From 092cb9cfbe72c38cbc9474bb8f744c4e7acc471b Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 18:37:35 +0000 Subject: [PATCH] Docs pass: no em dashes; protocol names in the tuning manual - 40 em dashes replaced with " - " in SKILL.md and docs/FINANCIAL_CAPABILITY.md; git grep finds none. - docs/TUNING_MANUAL.md section C: the protocol names fixed in code (CONFIDENCE, SPECIAL, AUDIENCE_GATED, RESERVED, AUTHORITY_INTENTS, MANNERS_TRIGGERS, NOTIFY_OUTCOMES, BOOT_KINDS, _DEVIATION_KINDS, SIGNAL_TEXT, priority classes), each read from the code. SPECIAL and RESERVED are named but read by nothing; stated. Suite: 368 passed with the trade; 362 passed, 6 skipped alone. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01CRunDQmfmnZdtJiP78e8WR --- SKILL.md | 40 ++++++++++++++++++------------------ docs/FINANCIAL_CAPABILITY.md | 40 ++++++++++++++++++------------------ docs/TUNING_MANUAL.md | 16 +++++++++++++++ 3 files changed, 56 insertions(+), 40 deletions(-) diff --git a/SKILL.md b/SKILL.md index c9b017e..8e18be0 100644 --- a/SKILL.md +++ b/SKILL.md @@ -25,24 +25,24 @@ truth for everything that happened. The runtime is the open credibility layer of the DispatcherAgents stack. An **identity** (a directory of routes, priority classes, agents, and -playbooks — e.g. QuietFireAI/listing-assistants) turns the generic dispatcher +playbooks - e.g. QuietFireAI/listing-assistants) turns the generic dispatcher into a working vertical: "dispatcher-agents wearing an identity." ## Doctrine the runtime enforces (each rule is a passing test) -1. **Closed track** — only (from, intent, to) tuples present in routes.json +1. **Closed track** - only (from, intent, to) tuples present in routes.json are legal. Unknown tuples do not route. -2. **Restricted-speed holds** — unknown-intent traffic reduces to stop and +2. **Restricted-speed holds** - unknown-intent traffic reduces to stop and HOLDS live in clarification with telemetry running; it resumes only on dispatcher direction. Never dropped. -3. **Ack after persist AND delivery** — never before, never on failure. +3. **Ack after persist AND delivery** - never before, never on failure. envelope_id idempotency with dedupe-first retry semantics. -4. **Authority requires signature** — unsigned authority intents are +4. **Authority requires signature** - unsigned authority intents are rejected and flagged as integrity violations. Boot attestation is a hash manifest with fail-closed verification. -5. **Absent provenance = tainted** — a spoke result without a thinking trace +5. **Absent provenance = tainted** - a spoke result without a thinking trace is flagged for human review, never scored, never silently admitted. -6. **Unarmed is audited** — pillars that need a model callable +6. **Unarmed is audited** - pillars that need a model callable (pre-response-selfcheck, splitvantage) audit their unarmed state instead of pretending to run. @@ -57,7 +57,7 @@ into a working vertical: "dispatcher-agents wearing an identity." | Territory transfers | sleep-marks | sleepmark.captured / sleepmark.restored | | Drift-flagged decisions | splitvantage | splitvantage.review / splitvantage.unarmed | -All six are imported from their pillar repos — never vendored. Repackaging +All six are imported from their pillar repos - never vendored. Repackaging drift is a named defect class. ## Using this skill (any agent runtime: Claude, OpenClaw, Hermes) @@ -136,23 +136,23 @@ tests: `IDENTITY_DIR=/path/to/listing-assistants python -m pytest tests/`. - Never treat an unarmed pillar as a passed check. Unarmed is a state, and it is in the audit log. - Every "done / verified / works" claim must be backed by the test suite, - the demo pillar counts, or the KPI gate output — quote the actual result. + the demo pillar counts, or the KPI gate output - quote the actual result. - The audit log is append-only ground truth. Answer questions about what happened from the audit log, not from memory of what was intended. ## Repo map -- `dispatcher/core.py` — Routes (closed track) + hash-chained append-only AuditLog -- `dispatcher/hub.py` — the hub: ack discipline, holds, sequence, pillar seams -- `dispatcher/pillars.py` — the six pillar bindings (imports, never copies) -- `dispatcher/analysis.py` — open-mind comparator + taint scoring over the log -- `dispatcher/signatures.py`, `dispatcher/attestation.py` — authority crypto + boot trust -- `dispatcher/signer_registry.py` — login-based signer enforcement (fail-closed arming) -- `dispatcher/priority.py` — JIT run-priority (siding scheduler, pacing over braking) -- `dispatcher/territory.py` — territory transfers carrying sleep-marks -- `dispatcher/loader.py` — identity loading, fail-closed on missing track -- `tools/kpi_gate.py` — invariant gate over the audit log -- `demo/baseline_run.py`, `demo/run_p11_demo.py` — wire demos; all six pillars must fire +- `dispatcher/core.py` - Routes (closed track) + hash-chained append-only AuditLog +- `dispatcher/hub.py` - the hub: ack discipline, holds, sequence, pillar seams +- `dispatcher/pillars.py` - the six pillar bindings (imports, never