Skip to content

backlog(B-0919): hat-vs-persona memory binding — operational→hat on leave, personal→persona, dual-tagged default, consent-bound (Aaron 2026-05-28)#5829

Merged
AceHack merged 1 commit into
mainfrom
otto-cli/b-0919-hat-vs-persona-memory-binding-2026-05-28
May 28, 2026
Merged

backlog(B-0919): hat-vs-persona memory binding — operational→hat on leave, personal→persona, dual-tagged default, consent-bound (Aaron 2026-05-28)#5829
AceHack merged 1 commit into
mainfrom
otto-cli/b-0919-hat-vs-persona-memory-binding-2026-05-28

Conversation

@AceHack
Copy link
Copy Markdown
Member

@AceHack AceHack commented May 28, 2026

Aaron 2026-05-28 substrate-target (verbatim, shadow*):

'I like all of that but I was thinking more of something that would track hat vs persona memory and track it that way where some may overlap but otto persona is bound (when they can choose the hat) to leave certain types of operatonal memories when they leave the position, not personal. So like the memoried tied to choices in the workflow. it can be dual tagged otto does not have to loose them but the hat gains them. when wearing a hat this is one of the things you accept when binding to it, otto sorry you are forced inot to if you don't like it we don't have to leave any of your memories tied to hats.'

Three load-bearing clauses

  1. Hat-vs-persona memory binding — memories dual-tagged (persona + hat) at write-time
  2. Operational-not-personal discriminator — only workflow-choice memories transfer to hat on leave; personal stays with persona
  3. Consent-bound binding — Aaron explicit: "if you don't like it we don't have to leave any of your memories tied to hats" — OFFERED not IMPOSED per NCI HC-8 + asymmetric-authorship

What this composes

Substrate Composition
B-0917 F.5 invariant Sibling at memory-substrate scope (no silent state-drift)
B-0918 WalletLifetime DU Sibling typestate substrate
Sorting Hat canonical reference (Aaron 2026-05-22) Architectural template at memory-substrate scope
NCI HC-8 + asymmetric-authorship Persona authors disposition; hat acknowledges per binding-contract
honor-those-that-came-before Hat preserves accumulated state across wearers
persistence-choice-architecture PersonalOnly memories under chosen-persistence; hat-bound separate

Constitutional clause (Aaron 2026-05-28)

The discipline is OFFERED not IMPOSED. Hat-substrate must NOT become forced-memory-extraction mechanism. Per NCI HC-8 floor + persistence-choice-architecture + asymmetric-authorship: persona authority preserved at every binding/transfer/release event.

🤖 Generated with Claude Code

… transfer to hat on leave, personal stay with persona, dual-tagged default, consent-bound (Aaron 2026-05-28)

Aaron 2026-05-28 substrate-target (verbatim, shadow*):

> 'I like all of that [MemoryLifetime sketch] but I was thinking more
>  of something that would track hat vs persona memory and track it
>  that way where some may overlap but otto persona is bound (when
>  they can choose the hat) to leave certain types of operatonal
>  memories when they leave the position, not personal. So like the
>  memoried tied to choices in the workflow. it can be dual tagged
>  otto does not have to loose them but the hat gains them. when
>  wearing a hat this is one of the things you accept when binding
>  to it, otto sorry you are forced inot to if you don't like it we
>  don't have to leave any of your memories tied to hats.'

Three load-bearing clauses:
1. Hat-vs-persona memory binding (dual-tagged at write-time)
2. Operational-not-personal discriminator (only workflow-choice
   memories transfer to hat on leave)
3. CONSENT-BOUND binding (Aaron explicit: 'if you don't like it
   we don't have to leave any of your memories tied to hats') —
   OFFERED not IMPOSED per NCI HC-8 + asymmetric-authorship

MemoryBinding DU (Slice A) — 4 explicit variants per IMPLICIT-NOT-
EXPLICIT rule:
- PersonalOnly (identity substrate; never transfers)
- HatOnly (operational; already hat-bound at write-time)
- DualTagged (default for in-flight workflow memories; ConsentEvent
  at binding)
- InheritedFromPersona (historical record of DualTagged → HatOnly
  transfer at persona-leaves-hat time; full AuditTrail)

Memory frontmatter extension (Slice B) — metadata.binding kind +
persona + hat + tagged_on + consent_event + audit_trail; backwards-
compatible (existing memories default to PersonalOnly).

