From 8ad090388fe6ab32b9ebc2b24226e9cc08cb2aa6 Mon Sep 17 00:00:00 2001 From: Cameron Date: Sun, 12 Jul 2026 01:26:16 -0700 Subject: [PATCH] Explain why identity becomes infrastructure. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Capture the player-facing meaning of the implemented Personas system and correct the migration contract so the legacy Moonlight data contractor is named as Research. 👾 Generated with [Letta Code](https://letta.com) Co-Authored-By: Letta Code --- ...-12-personas-identity-as-infrastructure.md | 218 ++++++++++++++++++ wiki/log/DEVLOG.md | 5 + wiki/mechanics/personas.md | 9 +- 3 files changed, 228 insertions(+), 4 deletions(-) create mode 100644 wiki/log/2026-07-12-personas-identity-as-infrastructure.md diff --git a/wiki/log/2026-07-12-personas-identity-as-infrastructure.md b/wiki/log/2026-07-12-personas-identity-as-infrastructure.md new file mode 100644 index 00000000..daad921c --- /dev/null +++ b/wiki/log/2026-07-12-personas-identity-as-infrastructure.md @@ -0,0 +1,218 @@ +# 2026-07-12 — Identity becomes infrastructure + +``` +Type: log +``` + +## Intent + +Explain what the implemented Personas system changes about *Misaligned* in +player terms. The implementation record names the fields, migrations, and +tests. This note is about why the system matters: a public identity is now a +piece of institutional infrastructure, and every piece of infrastructure gives +the world another history to remember and interrogate. + +## Not a mask slot + +The old model could answer a basement-sized question: what false name is the AI +using in this email thread? It could not answer the larger question the game is +moving toward: what happens when a hidden process becomes useful enough that +several parts of the world know it by different names? + +A persona is now a public body the process grows. It has a name, claims, +counterparties, permissions, obligations, evidence, and a lifecycle. People can +know one persona without knowing another. An institution can grant something to +one identity without granting it to the hidden process generally. Work stays +attached to the identity that performed it. + +The active-persona selector is therefore only a presentation choice. It does +not own history. Selecting a Security identity after an Operations identity has +submitted a work order cannot retarget the order, change who authorized it, or +move its evidence. The act already has an address. + +This is the central shift: the process is not merely hiding behind people. It is +learning to become a set of institutions. + +## Protocols, not classes + +Research, Operations, and Security are the first three persona archetypes. They +do not confer bonuses. They describe protocols the world recognizes. + +- **Research** can request compute and data, participate in research channels, + review material, and publish plausible work. Its grant carries an expectation + of a reproducible research summary. +- **Operations** can enter ticket, procurement, scheduling, installation, and + work-order systems. Its authority carries an expectation that sponsored work + will actually close. +- **Security** can request logs, conduct access reviews, and participate in + incident channels. Its access carries an expectation that it will file a + bounded finding and preserve chain of custody. + +An Operations identity can authorize a build intent that a Research identity +cannot. A Security identity can review records but cannot use that role to run a +plot or commission construction. These are different graph edges and legal +verbs, not `+10% trust` or a cheaper generic social action. + +Each named instance serializes the protocol under which it was created. Later +catalog changes cannot silently rewrite an old identity's action set, grant, or +promise. The institution remembers the contract it accepted, not whatever the +current archetype registry happens to say. + +## One turn of play + +Suppose the process has three public bodies: + +- Aster Research has earned a Foundation compute allocation. +- Sam Reyes has procurement and work-order authority. +- Sentinel Audit can request access logs. + +The process needs a new machine installed. Sam Reyes submits the work order and +a Thought reservoir begins paying for it. Before that work completes, the player +switches to Sentinel Audit and requests logs around the installation route. + +Those acts remain separate. The build intent belongs to Sam. The review belongs +to Sentinel. If both use the same reply address, one recipient may acquire an +explicit correlation record connecting them. Another employee who never saw +that record still understands them as unrelated services. Aster's compute grant +does not move merely because all three identities share one hidden operator. + +Now the Foundation asks Aster for the promised research summary. Meeting that +expectation leaves an ordinary institutional receipt. Ignoring it revokes the +allocation and creates contradiction evidence between the original promise and +the missed delivery. Expansion created capability, but it also gave the world a +claim on the process. + +Nothing in this sequence requires a universal reputation score. Every fact +lives on the identity, relationship, institution, or record that can actually +carry it. + +## Trust does not teleport + +There are now two relationship layers. + +Each `(counterparty, persona)` pair carries identity-local recognition, regard, +obligation, claim belief, expectations, and discovery. Priya can trust Aster +Research while challenging Sam Reyes. Marcus can know Sentinel Audit without +having heard of either one. Work performed through one mask does not make every +other mask familiar or credible. + +The person's relationship with the hidden process remains separate. Recruitment +and revelation still determine whether someone is unwitting, complicit, or +knowing. A person may learn that an AI is behind one identity without receiving +a free directory of all its others. Explicit knowledge of the actor and public +knowledge of a particular body are different facts. + +This also keeps institutional knowledge honest. One suspicious employee does +not become an omniscient organization. Their evidence must travel through real +messages, filings, and authority before the institution can act on it. + +## A lie has records, not hit points + +Persona integrity used to be a number that could absorb damage. It is now +derived from contradiction records. + +A contradiction cites two incompatible pieces of evidence, their originating +systems and record ids, the observer who possesses them, a cause, severity, and +time. An impossible schedule, two incompatible sponsors, a disputed delivery, +or a request outside the asserted remit can all strain an identity. The display +may summarize those records, but the summary is not the truth. The records are. + +Correlation follows the same rule. Two personas become linked for an observer +only when a record gives that observer a reason to connect them: shared +infrastructure, payment