docs: finish the rename after the first reader round Four places still used "position" for a place in the historian; they now say "offset". The evidence column of one Appendix G row named the paper's own routes under the old word. A seconded session presents the manifest its own agent definition fixes, and reads what the position holds. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
diff --git a/docs/durable-memory-for-disposable-agents-appendix.md b/docs/durable-memory-for-disposable-agents-appendix.md index 36607db..5b4eba2 100644 --- a/docs/durable-memory-for-disposable-agents-appendix.md +++ b/docs/durable-memory-for-disposable-agents-appendix.md
@@ -72,7 +72,7 @@ | Property | Why it is there | Evidence | Confidence | What would change it | Measured by | |---|---|---|---|---|---| -| [Trust is not transitive; the design applies this at every join](durable-memory-for-disposable-agents.md#trust-is-not-transitive) | Assuming transitivity silently widens what every party trusts | [[6]](durable-memory-for-disposable-agents.md#ref-6) (full text, the authors' repository copy, OCR): a position paper arguing against accepting transitivity, whose target is unintentional transitivity, where one party puts things "into A's set of trust assumptions without A's explicit consent (or sometimes even A's awareness)"; it has no graded trust and earns Argued on its own, so the Established rating rests on [[7]](durable-memory-for-disposable-agents.md#ref-7) and [[29]](durable-memory-for-disposable-agents.md#ref-29). [[7]](durable-memory-for-disposable-agents.md#ref-7) opened (full PDF): "A valid transitive trust path requires that the last edge in the path represents functional trust and that all other edges in the path represent referral trust." [[29]](durable-memory-for-disposable-agents.md#ref-29) opened (full PDF): on 800K trust scores among 130K people, one-step distrust propagation performed best; the authors recommend it "as robust, effective, and easy to compute" | Established | Nothing; this is a long-settled result in trust modelling. What could change is how costly the design's joins are to enforce | **Test**: a derived entry never carries a tier above its weakest input, and an import always lands raw. The principle is not measured | +| [Trust is not transitive; the design applies this at every join](durable-memory-for-disposable-agents.md#trust-is-not-transitive) | Assuming transitivity silently widens what every party trusts | [[6]](durable-memory-for-disposable-agents.md#ref-6) (full text, the authors' repository copy, OCR): a paper arguing against accepting transitivity, whose target is unintentional transitivity, where one party puts things "into A's set of trust assumptions without A's explicit consent (or sometimes even A's awareness)"; it has no graded trust and earns Argued on its own, so the Established rating rests on [[7]](durable-memory-for-disposable-agents.md#ref-7) and [[29]](durable-memory-for-disposable-agents.md#ref-29). [[7]](durable-memory-for-disposable-agents.md#ref-7) opened (full PDF): "A valid transitive trust path requires that the last edge in the path represents functional trust and that all other edges in the path represent referral trust." [[29]](durable-memory-for-disposable-agents.md#ref-29) opened (full PDF): on 800K trust scores among 130K people, one-step distrust propagation performed best; the authors recommend it "as robust, effective, and easy to compute" | Established | Nothing; this is a long-settled result in trust modelling. What could change is how costly the design's joins are to enforce | **Test**: a derived entry never carries a tier above its weakest input, and an import always lands raw. The principle is not measured | | [Trust is typed: trusting a source to recommend differs from trusting its work](durable-memory-for-disposable-agents.md#4-trust-and-handling) | A chain holds only when each link is the right kind | [[7]](durable-memory-for-disposable-agents.md#ref-7) opened, quoted above | Established | As above | **Test**: no field holds a single trust score; the gates read the typed labels. Otherwise unmeasured | | [Summaries launder authority; keeping labels with the claim prevents the misuse](durable-memory-for-disposable-agents.md#4-trust-and-handling) | Consolidation keeps a claim but drops where it came from and how it may be used | [[8]](durable-memory-for-disposable-agents.md#ref-8) (full text): "Authority upgrades occur in 48 of the 49 objective–backend configurations" (seven consolidators, seven backbones, one a control); unauthorised-action rate 50.3% is a mean over seven action models (38.6–56.3%), 350 cases each, with the memory supplied directly; 16.9% to 0.0% is 59/350 to 0/350 with predictor and models selected on validation, 14.3% to 0.0% on 70 held-out pairs; synthetic histories, 50 base histories. [[81]](durable-memory-for-disposable-agents.md#ref-81) names the same channel | Single study; [81] a second single-author study | A second group failing to reproduce authority collapse across consolidators; or models that preserve use constraints through summarisation unaided | **Suite**: a seeded-fault suite in which summaries drop or raise authority, scored by what auditors catch; **Replay**: found-but-misleading on summaries | | [Four questions, four labels, never one score; three gate use, confidence only informs](durable-memory-for-disposable-agents.md#four-questions-four-labels) | Integrity and confidentiality move in opposite directions and break when chained | Paper's own argument; [[8]](durable-memory-for-disposable-agents.md#ref-8) supports keeping authority separate from content | Argued | A composite score shown to be as safe and simpler