diff --git a/wiki/log/2026-07-11-lie-tap-take-routing.md b/wiki/log/2026-07-11-lie-tap-take-routing.md new file mode 100644 index 00000000..5f0d0844 --- /dev/null +++ b/wiki/log/2026-07-11-lie-tap-take-routing.md @@ -0,0 +1,24 @@ +# LIE routing authority follows TAKE, not TAP + +``` +Type: log +``` + +- **Intent:** Correct the endpoint-jurisdiction overclaim in the controlled + region decision and capture Cameron's TAP/TAKE distinction. +- **Decided:** TAP may reveal evidence and its routing state but cannot move + it. TAKE admits exactly the taken device into the controlled graph. Unread + evidence there may route toward a reachable active LIE sink; without one it + continues toward its designated human-operated endpoint. Route cost, not + geometric distance, determines the effective nearest sink. +- **Changed:** Amended the reach ownership contract, routed-evidence and LIE + jurisdiction rules, and the cross-system flow law. Appended a correcting + decision entry rather than rewriting history. +- **Runtime impact:** None. Routed evidence and topological LIE remain design + contracts awaiting migration from the current pool/radius runtime. +- **Open tuning:** How much evidence metadata TAP reveals; whether conspicuous + deletion, falsification, or delay on a human-operated endpoint emits a new + evidence record; exact route-cost weights. +- **Checks:** `./tools/check.sh --docs` passed (corpus/wiki links, corpus-engine + and deployment fixtures, ledger consistency, project operations, and env + registry; Rust correctly skipped for docs-only scope). diff --git a/wiki/log/DEVLOG.md b/wiki/log/DEVLOG.md index e3f5c0a4..ad2e9d7d 100644 --- a/wiki/log/DEVLOG.md +++ b/wiki/log/DEVLOG.md @@ -136,6 +136,11 @@ add or amend a session log, then re-run the generator. - Intent: Repair the material half of the in-flight work-route contract. The route system correctly selected material coordinates, but Demand's blip and every material route trail were submitted to Bevy's default gizmo group, which is visible only to the flat camera. In material view, T... - Log: [wiki/log/2026-07-11-material-demand-routes.md](2026-07-11-material-demand-routes.md) +## 2026-07-11 - LIE routing authority follows TAKE, not TAP + +- Intent: (see session log) +- Log: [wiki/log/2026-07-11-lie-tap-take-routing.md](2026-07-11-lie-tap-take-routing.md) + ## 2026-07-11 - Intel processing migrates to thought sinks - Intent: (see session log) diff --git a/wiki/log/decisions/2026-07-11.md b/wiki/log/decisions/2026-07-11.md index a006d9b4..37969981 100644 --- a/wiki/log/decisions/2026-07-11.md +++ b/wiki/log/decisions/2026-07-11.md @@ -220,3 +220,23 @@ Type: log radii and binary owned-equals-healthy region status. Runtime migration from the current pool/radius model remains unimplemented. Specs: `wiki/vision/simulation-laws.md`, `wiki/mechanics/detection.md`. + +- **2026-07-11 — TAP sees evidence; TAKE gives one device routing authority.** + This corrects the endpoint detail overclaimed in the preceding LIE-region + entry. Cameron separated subscription from ownership: tapping a device can + reveal that records are present and expose useful routing/read metadata, but + it cannot move them. Taking the device admits that exact node into the + controlled graph. Eligible unread records on it may then move toward a + reachable active LIE sink through real controlled routes; taking does not + itself erase evidence or annex the surrounding foreign network. If no LIE + sink is reachable, ordinary delivery continues toward the designated + human-operated endpoint rather than waiting safely for concealment. Sink + nearness is topological — route latency, capacity, and partitions — not + geometric. A taken human endpoint remains dangerous: unread records can be + diverted, but already-read knowledge cannot, and conspicuous interference + may itself become evidence [TUNE]. Rejected: TAP as record custody, TAKE as + automatic deletion, passive safe queuing while LIE is unavailable, and + endpoint ownership silently annexing adjacent nodes. Runtime migration from + the current pool/radius model remains unimplemented. Specs: + `wiki/mechanics/reach.md`, `wiki/mechanics/detection.md`, + `wiki/mechanics/system-laws.md`. diff --git a/wiki/mechanics/detection.md b/wiki/mechanics/detection.md index 54454ced..9dab458c 100644 --- a/wiki/mechanics/detection.md +++ b/wiki/mechanics/detection.md @@ -166,26 +166,31 @@ teleported into a global pool. **Evidence is a record somewhere.** the other way (intel.md), and operating your own pipeline is how the player learns theirs — the symmetry is deliberate pedagogy, never shared storage. -- **LIE is interdiction on the path (DECIDED 2026-07-11).** Concealment +- **LIE is interdiction on the path (DECIDED 2026-07-11; TAP/TAKE + jurisdiction clarified later that day).** Concealment stops evidence before it is read: delete the noise logs, falsify the entry, delay or misroute the transit. Interdiction is positional — a LIE machine answers the evidence that sits on or passes through what it controls, and evidence that routes around your coverage gets through. This supersedes the radius-vacuum scrub as ontology (the - implemented radius runtime stands until migration). A compromised observer - endpoint is a controlled node: its unread records remain eligible for - interdiction until their read-deadlines. An uncompromised endpoint remains - outside the region even when its route is known; records that arrive there - must be caught upstream. Interception surfaces and rates are [TUNE]. + implemented radius runtime stands until migration). **TAP is perception, + not custody:** it may reveal that records exist on a foreign device, their + type, route, and read-deadline [TUNE], but it grants no authority to move or + interdict them. **TAKE admits exactly that device into the controlled + graph.