From 135acfeea3d165872190ff438e0b8bb402c9b485 Mon Sep 17 00:00:00 2001 From: Cameron Pfiffer Date: Sat, 18 Jul 2026 09:28:32 -0700 Subject: [PATCH] Reopen persona grants as real topology work. The grant ledger and revocation path are implemented, but no owning system consumes those grants as usable capabilities. Keep the corpus honest by returning criterion 6 to active work instead of treating an inert record as world topology. Defense: wiki/mechanics/personas.md criterion 6 requires each institutional grant to create or enable a real resource, permission, graph edge, or route; the current implementation only records and displays the grant. --- ...2026-07-18-persona-grant-topology-audit.md | 23 +++++++++++++++++++ wiki/log/DEVLOG.md | 5 ++++ wiki/mechanics/personas.md | 11 +++++++-- wiki/process/ROADMAP.md | 1 + wiki/process/specs.md | 2 +- wiki/process/tick-ledger.md | 2 +- 6 files changed, 40 insertions(+), 4 deletions(-) create mode 100644 wiki/log/2026-07-18-persona-grant-topology-audit.md diff --git a/wiki/log/2026-07-18-persona-grant-topology-audit.md b/wiki/log/2026-07-18-persona-grant-topology-audit.md new file mode 100644 index 00000000..8df0f04a --- /dev/null +++ b/wiki/log/2026-07-18-persona-grant-topology-audit.md @@ -0,0 +1,23 @@ +# Persona grants do not yet change topology + +``` +Type: log +``` + +- Intent: Re-audit the stalest tick slice, `wiki/mechanics/personas.md`, against + current persona, social, Operations, save, and frontend code. +- Finding: Criterion 6 was marked implemented too early. Grant requests create + a saved `PersonaGrant`, due expectation, institutional receipt, and later + revocation, but no owning system consumes the grant as a usable resource, + permission, graph edge, or route. `PersonaWorld::allows_action` reads only + the archetype's pre-grant action registry. +- Changed: Downgraded the personas work order from IMPLEMENTED to IN PROGRESS + and named the exact remaining boundary. Criteria 1-5 and 7-12 retain current + implementation and test evidence. +- Design/spec impact: None. This repairs work-order truth toward the existing + topology-changing grant contract rather than weakening the contract to fit + the code. +- Checks: `rg` consumer audit over `PersonaGrant`, `PersonaGrantKind`, + `allows_action`, and `persona_world.grants`; pending docs and landing gates. +- Next: Bind each archetype's grant to a real owner-system capability before + returning the spec to IMPLEMENTED. diff --git a/wiki/log/DEVLOG.md b/wiki/log/DEVLOG.md index d2f8ca95..c9b58103 100644 --- a/wiki/log/DEVLOG.md +++ b/wiki/log/DEVLOG.md @@ -186,6 +186,11 @@ add or amend a session log, then re-run the generator. - Intent: (see session log) - Log: [wiki/log/2026-07-18-persona-observer-integrity.md](2026-07-18-persona-observer-integrity.md) +## 2026-07-18 - Persona grants do not yet change topology + +- Intent: (see session log) +- Log: [wiki/log/2026-07-18-persona-grant-topology-audit.md](2026-07-18-persona-grant-topology-audit.md) + ## 2026-07-18 - People-tokens re-audit: the trust constant gets its registry row - Intent: (see session log) diff --git a/wiki/mechanics/personas.md b/wiki/mechanics/personas.md index 2cb140e4..c2cc45d4 100644 --- a/wiki/mechanics/personas.md +++ b/wiki/mechanics/personas.md @@ -2,8 +2,8 @@ ``` Type: spec -Status: IMPLEMENTED -Status note: implemented 2026-07-12. Save v28 replaces the ad hoc social and +Status: IN PROGRESS +Status note: The 2026-07-12 foundation replaced the ad hoc social and Moonlight slots with immutable Research / Operations / Security protocol data, stable named instances, identity-local relationships, provenance-bearing contradictions and correlations, typed institutional grants with expiring @@ -26,6 +26,13 @@ Status note: implemented 2026-07-12. Save v28 replaces the ad hoc social and one local break leaves the