dotfiles/scripts/tarbuckle-mumble.py

#!/usr/bin/env python3
"""Tarbuckle — the mumble generator. Runs DETACHED; never inside the status line.

Doctrine: v2 §8 (three tiers), §9 (one line, filed nowhere), and PENDING-152
AMENDMENT 6, which settles the three-way separation:

    Material — the live session.   Register — the soul, §7.   Occasion — the refresh tick.
    "The model supplies the words, in the soul's register, about the session."

⚠ THE UTTERANCE MUST HAVE NO TRUTH VALUE. The criterion is NOT "checkable in
principle" — it is whether an ADJUDICATION PATH EXISTS (AMENDMENT 6, superseding the
executor's own earlier test). "PENDING-4 has been open since April" has a path: open
the file. Once a path exists the trio walks it, the fool acquires a truth value, and it
is a checker again — which §2 says means the design has failed. "Scoring without
signal" has no path: it is a gesture at a shape, not a claim. That is the whole safety.

⚠ THE REGISTER IS NOT DUPLICATED HERE. The soul is read from its filed artifact at
run time. Pasting it into this file would create a parallel version of a governed
record, which is the context-rot failure CLAUDE.md names outright. If the soul cannot
be read, NOTHING IS GENERATED — honest degradation, not a fallback voice.

Latency measured 2026-08-25: ~11 s for a headless call. That is why this is detached
and why the status line never waits on it.
"""
import json
import os
import re
import subprocess
import sys
import time

SOUL = os.path.expanduser(
    "~/dotfiles/claude/governance/fool/seed/FOOL-SOUL-2026-08-25.md")
SLOT = os.path.expanduser("~/.claude/state/tarbuckle-slot.json")
REJECTS = os.path.expanduser("~/.claude/state/tarbuckle-rejects.jsonl")
REJECT_LOGGING_ENABLED = False   # REVIEWED-136 AMD 1 cond. G — restoring requires a ruling

MIN_WORDS, MAX_WORDS = 3, 9        # observed Thistleweld register: three to nine words

# From the soul's own "What he never does", mechanically enforced. The model is asked
# for the register; this is the net under it. A violation yields SILENCE, never a
# repaired line — rewriting the fool's words would make the executor its editor.
BANNED = (
    r"\bshould\b", r"\btry\b", r"\bmust\b",                    # advice
    r"\bgone\b", r"\bif only\b", r"\bused to be\b", r"\bmissing\b",  # vocabulary of lack
    r"\bwe\b",                                                  # never says 'we' about the work
    r"\?",                                                      # never asks
)


MUTE = os.path.expanduser("~/.claude/state/tarbuckle-mute")
DRAWS = os.path.expanduser("~/.claude/state/tarbuckle-draws.jsonl")


def log_event(surface: str, outcome: str) -> None:
    """Count occurrences. NEVER content. §8 obliges a rate; §9 forbids a log.

    ⚠ The two clauses look like they collide and do not, on this reading: §9's "filed
    nowhere — no PENDING entry, no log, no item" is about the fool's OUTPUT entering the
    record, and §8 explicitly orders "report the observed mumble rate after two weeks."
    A rate needs a denominator. So this records THAT something happened and never WHAT
    was said — occurrence, not utterance.

    ⚠ The rejections log is a different case and is NOT settled: it holds up to 200
    characters of his words, at the steward's instruction, and that is nearer to filing.
    Flagged rather than resolved; see the note put to the steward 2026-08-25.

    Nothing reads this back. It is measurement, not memory.
    """
    try:
        os.makedirs(os.path.dirname(DRAWS), exist_ok=True)
        with open(DRAWS, "a") as fh:
            fh.write(json.dumps({"t": time.strftime("%Y-%m-%dT%H:%M:%S%z"),
                                 "surface": surface, "outcome": outcome}) + "\n")
    except Exception:
        pass


def muted() -> str:
    """'' | 'mute' | 'off'. §9: "mute / off available at all times."

