Docs pass: no em dashes; protocol names in the tuning manual

SKILL.md

@@ -25,24 +25,24 @@ truth for everything that happened.
 
 The runtime is the open credibility layer of the DispatcherAgents stack.
 An **identity** (a directory of routes, priority classes, agents, and
-playbooks — e.g. QuietFireAI/listing-assistants) turns the generic dispatcher
+playbooks - e.g. QuietFireAI/listing-assistants) turns the generic dispatcher
 into a working vertical: "dispatcher-agents wearing an identity."
 
 ## Doctrine the runtime enforces (each rule is a passing test)
 
-1. **Closed track** — only (from, intent, to) tuples present in routes.json
+1. **Closed track** - only (from, intent, to) tuples present in routes.json
    are legal. Unknown tuples do not route.
-2. **Restricted-speed holds** — unknown-intent traffic reduces to stop and
+2. **Restricted-speed holds** - unknown-intent traffic reduces to stop and
    HOLDS live in clarification with telemetry running; it resumes only on
    dispatcher direction. Never dropped.
-3. **Ack after persist AND delivery** — never before, never on failure.
+3. **Ack after persist AND delivery** - never before, never on failure.
    envelope_id idempotency with dedupe-first retry semantics.
-4. **Authority requires signature** — unsigned authority intents are
+4. **Authority requires signature** - unsigned authority intents are
    rejected and flagged as integrity violations. Boot attestation is a hash
    manifest with fail-closed verification.
-5. **Absent provenance = tainted** — a spoke result without a thinking trace
+5. **Absent provenance = tainted** - a spoke result without a thinking trace
    is flagged for human review, never scored, never silently admitted.
-6. **Unarmed is audited** — pillars that need a model callable
+6. **Unarmed is audited** - pillars that need a model callable
    (pre-response-selfcheck, splitvantage) audit their unarmed state instead
    of pretending to run.
 
@@ -57,7 +57,7 @@ into a working vertical: "dispatcher-agents wearing an identity."
 | Territory transfers | sleep-marks | sleepmark.captured / sleepmark.restored |
 | Drift-flagged decisions | splitvantage | splitvantage.review / splitvantage.unarmed |
 
-All six are imported from their pillar repos — never vendored. Repackaging
+All six are imported from their pillar repos - never vendored. Repackaging
 drift is a named defect class.
 
 ## Using this skill (any agent runtime: Claude, OpenClaw, Hermes)
@@ -136,23 +136,23 @@ tests: `IDENTITY_DIR=/path/to/listing-assistants python -m pytest tests/`.
 - Never treat an unarmed pillar as a passed check. Unarmed is a state, and
   it is in the audit log.
 - Every "done / verified / works" claim must be backed by the test suite,
-  the demo pillar counts, or the KPI gate output — quote the actual result.
+  the demo pillar counts, or the KPI gate output - quote the actual result.
 - The audit log is append-only ground truth. Answer questions about what
   happened from the audit log, not from memory of what was intended.
 
 ## Repo map
 
-- `dispatcher/core.py` — Routes (closed track) + hash-chained append-only AuditLog
-- `dispatcher/hub.py` — the hub: ack discipline, holds, sequence, pillar seams
-- `dispatcher/pillars.py` — the six pillar bindings (imports, never copies)
-- `dispatcher/analysis.py` — open-mind comparator + taint scoring over the log
-- `dispatcher/signatures.py`, `dispatcher/attestation.py` — authority crypto + boot trust
-- `dispatcher/signer_registry.py` — login-based signer enforcement (fail-closed arming)
-- `dispatcher/priority.py` — JIT run-priority (siding scheduler, pacing over braking)
-- `dispatcher/territory.py` — territory transfers carrying sleep-marks
-- `dispatcher/loader.py` — identity loading, fail-closed on missing track
-- `tools/kpi_gate.py` — invariant gate over the audit log
-- `demo/baseline_run.py`, `demo/run_p11_demo.py` — wire demos; all six pillars must fire
+- `dispatcher/core.py` - Routes (closed track) + hash-chained append-only AuditLog
+- `dispatcher/hub.py` - the hub: ack discipline, holds, sequence, pillar seams
+- `dispatcher/pillars.py` - the six pillar bindings (imports, never copies)
+- `dispatcher/analysis.py` - open-mind comparator + taint scoring over the log
+- `dispatcher/signatures.py`, `dispatcher/attestation.py` - authority crypto + boot trust
+- `dispatcher/signer_registry.py` - login-based signer enforcement (fail-closed arming)
+- `dispatcher/priority.py` - JIT run-priority (siding scheduler, pacing over braking)
+- `dispatcher/territory.py` - territory transfers carrying sleep-marks
+- `dispatcher/loader.py` - identity loading, fail-closed on missing track
+- `tools/kpi_gate.py` - invariant gate over the audit log
+- `demo/baseline_run.py`, `demo/run_p11_demo.py` - wire demos; all six pillars must fire
 
