on the Engagement, with the enclave-plus-customer-key rung as the architectural destination.
What changed from v0.1. v0.1 recommended tokenization ("the map") as the highest-leverage second step. The follow-up inspection showed the leverage is lower than it looked: identity is re-embedded in the content payload and content self-identifies by its facts, so tokenization protects structured identity, not semantic identity — reducing blast-radius but not delivering the strong de-identification claim for Loomworks's domains. The mechanism that protects self-identifying content is the enclave, because it protects content as content. So the destination moved from "tokenization is #2, enclave is demand-pulled #3" to "the enclave-with-customer-key rung is the architectural destination, framed as a declared posture property."
What it concludes. Confidentiality posture should be a declared property the Engagement carries and the Operator governs, naming a rung on a protection ladder (none → key-custody → enclave+customer-key → client-side-only), enforced by key absence rather than described by a flag. See the standing note for the settled form.
The v0.1 body — the reframe trajectory, the Companion-must-read constraint and the A/B threat split, the three protection families (confidential computing, tokenization, FHE), regulated-domain positioning, the original three-recommendation sequence, what-is-true-today, and prerequisites — is preserved unchanged from v0.1 as the landscape and starting position. §§8–10 record where the arc moved from there. (Full v0.1 text retained in the v0.1 file; v0.2 supersedes v0.1 as the current version, v0.1 retained as the prior position per the versioning discipline.)
memory_events carries payload and provenance as separate JSONB columns, plus dedicated structured columns (engagement_id, actor_id/actor_kind, object_id/version, timestamp). Projection tables decompose identity further into dedicated UUID columns and are rebuildable from the log. A token/map model keyed off these can be built without touching content.events.py:165 — payload = object.model_dump(mode="json") — serializes the entire object into payload, re-embedding the same identity and full provenance that also live in the dedicated columns; free-text content can name people. You cannot strip identity from content by pointing at columns. Making content identity-clean requires reshaping serialization and re-projecting — a rebuild of the object/event-construction layer.Plainly: the who/where/origin linkage is separable today (refactor); the content payload re-embeds identity and would need rebuilding to tokenize. The prerequisite is half-met.
Two failure modes for a pure map model:
payload blob — the vault protects the front door, the payload leaves the back open. Fixable by reshaping serialization so payload does not duplicate identity; deterministic, but touches the construction layer every contribution flows through.Corrected conclusion. Tokenization protects structured identity and reduces blast-radius; it does not deliver the strong de-identification claim for self-identifying domains. The mechanism that addresses self-identifying content is the enclave — it protects content as content without de-identifying it. This inverts v0.1's emphasis: tokenization's leverage is lower than it looked, the enclave's necessity higher. The enclave moves from "demand-pulled #3" to the architectural destination.
The question crystallized into one frame, recorded in full in standing-notes/loomworks-standing-note-confidentiality-posture-v0_1. In brief:
none (full Companion) → Rung 1 key-custody → Rung 2 customer key into an attested enclave (the destination — keeps the server-side Companion, makes confidentiality structural and attestable) → Rung 3 client-side-only (absolute exclusion, constrained Companion). Rungs stack; built in order as demand pulls.Sequence: build Rung 1 regardless (scoped); design and prove enforcement before any rung above 1; scope Rung 2 when a real buyer requires the strong claim; scope Rung 3 for absolute-exclusion buyers; defer the seed addition until the property stabilizes.
loomworks-record.