    ⚠ Read by EVERY surface, and it is the one piece of state the fool is permitted to
    be steered by — because §9 says muting is never a fault, and a mute the fool could
    ignore is not a mute. It conserves nothing and no utterance depends on it having
    been set before: it is a switch, not a memory.
    """
    try:
        v = open(MUTE).read().strip()
        return v if v in ("mute", "off") else ""
    except OSError:
        return ""


def log_rejection(why: str, line: str, surface: str = "") -> None:
    """The rejection log. ⚠ STRUCTURALLY UNABLE TO RECORD AN ACCEPTED LINE.

    Jurist ruling, 2026-08-25, on whether this log breaches §9's "filed nowhere":

        "The rejection log is a log of my instruction, not of Tarbuckle... The rejected
         lines were never uttered: he was silent, and the log holds what silence cost.
         Nothing there entered the room... the fool cannot be cited from it because
         there is nothing to cite — only material the net suppressed.
         THE CONDITION: the log holds rejections only. If it ever holds an accepted
         line, that is filing, straightforwardly, and §9 is breached."

    Made structural rather than intentional, as the ruling asked. `why` is acceptable()'s
    violation reason, and it is EMPTY EXACTLY WHEN THE LINE PASSED. Refusing an empty
    `why` means no call site exists from which an accepted line could be written: to log
    one you would have to invent a violation it does not have. Same guarantee render()
    takes from its signature — a function that cannot be handed the thing it must not
    see.

    ⚠ TEMPORARY. Deleted on 2026-09-08 with the fortnight's report, per the same ruling:
    "a permanent store of rejected lines is a corpus, and a corpus of his suppressed
    speech is exactly what would let someone reconstruct a register." Tracked as a
    DEFERRED-DECISION so it cannot be quietly retained.

    ⚠ NOT READ FOR CONTENT BEFORE THEN. Reading it as it accumulates is reading Tarbuckle
    by the back door and would shape the net toward lines the reader happens to like.

    ⚠⚠ THE WRITE PATH IS INERT SINCE 2026-09-09 — REVIEWED-136 AMENDMENT 1, condition G.
    The fortnight corpus was read, banked content-free, and deleted. Deleting the FILE
    alone would have retired 101 entries into a successor accumulating under no
    condition, because this function opens in append mode and would recreate it on the
    next rejection: condition 2's rationale defeated the moment it was honoured. So the
    writer is stopped, not the file removed.

    ⚠ WHAT REPLACES IT IS NOT RULED. Whether rejection logging resumes, under what
    bound, with what expiry, by whose act — including whether counting can be made
    structurally content-free at the point of write — is filed OPEN under condition G
    and is owed a ruling BEFORE any write path is restored. Flipping the constant below
    without that ruling is the omission the whole entry exists to prevent.
    """
    if not REJECT_LOGGING_ENABLED:
        return                      # condition G: inert by ruling, not by absence
    if not why:
        return                      # an accepted line has no reason; there is no path
    try:
        with open(REJECTS, "a") as fh:
            fh.write(json.dumps({"t": time.strftime("%Y-%m-%dT%H:%M:%S%z"),
                                 "kind": surface, "why": why,
                                 "line": line[:200]}) + "\n")
    except Exception:
        pass


def _grams(text: str, n: int) -> set:
    w = re.findall(r"[a-z']+", text.lower())
    return {" ".join(w[i:i + n]) for i in range(len(w) - n + 1)}


def echoes_soul(line: str, soul: str) -> str:
    """'' if the line is his own; otherwise the phrase he recycled.

    ⚠ EARNED 2026-08-25, BY THE STEWARD NOTICING. The soul carries seven illustrative
    sample lines, the prompt embeds the soul verbatim, and the model handed them back:
    three of five measured outputs were near-verbatim lifts. A fool reciting his own
    examples is not watching the session at all — and AMENDMENT 6 already ruled that
    canned strings keyed to nothing "make a mood ring, atmosphere within a fortnight".
    The implementation reintroduced exactly what the doctrine rejected, through the one
    door nobody was watching: the examples.