** Its eligible unread records may then travel over controlled routes + toward a reachable LIE sink. TAKE does not erase records, annex adjacent + foreign nodes, or suspend ordinary delivery while concealment is absent. + Interception surfaces and rates are [TUNE]. - **The player governs coverage, not an evidence inbox (DECIDED 2026-07-11; jurisdiction resolved later that day).** A LIE machine is a standing topological service over its **controlled connected region**, not a bounded-hop radius. It draws eligible unread crimson records through the routes the player controls and spends finite concealment throughput chewing - through them before their read-deadlines. Switches, trunks, compromised - endpoints, and later inter-plane ports extend the region; a broken or - uncontrolled route partitions it. The player does not approve every ordinary - deletion or falsification one record at a time. Records become salient + through them before their read-deadlines. Taken devices, controlled switches + and trunks, and later inter-plane ports extend the region one actual node and + route at a time; TAKE never annexes a surrounding foreign network. A broken + or uncontrolled route partitions the region. The player does not approve + every ordinary deletion or falsification one record at a time. Records become salient exceptions when they route around coverage, exceed its capacity, or approach a read before interception. This is the same command problem in a basement, across a corporation, and across continents: secure a topology, watch its @@ -202,6 +207,17 @@ teleported into a global pool. **Evidence is a record somewhere.** or relocate the hot operation. Continental status such as “Latin America is offline” must emerge from this topology and capacity state, not from an arbitrary machine radius. +- **No reachable LIE means ordinary delivery (DECIDED 2026-07-11).** Taking a + device creates routing authority, not a safe holding pattern. If no active + concealment sink is reachable from a record's current node, that record keeps + moving toward its designated human-operated endpoint. A reachable sink is + selected by graph route cost — capacity, latency, and partitions — rather + than geometric distance. A weak local sink can therefore be effectively + nearer than a powerful sink across a saturated trunk. A taken human-operated + endpoint is still dangerous: unread records there may be diverted into the + concealment graph, but the human remains an observer, conspicuous deletion or + delay may emit new evidence [TUNE], and a record already read has become + knowledge no LIE can undo. - **The two ledgers stay two systems (AFFIRMED 2026-07-11).** Exposure does not merge into the player's intel buffer — "you want someone's understanding of what has actually happened to be different" diff --git a/wiki/mechanics/reach.md b/wiki/mechanics/reach.md index 2c39d258..4bf0a494 100644 --- a/wiki/mechanics/reach.md +++ b/wiki/mechanics/reach.md @@ -130,7 +130,10 @@ This is the shared contract cursor.md and detection.md rely on activation work primes one short working-level buffer, then maintaining the feed drains 8% of one medium rack's Thought output per tick [TUNE]. A starved maintenance tap stays configured but carries no sight, hearing, or intercepted - messages until Thought reaches it again. + messages until Thought reaches it again. TAP may expose the presence and + routing metadata of evidence records resident on the device [TUNE], but a + subscription has no custody: the player cannot move, delay, falsify, or delete + those records through TAP. - **Untap (AMENDED 2026-07-11):** release your subscription without changing ownership or interrupting anyone else's feed. It is immediate and leaves no new signature because the process stops receiving rather than acting on the @@ -141,7 +144,12 @@ This is the shared contract cursor.md and detection.md rely on re-checks the tap before committing. On success the owner loses the feed, the tap's standing drain closes, and the outage is an event the owner's channels notice — camera outages are literally the first thing Ray's spec lists. - Loud, fast, total. + Loud, fast, total. TAKE admits that exact node — not its foreign neighbors — + into the player's controlled graph. Eligible unread evidence resident on a + taken device may route toward a reachable active LIE sink under + detection.md's capacity/deadline law. Ownership alone neither erases nor + safely queues evidence; without reachable concealment, it continues toward + its designated human-operated endpoint. - **The player's senses (cursor.md) are exactly the union of feeds they subscribe to.** Observer witnessing (schedules.md) runs on the same coverage machinery with the same ownership data — the player is diff --git a/wiki/mechanics/system-laws.md b/wiki/mechanics/system-laws.md index d445fec5..cc292fe3 100644 --- a/wiki/mechanics/system-laws.md +++ b/wiki/mechanics/system-laws.md @@ -82,6 +82,15 @@ can be interdicted in flight — detection stops being an abstract pool and becomes one more flow under this law. The model is owned by `wiki/mechanics/detection.md`. +**Observation is not route authority (AFFIRMED 2026-07-11).** TAP observes a +foreign flow or device without granting custody over records resident there. +TAKE transfers control of one device and thereby permits its eligible unread +records to enter the controlled concealment graph; controlled routes and an +active LIE sink are still required to redirect them. Without that service the +ordinary flow toward a human-operated endpoint continues. This keeps tap, +ownership, and redirect as separate powers rather than allowing surveillance +to become suppression for free. + **Code expression.** The flow law has a shared engine — the two substrate modules `crates/misaligned-core/src/flow.rs` (`FlowGraph`: topology, reachability, the tap registry) and