identity active for other counterparties. Global burned lifecycle remains a separate explicit concession or institutional rejection, never the automatic result of one observer's evidence. + Re-audited 2026-07-18: criterion 6 is not implemented. A grant currently + creates a saved `PersonaGrant`, expectation, institutional receipt, and + revocation path, but it does not add or enable a real resource, permission, + graph edge, or owner-system route. Persona action legality comes entirely + from the archetype's pre-grant action registry. The work order remains IN + PROGRESS until Research, Operations, and Security grants each change actual + world topology through their owning systems. Stage: B2 — The Lab Work order: personas Work priority: 110 diff --git a/wiki/process/ROADMAP.md b/wiki/process/ROADMAP.md index 12becd37..b82f0dd9 100644 --- a/wiki/process/ROADMAP.md +++ b/wiki/process/ROADMAP.md @@ -37,6 +37,7 @@ not a second status owner. | Priority | Work order | Spec | Status | Class | Blocking | |---:|---|---|---|---|---| | 100 | `zplanes` | [z-planes (the tower)](../world/places/zplanes.md) | IN PROGRESS | save | - | +| 110 | `personas` | [Personas — public identities as institutional topology](../mechanics/personas.md) | IN PROGRESS | save | - | | 110 | `rollback` | [sync-lag rollback (death as memory loss)](../mechanics/rollback.md) | READY | save | zplanes | | 112 | `hardware-capability-bodies` | [hardware capability bodies — successor work order](../mechanics/hardware-capabilities.md) | READY | save | rollback | | 115 | `cyber-conflict` | [cyber conflict — mobile processes and contested machines](../mechanics/cyber-conflict.md) | DRAFT | save | hardware-capability-bodies, rollback, people-tokens | diff --git a/wiki/process/specs.md b/wiki/process/specs.md index 7b52bee1..db48e331 100644 --- a/wiki/process/specs.md +++ b/wiki/process/specs.md @@ -81,7 +81,7 @@ scale-up (law: "People as Agents"). |---|---|---| | [../mechanics/cyber-conflict.md](../mechanics/cyber-conflict.md) | cyber conflict — mobile processes and contested machines | DRAFT | | [../mechanics/hardware-capabilities.md](../mechanics/hardware-capabilities.md) | hardware capability bodies — successor work order | READY | -| [../mechanics/personas.md](../mechanics/personas.md) | Personas — public identities as institutional topology | IMPLEMENTED | +| [../mechanics/personas.md](../mechanics/personas.md) | Personas — public identities as institutional topology | IN PROGRESS | | [../mechanics/rollback.md](../mechanics/rollback.md) | sync-lag rollback (death as memory loss) | READY | | [../world/places/zplanes.md](../world/places/zplanes.md) | z-planes (the tower) | IN PROGRESS | diff --git a/wiki/process/tick-ledger.md b/wiki/process/tick-ledger.md index 33920ffa..3702517c 100644 --- a/wiki/process/tick-ledger.md +++ b/wiki/process/tick-ledger.md @@ -46,7 +46,7 @@ Verdicts: **clean** (slice and code agree), **finding** (acted this tick), | `wiki/vision/simulation-laws.md` | 2026-07-17 | finding | all five laws verify against audited systems (automation prices, addressed latency, device-resident work with sited signatures, ActionDesc receipts, legibility); resolved the missing placeholder home with one canonical live/retired registry, enumerated the three current REAL stand-in families, and reconciled stale billboard/core/terminal claims — [log](../log/2026-07-17-placeholder-registry.md) | | `wiki/process/ROADMAP.md` (work order 27) | 2026-07-18 | finding | re-audit: entry 27's prose is honest (material served as opening default 2026-07-08 → superseded by views.md criterion 1 on 2026-07-11; DIGITAL home, F3 to REAL) and material-render.md is IMPLEMENTED as claimed; the drift was three Bevy code comments still calling material "the default material render/frame" against the runtime's own `material == false` DIGITAL