Version 0.1 · 2026-06-04 · Investigation
Loomworks Memory has one visibility rule for committed assertions: everyone on the engagement sees everything committed. That is correct for the cases Loomworks was built around — a single Operator, or a few collaborators sharing one truth. It is wrong for any engagement where contributors have asymmetric relationships to the content: coaching, therapy, legal mediation, advisory, medical, HR review. Several people contribute to one engagement, but what each may see differs by their role.
The right fix is not a coaching-specific workaround but a general capability the platform is missing: a disclosure facet on committed assertions, scoped by role-on-the-engagement. It keeps one engagement, one accumulating Memory, full provenance — and adds the one missing thing: what each role may see.
Decision needed: whether to accept this as a real gap worth scoping as its own capability, held to a higher correctness bar than an ordinary phase.
Phase 16 settled the visibility logic for the Memory room, and it is explicit:
contributor designation sees: their own held (uncommitted) assertions, all committed assertions, and retracted assertions (with rationale, per non-erasure).So there is exactly one private boundary in the built model: held-versus-committed. Your uncommitted draft is yours; the moment you commit, it joins the shared engagement Memory that every contributor sees. There is no per-contributor restricted view of committed Memory.
Separately, the architecture already distinguishes engagement Memory (shared across contributors) from personal Memory (per-person, readable only by that person). Each contributor has their own Companion with its own personal-Memory access, while engagement Memory is the shared layer.
Prior confidentiality work exists but sits at a different level: the engagement-to-domain promotion rule (who may promote engagement-scoped Memory upward, gated on Operator approval) and the federated model (separate environments for HIPAA/GDPR sovereignty). Both govern Memory crossing outward across engagement or organizational boundaries. Neither governs within-engagement, per-role visibility of committed assertions. That is the unaddressed gap.
Committed engagement Memory is all-or-nothing shared. There is no built way for two contributors on the same engagement to see different subsets of the committed Memory.
This breaks the moment an engagement has contributors with asymmetric relationships to the content. Three concrete failures, all from the coaching case:
Two workarounds present themselves. Both are accommodations to the limitation rather than fixes, and both damage the thing that makes Loomworks valuable.
The coach keeps private reads in personal Memory; 360s and sponsor material stay out of engagement Memory. The client-as-contributor only ever sees client-safe committed Memory.
This works as a near-term posture on built primitives — but only by never committing the richest material (the coach's diagnosis, the rater feedback) to the engagement. That material then lives outside the engagement and does not compound. The platform's premise is that knowledge accumulates with provenance in one place; this guts that premise for safety. The most valuable content is exactly what it forces out.
Run the coach's reads, the client's plan, the raters' input, and the sponsor's readout as separate engagements.
It looks clean but fractures the single accumulating picture that is the point of Loomworks. The coach now manually reconciles four fragmented memories — precisely the "method trapped in my head, scattered across tools" problem the platform exists to eliminate. You would use Loomworks to recreate the mess it is meant to remove, and multiply engagements for what is obviously one relationship.
Both workarounds preserve the all-or-nothing rule and contort the work to fit it. If development is not the constraint, the right move is to fix the rule.
Add a disclosure facet to committed assertions: a property of each assertion, set at commit time, expressing who the assertion is visible to in terms of role-on-the-engagement, not named individuals.
A small set of disclosure bands, not an open per-person matrix. Illustrative, for the coaching case:
Design disciplines that keep this safe and governable:
This is the version where a confidential professional engagement is a genuine first-class Loomworks engagement rather than a compromise.
The coaching case is the trigger, not the boundary. The same shape — multiple contributors to one engagement, asymmetric visibility by role — describes an entire class of confidential professional work:
Each needs the same missing capability: one accumulating engagement Memory with role-scoped disclosure. The gap the coaching idea surfaced points at one of the platform's most valuable missing pieces — what makes Loomworks viable for the whole category of confidential professional engagements, a far larger and more defensible market than coaching alone.
Even with development unconstrained, this is not an ordinary feature. The disclosure layer governs the most safety-critical question in the system: who sees what. A subtle error leaks a coach's private note to a client or attributes a rater's confidential feedback. If built, it earns more rigor than a normal phase:
The capability is right; it earns extra care because the cost of a leak is high.
Treat role-scoped disclosure of committed Memory as a real, general platform gap — not a coaching-specific workaround. If accepted, the next step is a scoping note that decides the disclosure bands, how the facet is set at commit time, how every Memory read path enforces it, and the correctness bar above. This investigation names the gap and the shape; it does not pre-empt that scoping.
Until then, the near-term posture (Workaround A — coach keeps private reads in personal Memory, 360s as separate engagements) is the honest stopgap, with its cost understood: the richest material does not yet compound inside the engagement.