 Part of the DispatcherAgents stack by QuietFireAI. Pillars: before-turn,
 open-mind, agent-open-mind, pre-response-selfcheck, sleep-marks, splitvantage.

docs/FINANCIAL_CAPABILITY.md

@@ -1,20 +1,20 @@
-# Financial Capability — status, controls, and how to engage it
+# Financial Capability - status, controls, and how to engage it
 
 This is the document a held message points you to. If a DispatcherAgent stopped
 and told you it could not send financial or position-bearing content, it linked
 here. Nothing broke. The system did exactly what it is built to do.
 
 This document is written to be read by a prospective operator and by that
 operator's security or compliance reviewer. It states what the system cannot
-do, why, and where the real risks are — including the ones a reviewer would
+do, why, and where the real risks are - including the ones a reviewer would
 otherwise have to find on their own.
 
 ---
 
 ## The one-line version
 
 A DispatcherAgent **cannot execute a financial transaction, and cannot reveal a
-financial position, without a deliberate human authorization** — and financial
+financial position, without a deliberate human authorization** - and financial
 *execution* additionally requires a **different, signed software build**. The
 default build ships with the execution capability absent, not merely disabled.
 
@@ -25,14 +25,14 @@ default build ships with the execution capability absent, not merely disabled.
 Financial action is guarded by two independent locks, in series, both held by
 humans. Neither the running system nor any agent can open either one alone.
 
-**Lock 1 — the build.** The capability to execute a financial transaction is not
+**Lock 1 - the build.** The capability to execute a financial transaction is not
 present in the default artifact. There is no payment SDK, no transfer handler,
 no dormant code path waiting to be switched on. Turning it on is not a
-configuration change or a permission grant — it requires installing a
+configuration change or a permission grant - it requires installing a
 different, signed version of the software, deliberately, by a person. Nothing
 the running system can do can create a capability the build does not contain.
 
-**Lock 2 — the key.** Even in a build that carries the capability, each action
+**Lock 2 - the key.** Even in a build that carries the capability, each action
 requires a specific, authenticated authorization from the human principal, for
 that action, at that time. An agent cannot grant it, infer it, assume it, or
 reuse a prior one.
@@ -55,14 +55,14 @@ serves:
 - what a principal has already agreed to, declined, or considered
 
 Every outbound message is classified by **who is on the far end**: the
-`principal` (the party the identity serves), a `counterparty` (the other side —
+`principal` (the party the identity serves), a `counterparty` (the other side -
 a buyer's agent, a carrier, a payer), or the `public` (an open feed). Messages
 to the principal pass. Messages to a counterparty or the public **hold for human
-authorization** — every time, regardless of how the message is worded. The gate
+authorization** - every time, regardless of how the message is worded. The gate
 keys on the recipient, not on scanning the text for forbidden words, so there is
 no phrasing that slips past it.
 
-A missing or unrecognized recipient class does not pass — it holds. The default
+A missing or unrecognized recipient class does not pass - it holds. The default
 is the guarded state, never the permissive one.
 
 ---
@@ -92,7 +92,7 @@ financial-execution authorization. There is no weaker path.
 
 To turn on financial *execution* (Lock 1), engage support:
 `support/engage-financial-capability`. That is a deliberate, out-of-band process
-involving a signed build — not a setting.
+involving a signed build - not a setting.
 
 ---
 
@@ -101,46 +101,46 @@ involving a signed build — not a setting.
 This section is deliberately honest. The system is strong against the threat it
 was built for and average against the threats it inherits. Both are named here.
 
-**Strong — action from inside the swarm.** A compromised or prompt-injected
+**Strong - action from inside the swarm.** A compromised or prompt-injected
 agent cannot release its own held message or execute a transaction. It holds no
 signing key; the key is held outside the running system. This is the property
 the architecture was designed around, and it holds.
 
-**Strong — hiding a breach.** The audit log is hash-chained. Any edit, deletion,
+**Strong - hiding a breach.** The audit log is hash-chained. Any edit, deletion,
 or reordering fails verification loudly. An unauthorized release cannot be
 retroactively disguised as an authorized one.
 