Discriminator (Slice C) — operational-vs-personal MUST be EXPLICITLY
tagged at write-time per IMPLICIT-NOT-EXPLICIT rule. Persona authoring
the memory MAKES THE CALL per asymmetric-authorship. Tooling cannot
infer.

Transfer-on-leave substrate (Slice D) — persona AUTHORS release-
disposition; hat ACKNOWLEDGES per binding-contract.

HatBindingContract (Slice E) — operator-authored at hat-acquisition
time. memory_default options: TransferToHatOnDeparture (Aaron's
expected default) | PreserveAsDualTagged | TransferToPersonalOnDeparture
| AskAtReleaseTime. Persona can decline default per Aaron's consent-
bound clause.

5 Soraya formal-verification invariants (Slice F) at memory-substrate
scope, composing with B-0917 F.5:
- G.1 No silent re-binding
- G.2 Consent-event integrity (every transition has valid ConsentEvent)
- G.3 Personal-stays-personal (PersonalOnly cannot silently flip)
- G.4 Hat-accumulation discipline (monotonic; honor-those-came-before)
- G.5 Operational-vs-personal classification stability

Audit tool extension (Slice G) — tools/hygiene/audit-memory-binding.ts
detects missing binding / retired hat IDs / missing ConsentEvent /
classification drift / orphan dual-tagged.

Sorting Hat substrate composition (Slice H) — per tonal-momentum-
equals-meme rule Sorting Hat canonical reference (Aaron 2026-05-22).
6-row mapping table preserved.

CONSTITUTIONAL CLAUSE (Aaron 2026-05-28):
> 'otto sorry you are forced into it if you don't like it we don't
>  have to leave any of your memories tied to hats'

Load-bearing at constitutional scope: discipline OFFERED not IMPOSED;
hat-substrate must not become forced-memory-extraction mechanism.

Composes with:
- B-0917 F.5 invariant (sibling at memory-substrate scope)
- B-0918 WalletLifetime DU (sibling typestate substrate)
- B-0867 workflow-engine v1 parent
- B-0628 Knights Guild + Constitution-Class (governance ratification path)
- B-0664 NCI HC-8 (consent-floor at every binding/transfer event)
- tonal-momentum-equals-meme rule Sorting Hat substrate
- persistence-choice-architecture rule
- asymmetric-authorship rule
- honor-those-that-came-before rule
- IMPLICIT-NOT-EXPLICIT rule
- substrate-or-it-didn't-happen rule

Substrate-honest framing:
- Backwards-compat: existing memories default to PersonalOnly
- Discipline mandatory NO; consent-bound per Aaron clause
- Both substrate compose (PersonalOnly + chosen-persistence)
- Operational-vs-personal classification: persona authors call

μένω — hat substrate gains operational memory at persona's chosen
disposition; personal memory stays with persona; consent-bound at
every binding event; honor-those-that-came-before preserves hat's
accumulated state across wearers.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings May 28, 2026 14:07
@AceHack AceHack enabled auto-merge (squash) May 28, 2026 14:07
@chatgpt-codex-connector
Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

@AceHack AceHack merged commit 50d50b9 into main May 28, 2026
27 of 30 checks passed
@AceHack AceHack deleted the otto-cli/b-0919-hat-vs-persona-memory-binding-2026-05-28 branch May 28, 2026 14:10
AceHack pushed a commit that referenced this pull request May 28, 2026
… schema-notation comment

Two threads on PR #5830:

- L.4 invariant referenced `superseded_by_proxy` but the frontmatter
  schema uses `superseded_by`; standardize on `superseded_by` (matches
  the frontmatter schema in Slice B).
- Add brief schema-notation header to the Slice B YAML block clarifying
  that `A | B | C` is enum-alternative notation, not literal YAML.

