docs: the ledger has no fencing generation, and the historian derives lineage Two corrections from the second fact check. The ledger refuses a stale holder by identity and lease time; the fencing generation is described only. Lineage is a query over the historian's offsets; the historian stores events. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
diff --git a/docs/durable-memory-for-disposable-agents-complexity.md b/docs/durable-memory-for-disposable-agents-complexity.md index 9a70cbc..8606e0b 100644 --- a/docs/durable-memory-for-disposable-agents-complexity.md +++ b/docs/durable-memory-for-disposable-agents-complexity.md
@@ -54,7 +54,7 @@ Two places carry the weight. Coordination ([§8](durable-memory-for-disposable-agents.md#8-coordination) with Appendix C) is about 4,900 words and 86 list items, more than twice the next largest section. Trust and handling with the curator ([§4](durable-memory-for-disposable-agents.md#4-trust-and-handling) and [§5](durable-memory-for-disposable-agents.md#5-the-curator)) is about 3,000 words and 47 list items. -The two differ in kind. The coordination rules are the invariants any task ledger with leases needs: a claim with a lease, a fencing generation, an origin for dedup, an append-only log with the task table as its projection. The code holds them (`crates/ledger/src/lib.rs`). The trust rules are the paper's own contribution, and most of their evidence is single studies and incidents ([Appendix G](durable-memory-for-disposable-agents-appendix.md)). +The two differ in kind. The coordination rules are the invariants any task ledger with leases needs: a claim with a lease, a fencing generation, an origin for dedup, an append-only log with the task table as its projection. The code holds three of the four (`crates/ledger/src/lib.rs`); a stale holder is refused by identity and lease time, and the fencing generation is described only. The trust rules are the paper's own contribution, and most of their evidence is single studies and incidents ([Appendix G](durable-memory-for-disposable-agents-appendix.md)). Every other section is under 1,800 words. The parts in the [§2](durable-memory-for-disposable-agents.md#2-the-design-at-a-glance) diagram are each simple: the subsections that introduce the record, the historian, search and access control are each under 500 words. @@ -85,8 +85,8 @@ | Premise | In the code | Described only | |---|---|---| -| Model output is untrusted input | Trust tiers and the read filter (`crates/core/src/lib.rs`, `crates/core/src/filter.rs`); the injection scan and quarantine (`crates/policy/src/scan.rs`, `crates/memory/src/review.rs`); erasure and tombstones (`crates/core/src/erasure.rs`); the checker as the audit agent (`crates/memory/src/checker.rs`); the per-domain event log (`crates/server/src/log.rs`); the promotion gate as a proposal and an approval by two identities, and lineage derived from the read and write logs (`crates/server/src/lib.rs`) | Lineage edges the historian stores, the guards and `declassify`, the principal chain | -| Agents are disposable | The ledger with leases, handoffs and origin dedup (`crates/ledger/src/lib.rs`); T0 (`crates/server/src/t0.rs`); the recall deputy (`crates/server/src/recall.rs`); matching a task's requirements against a session's manifest (`crates/ledger/src/lib.rs`) | Positions, task definitions, waiting as a ledger state | +| Model output is untrusted input | Trust tiers and the read filter (`crates/core/src/lib.rs`, `crates/core/src/filter.rs`); the injection scan and quarantine (`crates/policy/src/scan.rs`, `crates/memory/src/review.rs`); erasure and tombstones (`crates/core/src/erasure.rs`); the checker as the audit agent (`crates/memory/src/checker.rs`); the per-domain event log (`crates/server/src/log.rs`); the promotion gate as a proposal and an approval by two identities, and lineage derived from the read and write logs (`crates/server/src/lib.rs`) | The historian as one ordered log, with lineage as a query over its offsets; the guards and `declassify`; the principal chain | +| Agents are disposable | The ledger with leases, handoffs and origin dedup (`crates/ledger/src/lib.rs`); T0 (`crates/server/src/t0.rs`); the recall deputy (`crates/server/src/recall.rs`); matching a task's requirements against a session's manifest (`crates/ledger/src/lib.rs`) | Positions, task definitions, the fencing generation, waiting as a ledger state | | Ownership limits conflict | Domains in the read filter; taps (`crates/taps`, `crates/server/src/taps.rs`); the platform as a domain (`crates/server/src/platform.rs`); bundles out and in (`crates/server/src/bundle.rs`) | Coordination across domains | | The system must stay viable for years | Policy as layered entries with Rego modules, exceptions that expire, enforcement only once verified (`crates/policy/src/record.rs`); the curation cycle with its telemetry (`crates/memory/src/curation.rs`); spend limits at the egress (`crates/egress/src/lib.rs`); the rubric compiled from strategy (`crates/server/src/fabric.rs`) | The rule ceiling and the reset, autonomy levels, approvals with a scope and an expiry that the perimeter checks again when the action runs, the other four limits, the horizon scanner | | Evaluation is built in | Read and write telemetry (`crates/server/src/reads.rs`); golden suites (`crates/memory/src/golden.rs`); frozen-context replay and re-enactment (`crates/memory/src/replay.rs`, `crates/memory/src/reenact.rs`); canary entries (`crates/memory/src/canary.rs`); vendor-drift probes (`crates/memory/src/drift.rs`); cost (`crates/memory/src/cost.rs`) | The evaluator, the five arms, most of the 21 metrics |