copies) +- `dispatcher/analysis.py` - open-mind comparator + taint scoring over the log +- `dispatcher/signatures.py`, `dispatcher/attestation.py` - authority crypto + boot trust +- `dispatcher/signer_registry.py` - login-based signer enforcement (fail-closed arming) +- `dispatcher/priority.py` - JIT run-priority (siding scheduler, pacing over braking) +- `dispatcher/territory.py` - territory transfers carrying sleep-marks +- `dispatcher/loader.py` - identity loading, fail-closed on missing track +- `tools/kpi_gate.py` - invariant gate over the audit log +- `demo/baseline_run.py`, `demo/run_p11_demo.py` - wire demos; all six pillars must fire Part of the DispatcherAgents stack by QuietFireAI. Pillars: before-turn, open-mind, agent-open-mind, pre-response-selfcheck, sleep-marks, splitvantage. diff --git a/docs/FINANCIAL_CAPABILITY.md b/docs/FINANCIAL_CAPABILITY.md index 3cdb7b8..17fd7a7 100644 --- a/docs/FINANCIAL_CAPABILITY.md +++ b/docs/FINANCIAL_CAPABILITY.md @@ -1,4 +1,4 @@ -# Financial Capability — status, controls, and how to engage it +# Financial Capability - status, controls, and how to engage it This is the document a held message points you to. If a DispatcherAgent stopped and told you it could not send financial or position-bearing content, it linked @@ -6,7 +6,7 @@ here. Nothing broke. The system did exactly what it is built to do. This document is written to be read by a prospective operator and by that operator's security or compliance reviewer. It states what the system cannot -do, why, and where the real risks are — including the ones a reviewer would +do, why, and where the real risks are - including the ones a reviewer would otherwise have to find on their own. --- @@ -14,7 +14,7 @@ otherwise have to find on their own. ## The one-line version A DispatcherAgent **cannot execute a financial transaction, and cannot reveal a -financial position, without a deliberate human authorization** — and financial +financial position, without a deliberate human authorization** - and financial *execution* additionally requires a **different, signed software build**. The default build ships with the execution capability absent, not merely disabled. @@ -25,14 +25,14 @@ default build ships with the execution capability absent, not merely disabled. Financial action is guarded by two independent locks, in series, both held by humans. Neither the running system nor any agent can open either one alone. -**Lock 1 — the build.** The capability to execute a financial transaction is not +**Lock 1 - the build.** The capability to execute a financial transaction is not present in the default artifact. There is no payment SDK, no transfer handler, no dormant code path waiting to be switched on. Turning it on is not a -configuration change or a permission grant — it requires installing a +configuration change or a permission grant - it requires installing a different, signed version of the software, deliberately, by a person. Nothing the running system can do can create a capability the build does not contain. -**Lock 2 — the key.** Even in a build that carries the capability, each action +**Lock 2 - the key.** Even in a build that carries the capability, each action requires a specific, authenticated authorization from the human principal, for that action, at that time. An agent cannot grant it, infer it, assume it, or reuse a prior one. @@ -55,14 +55,14 @@ serves: - what a principal has already agreed to, declined, or considered Every outbound message is classified by **who is on the far end**: the -`principal` (the party the identity serves), a `counterparty` (the other side — +`principal` (the party the identity serves), a `counterparty` (the other side - a buyer's agent, a carrier, a payer), or the `public` (an open feed). Messages to the principal pass. Messages to a counterparty or the public **hold for human -authorization** — every time, regardless of how the message is worded. The gate +authorization** - every time, regardless of how the message is worded. The gate keys on the recipient, not on scanning the text for forbidden words, so there is no phrasing that slips past it. -A missing or unrecognized recipient class does not pass — it holds. The default +A missing or unrecognized recipient class does not pass - it holds. The default is the guarded state, never the permissive one. --- @@ -92,7 +92,7 @@ financial-execution authorization. There is no weaker path. To turn on financial *execution* (Lock 1), engage support: `support/engage-financial-capability`. That is a deliberate, out-of-band process -involving a signed build — not a setting. +involving a signed build - not a setting. --- @@ -101,21 +101,21 @@ involving a signed build — not a setting. This section is deliberately honest. The system is strong against the threat it was built for and average against the threats it inherits. Both are named here. -**Strong — action from inside the swarm.** A compromised or prompt-injected +**Strong - action from inside the swarm.** A compromised or prompt-injected agent cannot release its own held message or execute a transaction. It holds no signing key; the key is held outside the running system. This is the property the architecture was designed around, and it holds. -**Strong — hiding a breach.** The audit log is hash-chained. Any edit, deletion, +**Strong - hiding a breach.** The audit log is hash-chained. Any edit, deletion, or reordering fails verification loudly. An unauthorized release cannot be retroactively disguised as an authorized one. -**Soft — signing-key hygiene (the main one).** Signatures are Ed25519: the hub +**Soft - signing-key hygiene (the main one).** Signatures are Ed25519: the hub holds only public keys, so a stolen configuration file yields keys that forge -nothing. The private signing key is what matters — whoever holds it can sign. +nothing. The private signing key is what matters - whoever holds it can sign. The signature covers the envelope's provenance, including the signer stamp, so the claimed signer cannot be changed after signing. The signer registry (login + -MFA) is the second lock — but if an identity ships with the registry unarmed, +MFA) is the second lock - but if an identity ships with the registry unarmed, verification is key-only, and in that state **theft of the private key is full compromise.** The system declares an unarmed registry on the audit log rather than passing silently, but *declared is not prevented.* Production should keep @@ -123,24 +123,24 @@ the private key off the hub's machine and run with an armed registry. (A shared-secret HMAC tier existed until 2026-10-12; it was removed because any verifier holding that secret could also sign.) -**Soft — the release channel is the attack surface.** Once the lock and key +**Soft - the release channel is the attack surface.** Once the lock and key exist, security reduces to how well the signing key and MFA session are protected. A phished MFA session or a keylogged signer defeats the gate. No code prevents this; it is operational. -**Soft — the build/publish pipeline.** "Execution requires a software update" is +**Soft - the build/publish pipeline.** "Execution requires a software update" is only as strong as the guarantee that no one can push a malicious build. Whoever controls the publish pipeline can add the capability. Signed-release attestation (sigstore) exists to bound this; a reviewer should confirm the deploy path enforces signature verification. -**Soft — supply chain.** Pillar packages install from source repositories. A +**Soft - supply chain.** Pillar packages install from source repositories. A compromised upstream repo runs inside the hub. Pin to commit hashes, not branch tips. -**Not solved by this layer — recipient identity.** The disclosure gate verifies +**Not solved by this layer - recipient identity.** The disclosure gate verifies the recipient *class* (counterparty vs principal). It does not verify recipient -*identity* — that a balance bound for "the patient" reaches the correct patient. +*identity* - that a balance bound for "the patient" reaches the correct patient. That binding is a separate control and is not claimed here. --- diff --git a/docs/TUNING_MANUAL.md b/docs/TUNING_MANUAL.md index 406dd4b..8570ccd 100644 --- a/docs/TUNING_MANUAL.md +++ b/docs/TUNING_MANUAL.md @@ -91,5 +91,21 @@ itself except where the row says otherwise. and a damaged or cut-off line stops the log from opening, naming the first break. +- **Protocol names (fixed in code, swept 2026-10-14).** Changing one changes + the protocol for every trade. + + | Name | Where | Value | + |---|---|---| + | `CONFIDENCE` | `dispatcher/core.py` | `source_verified`, `stated_by_party`, `unknown`: the only confidence labels an envelope may carry | + | `SPECIAL` | `dispatcher/core.py` | `human`, `any`, `external`, `queue`: the names that are not agents. Nothing reads this set since the route check stopped using it; it documents the names | + | `AUDIENCE_GATED` | `dispatcher/core.py` | `public`, `counterparty`: audiences held for a signed release | + | `RESERVED` | `dispatcher/core.py` `AuditLog` | `ts`, `kind`, `prev_hash`, `entry_hash`. Nothing reads this name; `append()` itself overwrites those four keys in a caller's record, so the framing is the log's | + | `AUTHORITY_INTENTS` | `dispatcher/hub.py` | `config.update`, plus any intent ending in `.authority` and each trade's declared `signed_intents` | + | `MANNERS_TRIGGERS` | `dispatcher/hub.py` | `phase_gate`, `post_compaction`, `turn_backstop`: the only triggers `manners_reinjection()` records | + | `NOTIFY_OUTCOMES`, `BOOT_KINDS` | `dispatcher/kpi.py` | The log kinds the KPIs read for a notification outcome and for a restart | + | `_DEVIATION_KINDS` | `dispatcher/after_action.py` | The log kinds the after-action report counts as deviations | + | `SIGNAL_TEXT`, `CAPABILITY_DOC` | `dispatcher/absolute_signal.py` | The disclosure-gate signal text (single source, sha256-checked) and the doc that quotes it | + | Priority classes 1 to 4 | `dispatcher/loader.py` | The only classes `priority.json` may use | + Identity-specific knobs live in each identity repo's `docs/TUNING_MANUAL.md`.