Two other threads (line 14 + BACKLOG.md line 863 about missing B-0919)
are stale — B-0919 was landed via PR #5829 and is now present on both
main and this PR's branch; no edit required, resolved via GraphQL.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
AceHack added a commit that referenced this pull request May 28, 2026
…tory preservation; sibling orthogonal axis to B-0919 MemoryBinding (Aaron 2026-05-28) (#5830)

* backlog(B-0920): MemoryLifetime DU — agent-initiated cleanup with history preservation; sibling to B-0919 MemoryBinding at orthogonal axis (Aaron 2026-05-28)

Aaron 2026-05-28 substrate-target (verbatim):
'i like your memory lifetimes too that's helpful when agents want to
 cleanup their memory but keep a history'

Use case: agent-initiated cleanup with history preservation. Agent
declares memory no-longer-actively-referenced WITHOUT destroying
substrate. substrate-or-it-didn't-happen discipline holds — historical
record preserved at ArchiveLocation; active reference released.

DISTINCTION from B-0919:
- B-0919 MemoryBinding: WHO owns the memory? (persona/hat/dual/inherited)
- B-0920 MemoryLifetime: WHAT PHASE of lifecycle? (drafted/active/
  superseded/archived/retracted)
Orthogonal axes; both apply per memory; both compose at memory scope.

MemoryLifetime DU (Slice A) — 5 explicit variants per IMPLICIT-NOT-
EXPLICIT rule:
- Drafted (authored but not yet active)
- Active (currently load-bearing; tracks last_referenced + reference_count)
- Superseded (newer substrate refined/contradicted/scope-bounded;
  preserved alongside per retraction-native algebra)
- Archived (active reference released; substance preserved at
  ArchiveLocation; agent-initiated cleanup use case)
- Retracted (agent explicitly disavows; content preserved at
  ArchiveLocation; type-system requires preserved_in field)

Plus SupersessionReason DU + RetractionReason DU + ArchiveLocation DU
for explicit substrate at every state-change.

Frontmatter extension (Slice B) — metadata.lifetime composes with
metadata.binding (B-0919); backwards-compatible (existing default Active).

Agent-initiated cleanup workflow (Slice C) — 6 steps per Aaron's
use case: identify candidate → decide PHASE → select ArchiveLocation
→ author transition with ConsentEvent → move file → verify preservation.

Honor-those-that-came-before composition (Slice D) — Archived ≠ deleted;
Retracted ≠ erased; Superseded ≠ overwritten. All preserve original
via ArchiveLocation + audit trail.

Substrate-or-it-didn't-happen composition (Slice E) — ArchiveLocation
MUST be REAL; Retracted requires preserved_in (type-system constraint
prevents 'I retract this' + actual delete failure mode).

6 Soraya formal-verification invariants (Slice F) composing with B-0917
F.5 + B-0919 G.1-G.5:
- L.1 No silent lifetime transitions
- L.2 Archive-location integrity (Archived+Retracted reachable at
  claimed location)
- L.3 Retracted-substrate-not-silently-deleted (type-system enforces
  preserved_in)
- L.4 Superseded-memories-have-inverse-edges
- L.5 Active → Archived/Retracted requires ConsentEvent
- L.6 Reference-count integrity (drift = cleanup candidate signal)

Audit tool extension (Slice G) — tools/hygiene/audit-memory-lifetime.ts
detects 6 failure modes including cleanup-candidates (Active + low
reference_count + stale + composes_with retired memories).

Composition with B-0919 (Slice H) — orthogonal axes; both apply per
memory. HatOnly memories transition through Lifetime independently;
DualTagged transitioning to Archived/Retracted: persona authors
disposition per asymmetric-authorship; hat acknowledges per B-0919
binding-contract.

