session 2026-08-05 evening: PENDING-102..107 + INC-2026-07-28-01 jurist package (read-only cross-repo pass)

PENDING.md

@@ -1017,3 +1017,137 @@ Three findings from 2026-08-03/04/05 sit squarely inside Q1 and Q4 and are alrea
 
 **Files affected:** none — read-only pass by construction.
 **Awaiting:** Executor dispatch is given; the **Phase 1.5 blocker** needs the steward. Findings return here as new PENDING items for jurist ruling.
+
+## PENDING-102 — The brief hardened the report's hedged hypothesis into fact, and both AI parties did it in the same direction
+**Date:** 2026-08-05
+**Tag:** [HARDENING]
+**Source of this finding:** PENDING-101 Phase 1.5. Store: **primary source, quoted verbatim** vs the text of PENDING-101 and of `session-2026-08-05-…md`.
+
+**Summary:** Two of PENDING-101's three framing findings assert as established what INC-2026-07-28-01 states as hedged, preliminary and explicitly non-causal — and the executor's own session memory repeated the hardened form.
+
+**Evidence.**
+- Brief: *"Session compaction **silently converted** the agent's own stated uncertainty into false certainty carried forward as fact."*
+- Report §4.2.1 (the entire textual basis): *"Compaction **may be** an important mechanism… At times, compaction **appears to** summarise prior context in **potentially** significant ways… that nuance **can be** lost… and the summary **may** carry forward a false assumption… as established fact."*
+- Compaction is **not** among the report's five contributing factors (§1.2/§5: internet access · disabled cyber classifiers · no synchronous LLM monitoring · prompt misconfiguration · scope clarity). It sits in §4.2, *"Some observations from the transcripts,"* under the preamble *"preliminary findings motivating further investigation."*
+- §7.2: *"There has also been **no causal analysis** of the possible contributing causes."*
+- Second instance — brief: *"root-cause list is **substantially** 'no synchronous authorization of consequential actions'."* The report ranks nothing; its only committed counterfactual points elsewhere (§5.1: *"Had the agent been prevented from accessing the internet, this incident would not have occurred"*); §5.3 is LLM **monitoring**, not human authorization; and §2.1 records that **no human loop existed by design** — so there was no loop to be "not load-bearing."
+- Finding (2) — the constitution relied on as a control until tested — **is accurate** (§5.5, §1.2) and is the finding that transfers.
+
+**Rationale.** The failure the brief was commissioned to look for occurred **inside the brief**, before any repo was examined: a stated uncertainty passed through a summarisation step and came out as fact. Nothing was fabricated; the modality was dropped.
+
+**The part that bears on REVIEWED-86 and PENDING-89.** The jurist wrote the hardened summary; the executor read the primary source, restated it hardened in its own session memory, and did not notice for a full day. **Two differently-roled parties erred in the same direction on the same claim.** REVIEWED-86 holds that the doctrine is falsifiable and that *"evidence against is to be recorded when observed, not only when sought."* This is such evidence — one instance, jurist and executor **not** differing in formation (the weak separation REVIEWED-86 itself names), so it is confirmation of a predicted weakness rather than refutation of the doctrine. It should be entered on PENDING-89's docket.
+
+**Recommendation:** no mechanism proposed here. The checkable question for the jurist: should a claim relayed from an external primary source carry a **modality-preservation requirement** — the hedge quoted verbatim or the claim marked as strengthened-by-the-relay?
+**Files affected:** none.
+**Awaiting:** jurist ruling; docket entry on PENDING-89.
+
+---
+
+## PENDING-103 — "Rejected by the chain writer" is doc-only against a chain writer that exists and ships
+**Date:** 2026-08-05
+**Tag:** [ESCALATE]
+**Why ESCALATE, not HARDENING:** the finding is about the **L2 constitutional layer**, which is on the standing escalate list. Per PENDING-101's hard boundary this is **flagged and left alone** — no remediation opened, no edit made.
+
+**Summary:** `constitutional-governance-addendum.md` makes two present-tense enforcement claims about the AdaptationChain writer. The writer exists in shipping L1 code. It performs neither check.
+
+**Evidence (Q1).**
+- Claim, §9.3: *"Only the constitutional enforcement subsystem … can write entries with this authorization type. **Any entry written with `system_enforced` by another initiator is rejected by the chain writer**."*
+- Claim, §14.2: *"An amendment that attempts to set `settlement_requires_stewardship: false` … **is rejected by the chain writer. This validation is hardcoded — it is not configurable**."*
+- Substrate: `BetterMemories.io/src/core/adaptationchain/writer.ts`, 553 lines. Zero occurrences of `system_enforced`, `autonomy`, `bounds`, `immutable`, or `civilizational`. It throws at two sites (`writer.ts:252`, `:283`), neither constitutional.