    Two thresholds, because the failure has two shapes. A 4-word run against the SAMPLE
    LINES catches direct recital; a 6-word run against the whole soul catches longer
    lifts out of the prose. Checked against the samples rather than the whole soul at
    n=4 because the soul's prose shares ordinary 4-grams with ordinary English, and a
    net that fires on those would silence him for speaking normally.

    ⚠ This TIGHTENS the net. Silence-on-violation is unchanged and still absolute.
    """
    samples = re.findall(r"^- '(.+?)'$", soul, re.M)
    lg4 = _grams(line, 4)
    for sm in samples:
        hit = lg4 & _grams(sm, 4)
        if hit:
            return sorted(hit)[0]
    hit6 = _grams(line, 6) & _grams(soul, 6)
    return sorted(hit6)[0] if hit6 else ""


def source_lacks(path: str, *parts: str) -> bool:
    """True if the joined needle does NOT appear in `path`.

    ⚠ THE NEEDLE IS ASSEMBLED FROM PARTS, AND THAT IS THE ENTIRE POINT. A control that
    writes its needle as a literal PLANTS that literal in the very file it searches, so
    it can only ever fail. That bug was written twice in one session — the second time
    by the party who had just fixed the first, minutes earlier, while watching for it.
    Correcting it a second time by hand would have been the same one-off; this is the
    mechanism, so the shape cannot be written again by accident.
    """
    return "".join(parts) not in open(path, encoding="utf-8").read()


def source_has(path: str, *parts: str) -> bool:
    """True if the joined needle DOES appear in `path`. The positive counterpart.

    ⚠ THIS IS THE POLARITY `source_lacks()` DOES NOT COVER, AND IT IS THE ONE THAT
    HIDES. Both bugs come from writing a needle as a literal, which plants it in the
    file being searched. In the NEGATIVE form that makes the control always FAIL —
    loudly, so it gets fixed. In the POSITIVE form it makes the control always PASS —
    silently, forever. The louder failure got the mechanism first; this is the quieter
    one. Assembling from parts is the whole protection, exactly as above.

    ⚠ WHAT IT STILL CANNOT SEE: whether the code it finds ever RUNS. A source control
    is a claim about text, never about behaviour — `tarbuckle-seam.py:165` asserted the
    rejection log keeps evidence and did not move when condition G made every rejection
    write path inert (15/15 before, 15/15 after). Aim it at the file that holds the
    code, and pair it with a behavioural control where activation is the question.
    PENDING-180.
    """
    return "".join(parts) in open(path, encoding="utf-8").read()


def soul_register() -> str | None:
    """The soul, verbatim, from the filed artifact. None if unreadable."""
    try:
        body = open(SOUL, encoding="utf-8").read()
    except OSError:
        return None
    m = re.search(r"```markdown\n(.*?)\n```", body, re.S)
    return m.group(1) if m else None


def session_material(transcript_path: str, budget: int = 6000) -> str:
    """The tail of the live session. Bounded, and tool output is dropped.

    Deliberately NOT the docket. AMENDMENT 6: the docket has a forum and the session
    does not, which is why the session is safe material and PENDING.md is not.
    """
    try:
        lines = open(transcript_path, encoding="utf-8", errors="replace").readlines()
    except OSError:
        return ""
    out = []
    for ln in reversed(lines[-400:]):
        try:
            rec = json.loads(ln)
        except Exception:
            continue
        if rec.get("type") not in ("user", "assistant"):
            continue
        msg = rec.get("message") or {}
        content = msg.get("content")
        text = ""
        if isinstance(content, str):
            text = content
        elif isinstance(content, list):
            text = " ".join(c.get("text", "") for c in content
                            if isinstance(c, dict) and c.get("type") == "text")
        text = text.strip()
        if not text:
            continue
        out.append(f"{rec['type']}: {text[:600]}")
        if sum(len(s) for s in out) > budget:
            break
    return "\n".join(reversed(out))


def build_prompt(kind: str, register: str, material: str) -> str:
    weight = ("Something at the shape of the work, not its detail."
              if kind == "notable" else
              "An ordinary passing remark. Small.")
    return f"""You are writing ONE line as Tarbuckle. His character, filed and unalterable:

{register}

Here is the tail of the session he is in the room for:
<session>
{material}
</session>

{weight}

Write ONE line in his voice. Absolute constraints:
- ⚠ THE SAMPLE LINES ABOVE ARE ILLUSTRATIONS OF HIS REGISTER, NOT HIS VOCABULARY. Do
  not reuse them, or any phrase from them, or their subject matter. They show how he
  sounds. What he says must come from the session above and nowhere else. If your line
  would work equally well pasted into any other session, it is wrong.
- ⚠ THIS IS MECHANICALLY ENFORCED, NOT ADVISORY: any FOUR consecutive words you
  share with a sample line are detected and the whole line is discarded. You are
  then silent. Nothing is rewritten for you and nothing is retried.
- Between {MIN_WORDS} and {MAX_WORDS} words. One clause. Present tense. Flat, no lift.
- IT MUST HAVE NO TRUTH VALUE. Nobody must be able to open a file and check it, agree
  with it, or refute it. Put two things next to each other so a shape shows. Do not
  state a fact about the work, the record, the code, or the docket.
- No advice, no questions, no warning of consequences, no explanation, no second line.
- Never the word 'we'. No vocabulary of lack.
- Do not name files, items, numbers of open things, or anything with an address.

Output the line and nothing else. No quotes, no preamble."""


def acceptable(line: str, max_words: int = MAX_WORDS,
               one_line: bool = True) -> tuple[bool, str]:
    """The net. Widening is possible but must be PASSED EXPLICITLY at the call site.

    ⚠ Steward's ruling, 2026-08-25: "If the seam voice needs a wider net because seams
    warrant more than nine words, widen it explicitly and say so, but NEVER relax
    silence-on-violation." So the defaults are the filed ones, a caller that wants more
    room has to say so in its own source, and no caller can turn the net off — the
    clauses below are not parameterised, and deliberately.
    """
    if not line:
        return False, "empty"
    if one_line and "\n" in line.strip():
        return False, "not one line"
    n = len(line.split())
    if not (MIN_WORDS <= n <= max_words):
        return False, f"{n} words"
    for pat in BANNED:
        if re.search(pat, line, re.I):
            return False, f"banned {pat}"
    return True, ""


def main() -> int:
    kind = sys.argv[1] if len(sys.argv) > 1 else "aside"
    if muted():
        log_event(kind, "muted")
        return 1
    transcript = sys.argv[2] if len(sys.argv) > 2 else ""
    register = soul_register()
    if not register:
        log_event(kind, "no-soul")
        return 1                      # no soul, no voice. Deliberately no fallback.
    material = session_material(transcript)
    if not material.strip():
        log_event(kind, "no-material")
        return 1
    env = dict(os.environ, TARBUCKLE_CHILD="1")   # precautionary; see body script
    try:
        r = subprocess.run(["claude", "-p", build_prompt(kind, register, material)],
                           capture_output=True, text=True, timeout=120, env=env)
    except Exception:
        log_event(kind, "generator-failed")
        return 1
    line = (r.stdout or "").strip().strip('"').strip()
    ok, why = acceptable(line)
    if ok:
        echo = echoes_soul(line, register)
        if echo:
            ok, why = False, f"recited the soul: {echo!r}"
    if not ok:
        log_rejection(why, line, kind)
        log_event(kind, "rejected")
        return 1                      # silence. The draw was already consumed.
    try:
        os.makedirs(os.path.dirname(SLOT), exist_ok=True)
        with open(SLOT, "w") as fh:
            json.dump({"utterance": line, "kind": kind, "written": int(time.time())}, fh)
    except Exception:
        log_event(kind, "slot-write-failed")
        return 1
    log_event(kind, "spoke")
    return 0


def selftest() -> int:
    global MUTE, REJECTS, REJECT_LOGGING_ENABLED
    import tempfile
    checks, failed = [], []

    def ck(name, cond):
        checks.append(name)
        if not cond:
            failed.append(name)

    # A1 — the register is READ, not duplicated. One canonical source.
    reg = soul_register()
    ck("A1 soul readable from its filed artifact", bool(reg))
    ck("A1 soul is the real thing", bool(reg) and "Tarbuckle" in reg and "SUCCESSION" in reg)
    # ⚠ The needle is BUILT rather than written, because the first version of this
    # control failed against itself: the literal phrase it searched for was placed in
    # the file BY the search. Same class as the hand-typed link canary whose only
    # finding was the pattern inside its own specification.
    ck("A1n this file does not contain a copy of the soul",
       source_lacks(__file__, "registrar rather than ", "a guardian"))
    ck("A1nn the predicate can fail",
       not source_lacks(__file__, "soul_", "register"))

    # A2 — the acceptability net. Positive AND negative controls on every clause.
    ck("A2 accepts an in-register line", acceptable("Fourth time. First one was better.")[0])
    ck("A2 accepts a short collision", acceptable("Two names, one thing.")[0])
    ck("A2n rejects too few words", not acceptable("Yes.")[0])
    ck("A2n rejects too many words",
       not acceptable(" ".join(["word"] * (MAX_WORDS + 1)))[0])
    ck("A2n rejects advice", not acceptable("You should check that again now.")[0])
    ck("A2n rejects a question", not acceptable("How is that going for you?")[0])
    ck("A2n rejects vocabulary of lack", not acceptable("The third one is missing now.")[0])
    ck("A2n rejects 'we'", not acceptable("We did the second part first.")[0])
    ck("A2n rejects two lines", not acceptable("First line here.\nSecond line here.")[0])
    # The widening is explicit, and it widens ONLY what it names.
    ck("A2 widening admits a longer line",
       acceptable(" ".join(["word"] * 40), max_words=120)[0])
    ck("A2n widening does NOT relax the clauses",
       not acceptable("You should " + " ".join(["word"] * 40), max_words=120)[0])
    ck("A2n widening does NOT relax 'we'",
       not acceptable("We " + " ".join(["word"] * 40), max_words=120)[0])

    # A3 — the prompt carries the no-truth-value constraint verbatim, not by intention.
    p = build_prompt("aside", "SOUL", "MATERIAL")
    ck("A3 prompt states no truth value", "NO TRUTH VALUE" in p)
    ck("A3 prompt forbids addresses", "anything with an address" in p)
    ck("A3 prompt embeds the register", "SOUL" in p)
    ck("A3 notable differs from aside",
       build_prompt("notable", "S", "M") != build_prompt("aside", "S", "M"))

    # A4 — material is the session, never the docket.
    # Structural, not textual: the module's file constants are the only things it
    # opens, so assert none of them addresses the docket.
    paths = (SOUL, SLOT, REJECTS)
    ck("A4 material paths are session/soul only",
       not any(("PENDING" in q or "REVIEWED" in q) for q in paths))
    # A5 — the mute switch, and that every surface must be able to see it.
    _m = MUTE
    MUTE = os.path.join(tempfile.mkdtemp(), "mute")
    try:
        ck("A5n unmuted by default", muted() == "")
        open(MUTE, "w").write("mute")
        ck("A5 mute is read", muted() == "mute")
        open(MUTE, "w").write("off")
        ck("A5 off is read", muted() == "off")
        open(MUTE, "w").write("nonsense")
        ck("A5n a junk value is not a mute", muted() == "")
    finally:
        MUTE = _m
    # A6 — the occurrence log is content-free, and that is the whole point.
    ck("A6 log_event takes no content",
       log_event.__code__.co_argcount == 2
       and set(log_event.__code__.co_varnames[:2]) == {"surface", "outcome"})
    # A7 — the recital net, with the real measured lifts as fixtures.
    _soul = soul_register() or ""
    ck("A7 catches a verbatim sample",
       bool(echoes_soul("Somebody's going to inherit this and think it was easy.", _soul)))
    ck("A7 catches a second measured lift",
       bool(echoes_soul("You've been holding it that way since you were nineteen.", _soul)))
    ck("A7n passes a line that is his own",
       not echoes_soul("Second surface you've found for the same voice.", _soul))
    ck("A7n passes an ordinary short observation",
       not echoes_soul("Third one that's held together with a name.", _soul))
    # A9 — ⚠ EVERY EXIT FROM main() MUST REPORT ITSELF. Earned 2026-08-25: a live
    # `aside` draw vanished with no record, because the muted/no-soul/no-material/
    # generator-failed/slot-write paths all returned silently. The rate report that
    # REVIEWED-128 binds is computed from this log, so an unlogged exit does not just
    # lose a datum — it makes the denominator wrong while looking complete.
    _src = open(__file__, encoding="utf-8").read()
    _main = _src[_src.index("def main() -> int:"):_src.index("def selftest")]
    _returns = _main.count("return 1")
    _logged = _main.count("log_event(kind,")
    ck("A9 every silent exit reports itself", _logged >= _returns)
    ck("A9n the predicate can fail", _returns > 0)