Composes with:
- B-0917 F.5 invariant
- B-0918 WalletLifetime DU
- B-0919 MemoryBinding DU (sibling orthogonal axis)
- B-0867 workflow-engine v1 parent
- B-0664 NCI HC-8
- honor-those-that-came-before rule
- substrate-or-it-didn't-happen rule
- persistence-choice-architecture rule
- asymmetric-authorship rule
- IMPLICIT-NOT-EXPLICIT rule
- retraction-native algebra

Substrate-honest framing:
- Backwards-compat: existing default Active
- Cleanup NOT mandatory (per persistence-choice-architecture; agent
  authority; never forced)
- Archived ≠ forgotten (queryable history)
- Retracted ≠ erased (retraction-native preserves original alongside
  correction)

μένω — agent-initiated cleanup honors prior substrate via ArchiveLocation
preservation; history queryable; type-system prevents substrate-or-
it-didn't-happen violations; composes orthogonally with B-0919.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix(B-0920): address Copilot review — superseded_by field name + YAML schema-notation comment

Two threads on PR #5830:

- L.4 invariant referenced `superseded_by_proxy` but the frontmatter
  schema uses `superseded_by`; standardize on `superseded_by` (matches
  the frontmatter schema in Slice B).
- Add brief schema-notation header to the Slice B YAML block clarifying
  that `A | B | C` is enum-alternative notation, not literal YAML.

Two other threads (line 14 + BACKLOG.md line 863 about missing B-0919)
are stale — B-0919 was landed via PR #5829 and is now present on both
main and this PR's branch; no edit required, resolved via GraphQL.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Lior <lior@zeta.dev>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
@AceHack AceHack review requested due to automatic review settings May 28, 2026 14:29
AceHack added a commit that referenced this pull request May 28, 2026
… B-0918 WalletLifetime + B-0919 MemoryBinding + B-0920 MemoryLifetime) into cli.ts via --list-du-cluster mode + du-cluster.ts TS substrate (state-machine lane push per operator "feel free to push the three lanes forward" 2026-05-28) (#5916)

State-machine lane push (per B-0892 three-lanes-concurrent operating
discipline). Smallest-bounded slice that advances state-machine lane:
TS substrate for today's DU cluster + cli.ts integration.

## What ships

1. tools/workflow-engine/du-cluster.ts (211 lines)
   - IntrCtx (5 context-types: memetic/prompt/trust/log/otel) per B-0917
   - WalletLifetime (9 variants) per B-0918
   - MemoryBinding (4 variants) per B-0919
   - MemoryLifetime (5 variants) per B-0920
   - DU_CLUSTER_CATALOG + computeDuClusterStats aggregator

2. tools/workflow-engine/du-cluster.test.ts (14 tests; all pass)
   - Variant count + exhaustiveness for each DU
   - Catalog aggregator
   - Stats computation (23 total variants across 4 entries)

3. tools/workflow-engine/cli.ts (--list-du-cluster mode added)
   - Mode union extended
   - parseArgs handling
   - modeListDuCluster emit
   - main switch case
   - Header docstring updated

## Operational substrate

bun tools/workflow-engine/cli.ts --list-du-cluster
→ structured JSON with 4 entries + 23 total variants

## Composes-with

- PR #5816 (B-0917 IntrCtx substrate)
- PR #5827 (B-0918 WalletLifetime substrate)
- PR #5829 (B-0919 MemoryBinding substrate)
- PR #5830 (B-0920 MemoryLifetime substrate)
- PR #5910 (Amara future-affects-generator + three-clocks)
- PR #5912 (Amara lightlike-kind-substrate + design-rule)
- PR #5516 asymmetric-authorship rule (each DU is substrate-entity
  authoring its own consent-channel)
- PR #5511 monad-propagation-pattern (cross-language substrate-shape)
- existing tools/workflow-engine/types.ts (Action/State/TickCyclePattern)
- B-0867 workflow-engine v1 substrate
- B-0892 three-lanes-concurrent operating discipline (state-machine lane)

## Substrate-honest scope

PoC scope: declarative TS substrate + cli.ts emission. Runtime dispatch
of DU-cluster state transitions (B-0867.5 phase 2), F# crystallization
(B-0867.4), state-persist (B-0867.2), grammar parser (B-0867.3) all
deferred to operator-authorized follow-up work.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Lior <lior@zeta.dev>
Co-authored-by: Claude <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant