Version. 0.1
Date. 2026-08-20
Status. Standing note for the Loomworks project. Screen every Loomworks change against §3. On apparent conflict: do not proceed silently — name what this note protects, name what the change appears to do, and raise it to the Operator in plain English.
Origin. Operator direction (Marvin Percival); drafted by Claude. Companion to loomworks-boundaries-arc-habitat-requirements-v0_1 (the R-H set) and solution design v0_4.
The Boundaries arc has settled a direction: agents will run inside a governed runtime (the Habitat), holding zero standing authority (identity is a permanent record — the Stele; power is a short-lived granted session), reaching the world only through governed tools, judged at named chokepoints, with everything receipted. The first increment of that runtime (H0) is Loomworks-native work and arrives as an ordinary CR. Everything else lands later through its own engagement.
This note exists so that ordinary Loomworks work between now and then — features, refactors, fixes — does not quietly foreclose that direction. None of the obligations below asks Loomworks to build the runtime early. Each asks only that new work not dig holes the runtime will have to fill.
Screen every CR against these ten. Each states the rule, then why in one line.
O1 — Do not add new act paths around the named chokepoints. New ways for any actor to spend, commit, admit, or transfer must route through the existing named dispatchers (gated_room_complete, commit/creation, execute_admission_outcome) or be raised as a new named chokepoint — never as an incidental side path. Why: the runtime's coverage guarantee is only as good as the chokepoint list; every unlisted path is a future hole.
O2 — Do not create standing credentials for non-human actors. No new long-lived tokens, API keys, or stored secrets held by agent code or agent rows. Anything shaped like "the agent keeps a key" contradicts request → grant → session. Why: zero standing authority is the identity model; a persistent credential is the flaw the Operator struck from the design.
O3 — Do not deepen the human-masquerade pattern; land the system actor kind. No new system processes passing human-authority gates by wearing kind="contributor". The existing masqueraders migrate when the actor-kind CR lands; until then, add no new ones. Why: every "human-only" claim in the direction is porous while machines can dress as people.
O4 — Keep actor identity UUID-class and communication-free. No new identity or lookup keyed on email, handle, or other communication attributes for any actor, human or not. Why: seed commitment, and the Stele extends it — identity is the UUID, full stop.
O5 — Keep agent capabilities enumerable. New things agents can do arrive as discrete, listable operations — never as a generic "execute arbitrary X" surface. Why: the Habitat's tool bench and the Stele's inscribed effector set require capabilities you can point at.
O6 — New refusal logic returns citable verdicts. Any new check that allows/refuses an action uses (or is shaped to adopt) the boundary-record form — decider, version, deciding condition — rather than a bare boolean and a log line. Keep the boundary-record subsystem and its rule decider-kind alive and in the path. Why: "STOP, citing tree v, node n" is the audit spine; bare booleans can't be cited.
O7 — Do not remove FORAY emission call sites; add them at new significant events. The emitter is a no-op today; the call sites are the map of what will be receipted. New significant events (grants, refusals, admissions, freezes) get a call site even while the emitter sleeps. Why: when emission goes live, coverage should be a switch-flip, not an archaeology project.
O8 — No new unnamed cross-run agent state. New agent features that persist state between executions put it in a named, discoverable store — not scattered rows, caches, or files an audit can't enumerate. Why: declared-persistence-only is the answer to cross-session information leakage; unnamed state is the leak.
O9 — Do not preclude sessions. New agent-facing interfaces should tolerate (or at least not structurally resist) a session identifier accompanying actions. No design that assumes "the agent" is a single eternal continuous caller. Why: every action will soon carry (Stele UUID, session id); interfaces that can't say which run acted will need rework.
O10 — One authorization seam, no self-widening paths. Changes near verify_companion_authorization evolve the seam being kept (per the findings' D3 direction) rather than forking a third; and no new path may let any machine actor widen its own authority — the confirm-step, human-gated pattern (CR-2026-127/128 lineage) is the template for anything authority-shaped. Why: the Watch must grow from one seam, and widening-is-human is the direction's spine.
It does not ask Loomworks to build sessions, envelopes, sandboxes, or the Habitat ahead of the H0 CR. It does not freeze features. It does not apply retroactively — existing code is the findings' business, not this note's. It asks one thing of new work: leave the ground level where the runtime will stand.
New CRs get a one-line screen against O1–O10 in their write-up ("Runtime direction: no conflict" or the named conflict). Conflicts go to the Operator before work proceeds. This note is Loom-versioned like its siblings; amendments walk the normal path.