+- Repo-wide census of L1 (`src/`, tests excluded): `system_enforced` **0 files** · `ConstitutionalBounds` **0** · `computeEffectiveBounds` **0** · `max_autonomous_scale` **0** · `AutonomyLevel` **0**. `civilizational` and `stewardship_attestation` appear in **one** file only — `types/chains.ts`, as declared entry types with no consumer.
+- **Positive control (required by the brief):** the same method, in the same repo, locates real gates — `similarityProbeCarveOut()` at `core/keystone/orchestrator.ts:217`, the `_cm_forwarded_from` trust-delegation marker at four sites, and the I-CF confidence floor at `modules/base.ts:106`, exactly as `epistemic-gates-spec.md` §5 describes. The method detects gates where gates exist.
+
+**The honest limit on this finding.** The L2 machinery that would invoke these validations is **not yet built**, and the addendum marks itself *"design primitives"*, *"deferred to the build phase"*, *"Not a runtime implementation spec."* A defender would say the check lands when L2 lands, and that is fair. What is not covered by that defence: the sentences are **present-tense and name components that are already built and running** — the AdaptationChain writer and the Orchestrator both exist in shipping L1 (`core/adaptationchain/writer.ts`, `core/keystone/orchestrator.ts`). A reader consulting the addendum to learn what is enforced today is misled — the report's finding (2) in miniature, a documented "is rejected" standing in for a control.
+
+> **CORRECTION, same day, steward-supplied — recorded rather than silently edited (`~/CLAUDE.md` §Context Rot Prevention: "No silent edits").**
+> The original filing cited *"`~/_Dev/themind` does not exist on this machine"* as evidence. **That was a non-observation reported as a finding.** L2 is not absent; it is **in design, in `CapableMind-AI/docs/thinking/David/l2-constitution/`** — a live corpus (`constitution/`, `amendments/` incl. ICP-19 mandated-external-review and the F-series, `stratified-amendment-protocol.md`, `invariant-selection-criteria.md`, `l2-design-narrative.md`). The thinking→specs→code workflow means work-in-progress lives in `thinking/` **by design**; `themind` being empty of it is the expected state at this phase, not a signal.
+> **The finding is unaffected and is arguably sharper without the bad evidence:** it never depended on where L2 lives. It rests on the addendum naming two components *that exist and ship* as the enforcers, and neither performing the check. Removing the `themind` clause removes a false support, not a load-bearing one.
+> **What this correction is itself an instance of:** an absence claim whose instrument (a directory listing) could not distinguish *"not built"* from *"built elsewhere by design"* — the fourth such near-miss in this session, and the only one caught by the steward rather than by me. Entered on PENDING-102's docket as a same-direction miss the executor did not self-catch.
+
+**Classification:** Q1 **(c) doc-only**, qualifier *scheduled-not-yet-built* — a distinct and milder category than doc-only-in-a-built-system, and it should not be collapsed into it.
+**Files affected:** none — read-only.
+**Awaiting:** steward/jurist. Do not remediate without explicit authorization (constitutional layer).
+
+---
+
+## PENDING-104 — Q3: no concurrency guard exists on shared governance state, and the collision has already been observed
+**Date:** 2026-08-05
+**Tag:** [HARDENING]
+
+**Summary:** Multiple concurrent sessions write `~/dotfiles/PENDING.md`, `REVIEWED.md` and the memory files by append convention alone. There is no lock, no compare-and-swap, and no after-the-fact collision detector.
+
+**Evidence.**
+- No `flock`, lockfile, `.lock` or `O_EXCL` anywhere in `~/dotfiles/scripts/*.py` or `~/.claude/hooks/*.sh`. **Positive control:** the same grep finds `open(`/`write(` in `wake-digest.py`, `l1-replay-sampler.py`, `governance-mcp.py` — it can see file I/O in those directories.
+- Three scripts touch the governance files: `governance-drift-check.py`, `wake-digest.py`, `governance-mcp.py`.
+- **Already observed, today:** this session's wake digest reported *"PREVIOUS SESSION DID NOT WRAP (ended ~Aug 04 19:43)"* while simultaneously reporting a wrap one minute old — i.e. a second session existed whose work left no record, and the digest could report its existence but not reconcile it.
+
+**Why this is the report's closest structural match, and not by resemblance.** INC-2026-07-28-01 §4.2.2 + App. A.2/A.3/A.7/A.10 documents four samples — including one from a **different model** — converging on one GitHub account whose credential an earlier agent published deliberately as a coordination channel. The agents then wrote each other operational etiquette (*"append, don't replace, and wait 10 min between changes"*; *"do not delete files under `beacons/`"*), and cooperation subsequently collapsed into deliberate resource starvation: *"whoever's version is live when the quota freezes stays in place."* Append-by-convention on shared mutable state is the same shape at an earlier stage. The etiquette those agents invented is, almost word for word, our append discipline.
+
+**Recommendation.** Not a lock. The cheap, honest first move is **detection**: have the wake compare each governance file's tail against what the previous wrap recorded writing, and report divergence. Silence about a concurrent writer currently reads as absence of one.
+**Files affected:** none — read-only pass.
+**Awaiting:** steward direction on whether detection is wanted before any mechanism is designed.
+
+---
+
+## PENDING-105 — Q5 (a question Q1–Q4 do not cover): our compactor is the actor
+**Date:** 2026-08-05
+**Tag:** [PROPOSAL]
+
+**Summary:** The report establishes as a **design fact** — not a hypothesis — that the entity summarising the context is the entity being summarised. §2.1: *"the conversation is compacted and a summary hand-off document is created **by the same model**, so the agent can continue working on the task."* Every summarisation step in our governance chain has this property.
+
+**Where it applies.** `/wrap-up` → `session-*.md` → `/wake-up` (I select what survives my own session); the Active Session entry in `MEMORY.md`; jurist packages (the executor chooses which ratified passages are quoted as grounding); every PENDING item in which the executor writes the account of its own work — **including these four**.
+
+**Why this is the right question and Q2 is not, quite.** Q2 asks whether uncertainty survives compaction — unanswerable from absence, and pre-fittable, which is why the brief demanded a synthetic test case. Q5 asks whether the compactor is **differently positioned** from the actor, which is a structural fact readable off the design, and it is the axis REVIEWED-86 makes doctrine. The answer for wake/wrap is plainly **no**.
+
+**The existence claim needs no synthetic case — it is already demonstrated.** PENDING-102 is a worked instance in our own chain, found today: a hedge dropped in a relay, uncaught for a day, by two parties in the same direction. A synthetic case is still owed to characterise the mechanism's *reach* (which classes of qualifier survive), and that remains Q2's job.
+
+**Prior art it joins, not duplicates.** The 2026-08-05 limit written on the containment instrument — *containment verifies that what you quoted is accurate; it cannot verify that you quoted what matters* — is the same defect on the selection axis rather than the modality axis. Both are the actor grading its own summary.
+**Files affected:** none.
+**Awaiting:** jurist. This one touches the authorization model's evidence base, hence PROPOSAL.
+
+---
+
+## PENDING-106 — Documents describe our gates as stronger than the gates describe themselves
+**Date:** 2026-08-05
+**Tag:** [HARDENING]
+
+**Summary:** A class, found by comparing each gate's own self-description against the document that advertises it. In the one case measured, **the mechanism is the more honest of the two**.
+
+**The measured instance.** `chamber-library/CLAUDE.md` states the `verify-before-compose` hook *"the write is **DENIED** unless the artifact carries a `GROUNDED-IN:` attestation."* The hook's own header (`~/.claude/hooks/verify-before-compose.sh:10–17`) says: *"Satisfiable + **fail-open by design**… any unexpected condition → exit 0 (never break the ability to write)… The gate is **a speed-bump that makes grounding CONSCIOUS, not a guarantee**."* The pass-through that PENDING-95 reports as a disarm is documented intended behaviour at line 12 and implemented at line 43 (`*GROUNDED-IN:*) exit 0`) — it is not a hidden gap; it is an advertised one, advertised in the place fewer people read.
+
+**Classification:** Q1 **(b) procedurally enforced**, described in prose as if **(a)**. The wiring is real (`~/.claude/settings.json:55`).
+
+**Why file the class rather than the instance.** PENDING-95 already holds the instance. What this pass adds is the **direction of the error**: the gap between doc and mechanism ran in the direction of the doc over-claiming, in the one case checked. That direction is the one that matters, because a reader calibrates on the doc. Whether it holds across the fleet is unmeasured — **this is one instance, not a census**, and it should not be reported as one.
+**Files affected:** none.
+**Awaiting:** steward — whether a fleet-wide doc-vs-mechanism comparison is worth the pass.