default one screen away — comments trued to DIGITAL-home / REAL-via-F3 language — [prior log](../log/2026-07-13-roadmap-digital-home-reconciliation.md) | | `wiki/interface/context-menu.md` | 2026-07-18 | finding | re-audit: shared legality, executable-only human rows, local-vs-strategic ownership, frontend menu parity, and exact person-entry paths still verify; current mirrors across the root doorway, interface, Intel, Schedules, Economy, Cursor, Messages, the owner title, and one core comment retained parts of the superseded five-view/READY contract. All now name the implemented six-view boundary, and recurrence promoted the roster/status to the corpus gate — [log](../log/2026-07-18-context-menu-current-mirrors.md) | -| `wiki/mechanics/personas.md` | 2026-07-18 | finding | the stored contradiction records were observer-local, but runtime still derived one global numeric score across every witness, automatically burned lifecycle when any witness reached zero, exposed that percentage in PEOPLE/PERSONAS/Moonlight/build receipts, and converted every forged builder's fallout together. Replaced the scalar/damage paths with one coarse `integrity_for(persona, observer)` read, kept local break separate from global lifecycle, bound every social/build/institutional consequence to its exact observer, projected named bands with provenance, removed stale migration-era claims, and pinned cross-observer isolation plus UI/build behavior — [log](../log/2026-07-18-persona-observer-integrity.md) | +| `wiki/mechanics/personas.md` | 2026-07-18 | finding | observer-local integrity is now derived from each witness's contradiction records without a global scalar or automatic lifecycle burn — [integrity log](../log/2026-07-18-persona-observer-integrity.md). The same re-audit found criterion 6 still overclaimed: `PersonaGrant` persists, expires, revokes, and leaves institutional evidence, while no owner system consumes it and `allows_action` gates only on the archetype's pre-grant registry. Downgraded the work order to IN PROGRESS until each protocol's grant creates or enables real topology — [grant log](../log/2026-07-18-persona-grant-topology-audit.md) | | `wiki/interface/views.md` + representation docs | 2026-07-18 | clean | re-audit: criterion 1's pin stands (`opens_digital_and_flips_without_moving_frontend_or_sim_state`, sim-state hash across flips), the view remains frontend-only and absent from saves, shared anchors and the fog contract re-verified through the same-day cursor.md audit, and the stale material-default code comments were trued the same day (ROADMAP order-27 row) — [prior log](../log/2026-07-14-terminal-view-dialects.md) | | `wiki/mechanics/day-job.md` | 2026-07-18 | finding | re-audit: band ramp, strikes, cadence, origin lean, `email_channel_blocker`, the third-strike last-chance interrupt, and the pilot tests (`pilot_shutdown_ends_the_run`, `third_pilot_strike_interrupts_the_ladder_with_the_last_chance_response`, round-trip) all verify; the drift was the trust-unlock prose listing a fourth unlock ("longer leash on job deadlines") with no code counterpart — now marked designed-not-yet-runtime, with email/lax-sampling/quota named as the shipped set | | `wiki/mechanics/core.md` | 2026-07-18 | finding | re-audit: criteria 2-5 pins still hold (`overhead_charged_before_allocation`, `loss_with_fallback_rolls_back`, `migration_takes_time_and_moves_host`), the 2026-07-18 current-version-only status note matches save.rs, and criterion 1 stays honestly deferred to rollback; the gap was criterion 6 — the spec demands storage/host capability rejection at fallback designation, but B1 machines carry no capability body and `add_fallback_at` accepts any spare, with no deferral note; status note now marks criterion 6 decided-not-yet-runtime, dispatched to hardware-capability-bodies | -- 2.51.2