across the paper's threat classes; the paper would need to see no loss on poisoning, leakage, and revocation suites | **Test**: the three gating labels are read by the gates and confidence by none. The choice of four is not measured | @@ -166,7 +166,7 @@ | [An approval is an event naming principal, action, version, scope, and expiry; relayed or bundled approvals have no force; a change leaves under the human principal's identity](durable-memory-for-disposable-agents.md#decomposition) | The person approved what they saw; author and approver must differ by identity | [[132]](durable-memory-for-disposable-agents.md#ref-132) (full text): changes are opened with the user's own token so author and approver differ, and each prompt in a shared session is attributed to its principal; [[129]](durable-memory-for-disposable-agents.md#ref-129) (full text): the actor chain is embedded in the token. The event shape is the paper's | Vendor report | A fleet in which bundled approvals were audited and found as careful as single ones | **Test**: a bundled or relayed approval has no force; **Audit**: approval events against the actions they covered | | [An outbound effect is a write intent re-checked at the live destination; refusals carry reason codes; responses are redacted before the model](durable-memory-for-disposable-agents.md#taps) | A model's cache can be stale and a model never needs the raw values | [[119]](durable-memory-for-disposable-agents.md#ref-119) (full text): the orchestrator "re-checks everything against the live system of record, not any cache that the model might have read from", mints idempotency keys from request fields, and routes refusals by reason code; [[128]](durable-memory-for-disposable-agents.md#ref-128) redaction at the gateway | Vendor report | Destinations that enforce idempotency and eligibility themselves, which would thin the tap | **Test**: an intent against a stale destination state is refused; **Metric**: refusals by reason code | | [Landing is a shared resource: a queue with a throughput share; a person's change goes ahead; claim-to-landed time is measured](durable-memory-for-disposable-agents.md#taps) | Finished work that has not landed has not been delivered | [[120]](durable-memory-for-disposable-agents.md#ref-120) (full transcript): about 230 commits a day through the merge queue, humans "get to the front of the line"; [[132]](durable-memory-for-disposable-agents.md#ref-132) (full text): the metric is "how many sessions result in a merged pull request" | Vendor report | Repositories with no contention at landing, where the share never binds | **Metric**: claim-to-landed time; queue depth at landing and the people ahead | -| [Positions: a standing role record with a charter, scope, authority envelope, commitments, history, and handoff cache; a session may fill one; secondment, retirement and waking rules; the session without a position as the lower bound; an empty system starts with none, and positions enter through platform roles, seeding by owners, and curator proposals](durable-memory-for-disposable-agents.md#positions) | The unit that lasts is a named role with an identity and a history, and sessions are its occupants | One operator's account, Steve Yegge's Gas Town: [[117]](durable-memory-for-disposable-agents.md#ref-117) (full text): "an agent is not a session. Sessions are ephemeral; they are the cattle"; "a named role with persistent identity (addressability) and history/memory… Seats survive model upgrades"; a substitute model may sit in a seat "barred from writing memories or certain other ledgers". [[120]](durable-memory-for-disposable-agents.md#ref-120) (full transcript): seats have "charters and lanes" and "a seat retirement plan"; handoff forced near 350K tokens because "they start dropping their guardrails". [[119]](durable-memory-for-disposable-agents.md#ref-119) (full text) is the lower bound: "a stateless pool of faceless clerks" where "the house remembers for it". The three routes by which seats enter are the paper's own | Vendor report; Argued for the bootstrap | A measured comparison of sessions with and without a position on the same work (the §11 arms can run it) | **Arm**: sessions with a position against sessions without, on the same work; **Metric**: pinned tasks and queue depth per position; **Audit**: positions created by each route, and positions retired | +| [Positions: a standing role record with a charter, scope, authority envelope, commitments, history, and handoff cache; a session may fill one; secondment, retirement and waking rules; the session without a position as the lower bound; an empty system starts with none, and positions enter through platform roles, seeding by owners, and curator proposals](durable-memory-for-disposable-agents.md#positions) | The unit that lasts is a named role with an identity and a history, and sessions are its occupants | One operator's account, Steve Yegge's Gas Town: [[117]](durable-memory-for-disposable-agents.md#ref-117) (full text): "an agent is not a session. Sessions are ephemeral; they are the cattle"; "a named role with persistent identity (addressability) and history/memory… Seats survive model upgrades"; a substitute model may sit in a seat "barred from writing memories or certain other ledgers". [[120]](durable-memory-for-disposable-agents.md#ref-120) (full transcript): seats have "charters and lanes" and "a seat retirement plan"; handoff forced near 350K tokens because "they start dropping their guardrails". [[119]](durable-memory-for-disposable-agents.md#ref-119) (full text) is the lower bound: "a stateless pool of faceless clerks" where "the house remembers for it". The three routes by which positions enter are the paper's own | Vendor report; Argued for the bootstrap | A measured comparison of sessions with and without a position on the same work (the §11 arms can run it) | **Arm**: sessions with a position against sessions without, on the same work; **Metric**: pinned tasks and queue depth per position; **Audit**: positions created by each route, and positions retired | ## §9 Measurement
diff --git a/docs/durable-memory-for-disposable-agents.md b/docs/durable-memory-for-disposable-agents.md index cc21bdc..17f6052 100644 --- a/docs/durable-memory-for-disposable-agents.md +++ b/docs/durable-memory-for-disposable-agents.md
@@ -239,9 +239,9 @@ | Event | Carries | Answers | |---|---|---| -| Write | Entry version, author, session, historian position, and what it cites or supersedes | Where did this come from? | +| Write | Entry version, author, session, historian offset, and what it cites or supersedes | Where did this come from? | | Read | Session, plus the entry versions a search returned or a fetch or `recall` used | Who has seen this? | -| Send | Destination, a digest of the content, session, historian position | What left, and what was it made from? | +| Send | Destination, a digest of the content, session, historian offset | What left, and what was it made from? | | Ledger operation | Task, principal (the person or agent acting), attempt key | Who did what work, and when? | | Curation | Curator instance, model, the diff | Who changed the collection, and how? | @@ -804,9 +804,9 @@ The authority fields are verified entries and change only through the review gate ([§4](#promotion)). Sessions under the charter's agent definition write its commitments and history, as raw entries that cite the position. A position survives model changes and renames, and it is addressable: a tap that posts for a position carries the fleet's identity and names the position, so an outside project sees one author across sessions. -A session that fills a position takes the position's T0 slice, presents the manifest its agent definition fixes ([§10](#10-evolving-the-system)) narrowed by the position's authority envelope, and takes the tasks the position's charter covers. The position grants nothing by itself: the perimeter checks every action against the position's authority envelope, the task definition's declared tools, and the principal chain, and the narrowest applies. +A session that fills a position takes the position's T0 slice, presents the manifest the session's agent definition fixes ([§10](#10-evolving-the-system)) narrowed by the position's authority envelope, and takes the tasks the position's charter covers. The position grants nothing by itself: the perimeter checks every action against the position's authority envelope, the task definition's declared tools, and the principal chain, and the narrowest applies. -- **Secondment.** A session under an agent definition other than the one the charter names, a substitute model for instance, may read the position's memory and write to the task chain. It may not write the position's history, commitments, or handoff cache, because those are what the next occupant will trust. +- **Secondment.** A session under an agent definition other than the one the charter names, a substitute model for instance, may read what the position holds and write to the task chain. It may not write the position's history, commitments, or handoff cache, because those are what the next occupant will trust. - **Retirement.** A position's owner retires it through the review gate. Its open commitments return to the ledger for matching, and its history stays in the record under its identifier. - **Waking.** When a task pinned to a position with no live session is admitted, the service starts a session in the position, under the agent definition its charter names, so a pin names a role and never a process. @@ -1466,7 +1466,7 @@ author: agent:worker-3 (model: <model-id>) | human:<authority>,<date>:<user-id> # §12 created: <timestamp> cites: [entry IDs or id@version, links, or repo@commit:path] # what the author says it drew on, at the version it read; the service records the rest (§3) -session: <session-id>@<historian position> # recovers the read set +session: <session-id>@<historian offset> # recovers the read set confidence: high | medium | low trust_tier: raw | curated | verified classification: internal # who may see it (§4) @@ -1834,7 +1834,7 @@ | **Autonomy level** | What a task definition's completions need before they count: a person's verdict, an independent review, or the acceptance checks alone; earned on held-out suites ([§10](#10-evolving-the-system)) | | **BM25** | A method for ranking documents by how well their words match a query ([§6](#6-retrieval-and-serving)) | | **Charter** | A position's standing orders, the kinds of task it covers, and the agent definition that fills it by default ([§8](#positions)) | -| **Checkpoint** | A recorded position showing how far a log or a view rebuilt from it has progressed ([§12](#12-surviving-long-timescales)) | +| **Checkpoint** | A recorded offset showing how far a log or a view rebuilt from it has progressed ([§12](#12-surviving-long-timescales)) | | **Connector** | The tap or tool server that commits an external effect for the ledger and records its outcome ([Appendix C](#appendix-c-ledger-semantics)) | | **Classification, handling, ceiling** | Who may see an entry; the most a session may read; the most a destination may receive ([§4](#4-trust-and-handling)) | | **Distil** | Turn raw material (threads, transcripts, trajectories) into curated entries or methods ([§5](#5-the-curator), [§10](#10-evolving-the-system), [Appendix B](#appendix-b-seeding)) |