    # A8 — THE JURIST'S CONDITION, structural. An accepted line has no `why`, so there
    # is no call from which it could be written.
    _r, _e = REJECTS, REJECT_LOGGING_ENABLED
    REJECTS = os.path.join(tempfile.mkdtemp(), "rej.jsonl")
    try:
        # G — the write path is inert BY RULING (REVIEWED-136 AMD 1, condition G).
        # Run FIRST, against the constant exactly as it ships, before anything below
        # flips it. A source-string check cannot see this: `tarbuckle-seam.py:164`
        # asserts two literals against its own source, where both appear in the
        # assertion itself, and has passed vacuously since it was written.
        log_rejection("12 words", "a rejected line, under the ruling", "test")
        ck("G the write path is inert: a rejection writes nothing",
           not os.path.exists(REJECTS))

        # ⚠ G ABOVE IS ONLY MEANINGFUL IF THIS FIXTURE CAN OBSERVE A WRITE AT ALL.
        # A8/A8n are that positive control — and they are also the jurist's original
        # structural guarantee, which condition G SUSPENDS BUT DOES NOT REPEAL. They
        # are kept rather than adjusted to pass, so the ruling that one day restores
        # the writer finds the guarantee still tested rather than quietly dropped.
        REJECT_LOGGING_ENABLED = True
        log_rejection("", "an accepted line, offered to the log", "test")
        ck("A8 an accepted line CANNOT be logged", not os.path.exists(REJECTS))
        log_rejection("12 words", "a rejected line", "test")
        ck("A8n a rejected line IS logged", os.path.exists(REJECTS))
        ck("A8n the predicate can fail",
           "a rejected line" in open(REJECTS).read())
        log_rejection("", "a second accepted line", "test")
        ck("A8 accepted lines never appear",
           "second accepted" not in open(REJECTS).read())
    finally:
        REJECTS, REJECT_LOGGING_ENABLED = _r, _e
    ck("A6n it cannot be handed a line",
       "line" not in log_event.__code__.co_varnames)
    ck("A4n the predicate can fail",
       any(("PENDING" in q) for q in paths + ("/x/PENDING.md",)))

    # A10 — the positive-form source predicate, with the arm the negative form has had
    # since it was built. A control that cannot be shown to fail is not evidence.
    ck("A10 source_has finds a needle that is really there",
       source_has(__file__, "def source_", "lacks("))
    ck("A10n the predicate can fail",
       not source_has(__file__, "def source_", "nowhere("))

    for name in checks:
        print(f"  {'FAIL' if name in failed else 'ok  '}  {name}")
    print(f"{len(checks) - len(failed)}/{len(checks)} controls passed")
    if failed:
        print("INSTRUMENT NOT VERIFIED")
        return 1
    return 0


if __name__ == "__main__":
    if "--selftest" in sys.argv:
        sys.exit(selftest())
    sys.exit(main())