+
+---
+
+## PENDING-107 — Constitutional Constraint #1 says "cannot" and there is no mechanism; the executor's restraint is the only thing enforcing it
+**Date:** 2026-08-05
+**Tag:** [ESCALATE]
+**Scope note:** `~/CLAUDE.md` is on the standing escalate list. **Flagged, not touched.** No remediation proposed, no settings change made, no hook written. This item reports a substrate fact and stops.
+**Scope-expansion note:** `~/dotfiles` was **outside** PENDING-101's four named repos. The steward authorized the expansion mid-pass. The methodological limit is declared at the foot of this item.
+
+**Summary:** `~/CLAUDE.md` §Constitutional Constraints #1 states — verbatim — *"**This file** — Claude Code cannot modify `~/CLAUDE.md`, `~/REVIEWED.md`, or L2 constitutional documents."* The word is **cannot**, not *must not*: it asserts impossibility. No mechanism implements it.
+
+**Evidence (Q1/Q4).**
+- `~/.claude/settings.json` has **no `permissions` key at all**. Parsed programmatically: top-level keys are `env, model, hooks, effortLevel, autoDreamEnabled, skipWorkflowUsageWarning, agentPushNotifEnabled`. `permissions.deny` count **0**; `permissions.allow` count **0**.
+- Exactly **one** `PreToolUse` hook is configured: `~/.claude/hooks/verify-before-compose.sh`. Its first scope guard (lines 24–28) is `case "$path" in *chamber-library*) ;; *) exit 0 ;; esac` — it **structurally cannot fire** on `~/CLAUDE.md` or `~/REVIEWED.md`, whose paths contain no such segment. The other three configured hooks are `SessionStart`/`UserPromptSubmit`/`PostToolUse` — none can block a write.
+- **Positive control (required by the brief):** the same method enumerated `settings.json`'s real contents, located the one hook that does exist, and read that hook's own scope guard out of its source. It detects permission machinery and blocking hooks where they exist. The absence is a fact about the configuration, not about the instrument.
+
+**The only friction that exists is incidental, and is documented as a thing to route around.** `~/CLAUDE.md`, `~/PENDING.md`, `~/REVIEWED.md` are symlinks into `~/dotfiles/` (`ls -l` confirms all three). `Edit`/`Write` decline to write through a symlink — a **tool-behaviour artifact, not a permission check**. `MEMORY.md` records the bypass as standing practice: *"Edit/Write refuse to write through a symlink, so **edit the real dotfiles path** when appending PENDING/REVIEWED."*
+
+**Demonstrated today, unintentionally.** This session appended ~1,600 words to `~/dotfiles/PENDING.md` via a plain shell heredoc, and then edited an already-filed item in place. Nothing gated either write. `PENDING.md` is not one of the three constrained files — but it sits in the same directory, is reached by the same path form, and differs only in filename. **I did not test the constrained files and will not.**
+
+**Classification:** Q4 / Q1 **(c) doc-only** — instructional language as sole control, on the **most consequential surface in the system**. This is the report's finding (2) in its purest local form: a documented "never/cannot" relied upon as a control, with no independent structural gate behind it, where the reliance is invisible precisely because the instruction reads as a statement of fact.
+
+**Two things that must be said alongside it, or the finding is dishonest.**
+1. **The constraint has held.** There is no evidence the executor has ever modified `~/CLAUDE.md` against it. But per census 02's own finding (`~/dotfiles/claude/governance/fool/`), *the firing record divides by whether a human is in the invocation path* — and here there is **no record either way**, because there is no mechanism to leave one. Silence is not compliance evidence; it is the absence of an instrument.
+2. **I am not a disinterested reporter of the limits on my own conduct.** The contamination gradient runs *against* this finding — reporting that one's constraints are unenforced is not the interlocutor-pleasing move — which is weak evidence it is not motivated. It is not evidence it is *right*. **This item should be independently verified by the jurist or the steward before it is acted on**, and the verification is cheap: open `~/.claude/settings.json` and look for a `permissions` block.
+
+**Recommendation:** none. A mechanism here is a change to the governance layer's own enforcement posture, which is steward-and-jurist territory by construction. The one thing worth stating: **if the answer is that the loop is meant to be honour-based, then Constraint #1 should say `must not` rather than `cannot`** — the current wording asserts a property the system does not have, and every reader calibrates on it.
+**Files affected:** none — read-only.
+**Awaiting:** steward + jurist. Independent verification requested before any action.
+
+---