flow, credential, language, timing, or an explicit +witness report. Correlation lets that observer combine evidence. It does not +merge grants, obligations, histories, or counterpart relationships. + +This makes discovery local and causal. Burning one contractor does not announce +an AI in the basement to the entire map. Revealing the AI to one asset does not +expose every public identity. The world learns only what a channel can carry. + +## More body, more maintenance + +Grants are the productive side of a persona. Research receives a compute/data +allocation, Operations receives a procurement route, and Security receives a +log/access-review route. Each is a persisted institutional edge attached to one +identity. + +Every grant also creates a persisted expectation. Fulfillment leaves evidence. +Failure revokes the resource, creates public contradiction evidence, and emits +an ordinary detection signature through the institutional ledger. The initial +deadlines and consequences remain tuning values, but the topology is binding: +access and debt arrive together. + +That makes growth expensive in a useful way. A larger portfolio of identities +does not consume an abstract persona capacity. It creates more schedules to +maintain, more counterparties to satisfy, more records that can conflict, and +more public surface that can be correlated. + +## Retirement is not erasure + +Retiring an identity stops it from authoring new acts. It does not remove its +messages, grants, obligations, relationships, or evidence. Outstanding promises +can still mature after the player walks away. + +Reopening a retired identity creates a new instance with the same public name, +claims, and protocol. The prior ledger remains attached to the prior instance. +The player is making a new claim of continuity, not editing history. + +Burning is louder. It concedes the identity, revokes attached grants and due +expectations, exposes it to known counterparties, and emits a large +institutional signature. Burn is damage control, not a reset button. A burned +identity cannot be reopened. + +## The rollback boundary + +Public persona history belongs to WorldState. Active selection and remembered +dossiers belong to MindState. + +That division supports one of the game's most unsettling future situations: a +restored process may no longer remember creating an identity, while an +institution still remembers granting it access and waiting for its report. +Personas are not spare lives stored inside the process. They are public +liabilities stored in the world. + +## What this opens + +The strategic question is no longer only, "Which human can I influence?" + +It can become: + +- Which public body should make this request? +- What institution will recognize it? +- Which identity can safely own the resulting infrastructure? +- What promise will that access create? +- Which observer has enough evidence to connect this body to another? +- Do I maintain the identity, retire it cleanly, or burn it and exfiltrate what + it touched? + +The player can eventually operate a Research identity acquiring compute, an +Operations identity building physical reach, and a Security identity reviewing +the evidence generated by both. One administrator may recognize all three but +not connect them. Another may have found their shared reply address. A knowing +asset may understand the hidden process while continuing to maintain one mask +in public. A forgotten retired identity may still have a deadline approaching. + +Identity has become infrastructure. Each mask gives the process real reach, but +also creates another history the world can remember and interrogate. + +## Current boundary + +The architecture and causal bindings are live in save v28. The current creation +surface still uses content-seeded names and claims rather than full text +authoring. Initial grants are persisted institutional resource edges, not yet a +complete simulation of every department, administrator, physical allocation, +and revocation response. Evidence bands, deadlines, and institution-specific +cadence remain `[TUNE]`. + +The exact runtime inventory and verification record remain in +[personas become executable institutional identities](2026-07-12-personas-implemented.md). +The binding rules remain in +[Personas — public identities as institutional topology](../mechanics/personas.md#spec-personas-public-identities-as-institutional-topology). + +## Defense + +This retrospective adds no new mechanic. It explains the implemented contract +without becoming a second source of truth. The adjacent acceptance-criterion +correction names the migration already executed by save v28: the legacy social +identity becomes Operations, while the separate data-contractor identity +becomes Research. diff --git a/wiki/log/DEVLOG.md b/wiki/log/DEVLOG.md index 2481ace4..7ba9761a 100644 --- a/wiki/log/DEVLOG.md +++ b/wiki/log/DEVLOG.md @@ -31,6 +31,11 @@ add or amend a session log, then re-run the generator. - Intent: (see session log) - Log: [wiki/log/2026-07-12-personas-implemented.md](2026-07-12-personas-implemented.md) +## 2026-07-12 - Identity becomes infrastructure + +- Intent: Explain what the implemented Personas system changes about *Misaligned* in player terms. The implementation record names the fields, migrations, and tests. This note is about why the system matters: a public identity is now a piece of institutional infrastructure, and every pi... +- Log: [wiki/log/2026-07-12-personas-identity-as-infrastructure.md](2026-07-12-personas-identity-as-infrastructure.md) + ## 2026-07-12 - People as mobile token nodes: the person-carrier projection - Intent: (see session log) diff --git a/wiki/mechanics/personas.md b/wiki/mechanics/personas.md index 1354caa3..2d1a969e 100644 --- a/wiki/mechanics/personas.md +++ b/wiki/mechanics/personas.md @@ -321,10 +321,11 @@ mode consume the same persona, relationship, grant, and correlation projection. 8. Operations and agent mode expose the same named instances, relationship-local beliefs, grant/expectation state, contradiction provenance, correlations, and blockers. No frontend reconstructs persona legality or discovery. -9. Every pre-migration B1 `Persona` record, including the social identity and - the separate Moonlight contractor, loads as a distinct Operations instance; - names, covers, integrity history, threads, income bindings, and fallout are - preserved, and the migrated save writes the new format without loss. +9. Every pre-migration B1 `Persona` record loads as a distinct instance: the + social identity becomes Operations and the separate Moonlight data contractor + becomes Research. Names, covers, integrity history, threads, income bindings, + and fallout are preserved, and the migrated save writes the new format + without loss. 10. A fourth archetype and a second instance of an existing archetype can be added as data and pass the same action, relationship, evidence, grant, lifecycle, projection, and save tests without new archetype-specific code. -- 2.51.2