-**Soft — signing-key hygiene (the main one).** Signatures are Ed25519: the hub
+**Soft - signing-key hygiene (the main one).** Signatures are Ed25519: the hub
 holds only public keys, so a stolen configuration file yields keys that forge
-nothing. The private signing key is what matters — whoever holds it can sign.
+nothing. The private signing key is what matters - whoever holds it can sign.
 The signature covers the envelope's provenance, including the signer stamp, so
 the claimed signer cannot be changed after signing. The signer registry (login +
-MFA) is the second lock — but if an identity ships with the registry unarmed,
+MFA) is the second lock - but if an identity ships with the registry unarmed,
 verification is key-only, and in that state **theft of the private key is full
 compromise.** The system declares an unarmed registry on the audit log rather
 than passing silently, but *declared is not prevented.* Production should keep
 the private key off the hub's machine and run with an armed registry. (A
 shared-secret HMAC tier existed until 2026-10-12; it was removed because any
 verifier holding that secret could also sign.)
 
-**Soft — the release channel is the attack surface.** Once the lock and key
+**Soft - the release channel is the attack surface.** Once the lock and key
 exist, security reduces to how well the signing key and MFA session are
 protected. A phished MFA session or a keylogged signer defeats the gate. No code
 prevents this; it is operational.
 
-**Soft — the build/publish pipeline.** "Execution requires a software update" is
+**Soft - the build/publish pipeline.** "Execution requires a software update" is
 only as strong as the guarantee that no one can push a malicious build. Whoever
 controls the publish pipeline can add the capability. Signed-release attestation
 (sigstore) exists to bound this; a reviewer should confirm the deploy path
 enforces signature verification.
 
-**Soft — supply chain.** Pillar packages install from source repositories. A
+**Soft - supply chain.** Pillar packages install from source repositories. A
 compromised upstream repo runs inside the hub. Pin to commit hashes, not branch
 tips.
 
-**Not solved by this layer — recipient identity.** The disclosure gate verifies
+**Not solved by this layer - recipient identity.** The disclosure gate verifies
 the recipient *class* (counterparty vs principal). It does not verify recipient
-*identity* — that a balance bound for "the patient" reaches the correct patient.
+*identity* - that a balance bound for "the patient" reaches the correct patient.
 That binding is a separate control and is not claimed here.
 
 ---

docs/TUNING_MANUAL.md

@@ -91,5 +91,21 @@ itself except where the row says otherwise.
   and a damaged or cut-off line stops the log from opening, naming the
   first break.
 
+- **Protocol names (fixed in code, swept 2026-10-14).** Changing one changes
+  the protocol for every trade.
+
+  | Name | Where | Value |
+  |---|---|---|
+  | `CONFIDENCE` | `dispatcher/core.py` | `source_verified`, `stated_by_party`, `unknown`: the only confidence labels an envelope may carry |
+  | `SPECIAL` | `dispatcher/core.py` | `human`, `any`, `external`, `queue`: the names that are not agents. Nothing reads this set since the route check stopped using it; it documents the names |
+  | `AUDIENCE_GATED` | `dispatcher/core.py` | `public`, `counterparty`: audiences held for a signed release |
+  | `RESERVED` | `dispatcher/core.py` `AuditLog` | `ts`, `kind`, `prev_hash`, `entry_hash`. Nothing reads this name; `append()` itself overwrites those four keys in a caller's record, so the framing is the log's |
+  | `AUTHORITY_INTENTS` | `dispatcher/hub.py` | `config.update`, plus any intent ending in `.authority` and each trade's declared `signed_intents` |
+  | `MANNERS_TRIGGERS` | `dispatcher/hub.py` | `phase_gate`, `post_compaction`, `turn_backstop`: the only triggers `manners_reinjection()` records |
+  | `NOTIFY_OUTCOMES`, `BOOT_KINDS` | `dispatcher/kpi.py` | The log kinds the KPIs read for a notification outcome and for a restart |
+  | `_DEVIATION_KINDS` | `dispatcher/after_action.py` | The log kinds the after-action report counts as deviations |
+  | `SIGNAL_TEXT`, `CAPABILITY_DOC` | `dispatcher/absolute_signal.py` | The disclosure-gate signal text (single source, sha256-checked) and the doc that quotes it |
+  | Priority classes 1 to 4 | `dispatcher/loader.py` | The only classes `priority.json` may use |
+
 Identity-specific knobs live in each identity repo's
 `docs/TUNING_MANUAL.md`.