Finding 1b — Retract Boundary (full-A) — Scoping Note — v0_1

Version. 0.1 Date. 2026-06-29 Status. Recorded, not scoped to a CR yet. Sequenced AFTER CR-2026-127 (needs its confirm-step). Part of the Memory-room (Room 1) finding set. Origin. Actor-boundary completeness sweep (Room-1 bar v0_2 check 5), 2026-06-29, run on the CR-2026-120 branch.

Plain-language summary

retract_assertion removes committed memory and is gated at neither layer — no data-layer actor-kind check, and its HTTP route uses the permissive get_resolved_actor instead of the human-only get_committing_resolved_actor that commit/discard use. A non-human actor (agent or companion) can therefore retract committed knowledge. CC empirically confirmed (rolled back) a companion retracting a committed Goosey assertion.

This is the same bug class as the commit-gate hole CR-2026-120 closed, and more exposed: discard (now gated) is held-only; retract (ungated) removes committed knowledge — the more consequential operation was the less-gated one.

The decision: full-A, no seam

Retract is human-authority. A non-human actor cannot retract committed memory. The Companion may propose a retraction; only the human authorizes it — identical to commit, identical to the seed's Operator-authority principle ("the machine surfaces and signals; the Operator approves").

This was chosen over Option B (a personal-vs-engagement carve-out letting the companion retract personal committed memory) because:

• B puts a growable exception into a clean principle — and the Operator's decisive concern was that B evolves to more without continual oversight. A self-polices (no exception to extend); B depends on oversight that can lapse.
• B's carve-out is backwards on risk — it would grant autonomous-erasure over the most sensitive data (personal memory) while withholding it over less-sensitive engagement data.
• B smuggles in an unstated seed claim (personal memory is a lower-authority domain) that the seed does not currently carry.

No transitional seam. An interim "gate engagement-retract now, fix personal later" was explicitly rejected — that interim is Option B temporarily, and the no-seam principle holds even to patch a live hole faster. The decision: carry the recorded exposure until 1b closes it fully, rather than introduce a B-shaped state even transiently.

The forget-about-me dependency (why this needs 127's confirm-step)

The Companion's "forget about me" feature (_route_forget_about_me, router.py:2477) today builds actor_from_companion and calls retract_assertion directly — the companion retracts committed personal memory on its own authority. That is the same principle-violation the gate closes, so full-A must re-route forget-about-me through human confirmation: the Companion surfaces "remove this from your record?", the human confirms, it retracts.

That confirmation surface is the same confirm-step CR-2026-127 builds for committed-revision (change N on a committed fact → supersession-with-confirm). So 1b reuses 127's machinery rather than duplicating it — which is why 1b sequences after 127.

Note: routing forget-about-me through one confirmation is an improvement, not a regression — permanent erasure of one's own committed memory warrants a confirming beat.

Scope when 1b is drafted (after 127)

1. Retract gate, both layers — reject non-human actors at retract_assertion (data layer) and switch its HTTP route from get_resolved_actor to the human-only get_committing_resolved_actor. Mirror CR-2026-120's pattern; reuse NON_HUMAN_ACTOR_KINDS.
2. Re-route forget-about-me through the human-confirmation step (reuse 127's confirm-step). Companion proposes → human confirms → retract.
3. Verify — companion-retract rejected on both engagement AND personal committed memory at the data layer; forget-about-me still works via confirmation; no path lets a non-human retract committed memory autonomously.

Carried exposure (the oversight that keeps it from drifting)

Until 1b lands, a non-human actor could retract committed engagement or personal memory — gated at neither layer. Bounded: no current automatic path drives a non-human to retract; it requires a deliberately-constructed companion-retract call (as CC's rollback demo did). Recorded here as the oversight. Must be closed in 1b; must not drift past Room-1 closure.

Lower-priority residue from the same sweep (not 1b, recorded)

• revise_engagement, add_relationship — ungated but narrow/low-consequence. Note for a later pass.
• revise_assertion — ungated but output is held (needs its own commit) — acceptable by design.

Room-1 finding set (current)

• Finding 1 — read-contract + commit/discard gates (CR-2026-120) — verified, merging now.
• Finding 1b — retract boundary, full-A (this note) — after 127.
• Finding 2 — held-tray grammar + committed-revision (CR-2026-127) — builds the confirm-step 1b reuses.
• Finding 3 — false-success audit — last.

Room 1 closes when all four are done and the room passes bar v0_2 (five checks; monitor-observability held-question carried to the boundaries arc).