Version. 0.1 Date. 2026-08-20
Status. Standing note for the Loomworks project. Screen
every Loomworks change against §3. On apparent conflict: do not proceed
silently — name what this note protects, name what the change appears to
do, and raise it to the Operator in plain English.
Origin. Operator direction (Marvin Percival); drafted
by Claude. Companion to
loomworks-boundaries-arc-habitat-requirements-v0_1 (the R-H
set) and solution design v0_4.
The Boundaries arc has settled a direction: agents will run inside a governed runtime (the Habitat), holding zero standing authority (identity is a permanent record — the Stele; power is a short-lived granted session), reaching the world only through governed tools, judged at named chokepoints, with everything receipted. The first increment of that runtime (H0) is Loomworks-native work and arrives as an ordinary CR. Everything else lands later through its own engagement.
This note exists so that ordinary Loomworks work between now and then — features, refactors, fixes — does not quietly foreclose that direction. None of the obligations below asks Loomworks to build the runtime early. Each asks only that new work not dig holes the runtime will have to fill.
Screen every CR against these ten. Each states the rule, then why in one line.
O1 — Do not add new act paths around the named
chokepoints. New ways for any actor to spend, commit, admit, or
transfer must route through the existing named dispatchers
(gated_room_complete, commit/creation,
execute_admission_outcome) or be raised as a new
named chokepoint — never as an incidental side path. Why:
the runtime’s coverage guarantee is only as good as the chokepoint list;
every unlisted path is a future hole.
O2 — Do not create standing credentials for non-human actors. No new long-lived tokens, API keys, or stored secrets held by agent code or agent rows. Anything shaped like “the agent keeps a key” contradicts request → grant → session. Why: zero standing authority is the identity model; a persistent credential is the flaw the Operator struck from the design.
O3 — Do not deepen the human-masquerade pattern; land the
system actor kind. No new system processes passing
human-authority gates by wearing kind="contributor". The
existing masqueraders migrate when the actor-kind CR lands; until then,
add no new ones. Why: every “human-only” claim in the direction is
porous while machines can dress as people.
O4 — Keep actor identity UUID-class and communication-free. No new identity or lookup keyed on email, handle, or other communication attributes for any actor, human or not. Why: seed commitment, and the Stele extends it — identity is the UUID, full stop.
O5 — Keep agent capabilities enumerable. New things agents can do arrive as discrete, listable operations — never as a generic “execute arbitrary X” surface. Why: the Habitat’s tool bench and the Stele’s inscribed effector set require capabilities you can point at.
O6 — New refusal logic returns citable verdicts. Any
new check that allows/refuses an action uses (or is shaped to adopt) the
boundary-record form — decider, version, deciding condition — rather
than a bare boolean and a log line. Keep the boundary-record subsystem
and its rule decider-kind alive and in the path. Why:
“STOP, citing tree v, node n” is the audit spine; bare booleans can’t be
cited.
O7 — Do not remove FORAY emission call sites; add them at new significant events. The emitter is a no-op today; the call sites are the map of what will be receipted. New significant events (grants, refusals, admissions, freezes) get a call site even while the emitter sleeps. Why: when emission goes live, coverage should be a switch-flip, not an archaeology project.
O8 — No new unnamed cross-run agent state. New agent features that persist state between executions put it in a named, discoverable store — not scattered rows, caches, or files an audit can’t enumerate. Why: declared-persistence-only is the answer to cross-session information leakage; unnamed state is the leak.
O9 — Do not preclude sessions. New agent-facing interfaces should tolerate (or at least not structurally resist) a session identifier accompanying actions. No design that assumes “the agent” is a single eternal continuous caller. Why: every action will soon carry (Stele UUID, session id); interfaces that can’t say which run acted will need rework.
O10 — One authorization seam, no self-widening
paths. Changes near verify_companion_authorization
evolve the seam being kept (per the findings’ D3 direction) rather than
forking a third; and no new path may let any machine actor widen its own
authority — the confirm-step, human-gated pattern (CR-2026-127/128
lineage) is the template for anything authority-shaped. Why: the
Watch must grow from one seam, and widening-is-human is the direction’s
spine.
It does not ask Loomworks to build sessions, envelopes, sandboxes, or the Habitat ahead of the H0 CR. It does not freeze features. It does not apply retroactively — existing code is the findings’ business, not this note’s. It asks one thing of new work: leave the ground level where the runtime will stand.
New CRs get a one-line screen against O1–O10 in their write-up (“Runtime direction: no conflict” or the named conflict). Conflicts go to the Operator before work proceeds. This note is Loom-versioned like its siblings; amendments walk the normal path.