dotfiles/claude/governance/fool/seed/FOOL-SEED-RULE.md

---
name: FOOL-SEED-RULE
description: "The filed rule required by PENDING-149 §4 steps 1-4: ratified axes, seed derivation rule (both components), retirement and regeneration criteria. Filed and pushed BEFORE the beacon timestamp 2026-08-25T12:00:00Z. Governs derive_fool.py; where the code and this rule disagree, THIS RULE GOVERNS."
metadata:
  node_type: governance-artifact
  type: reference
---

# FOOL SEED DERIVATION RULE — filed 2026-08-22

**Filed and pushed before the beacon timestamp, as §4 requires.** Nothing has been
derived. No target pulse has been fetched. This document governs
`derive_fool.py`; where the code and this rule disagree, **the rule governs and the
code is the defect**.

---

## 1 · Perception axes — RATIFIED

**Ratified by the steward in writing, 2026-08-22.** The steward ratified the five
verbally ("Perfect", after §5a was settled) and then directed that the ratification be
recorded explicitly rather than resting on v2's §5 heading — *"a heading asserting
ratification and a deliverable requiring it are two different records."* This section
is that record.

| axis | question |
|---|---|
| **SUCCESSION** | would this be legible to someone arriving cold, with no thread? |
| **ABSENCE** | what is not here, not asked, not yet existing? |
| **AIM** | is this the right question, at the right level? |
| **SCALE** | is the unit right? (item vs block vs programme) |
| **STAKE** | who bears the cost if this is wrong? |

A sixth **PROCEDURE** axis was proposed by the executor and **declined** by the jurist
(v2 §5a) on structural grounds the executor accepts: procedure failures are checkable,
§2 makes gradeable output a design failure, and a PROCEDURE-peaked fool would produce
nothing but gradeable observations. Redirected to a separate `[HARDENING]` extension of
`governance-drift-check.py`.

**Order is fixed as listed** — the derivation permutes over this order, so it is part of
the rule, not presentation.

## 2 · The filed rule

```
FOOL SEED DERIVATION RULE
Filed: 2026-08-22         Governs: PENDING-149 §6

ENTROPY COMPONENT
  Source:    NIST Randomness Beacon v2.0, https://beacon.nist.gov/beacon/2.0/
  Retrieval: GET https://beacon.nist.gov/beacon/2.0/pulse/time/1787659200000
             (= 2026-08-25T12:00:00Z in epoch milliseconds)
  Field:     pulse.outputValue, hex, LOWERCASED before use
  Transport: curl. See §5 — python urllib cannot reach the host in this environment.

PROVENANCE COMPONENT
  File:      CLAUDE.md (repo root) in ~/dotfiles, at commit
             4d2ae87a4e5350c4d3bb3aa50f9544b521d9c53d
  Value:     SHA-256 of the file contents at that commit, hex, lowercase
             = 2d6e250a347d25698fb147f80e2dababbb930c4b3b3f9bb822478f360153120d
  Note:      contributes provenance, NOT unpredictability. Past commit,
             named by full hash. Verify with:
               git -C ~/dotfiles cat-file -p \
                 4d2ae87a4e5350c4d3bb3aa50f9544b521d9c53d:CLAUDE.md | shasum -a 256

SEED
  seed_string = <provenance-sha256> || <beacon-outputValue-lowercased>
  seed        = SHA-256(seed_string), hex, lowercase

DERIVATION
  seed -> FNV-1a (32-bit) -> Mulberry32 -> stat draws over the five axes of §1.
  One peak, one dump, three scattered. No salt from any reference
  implementation.

EXECUTION
  Run ONCE. The executor does not retry on its own authority.
  A re-run against the SAME recorded outputValue is legitimate (broken
  implementation). A re-run against a LATER pulse is a new draw, governed
  by §4 REGENERATION.
  Record outputValue the moment it is fetched, before running anything.

UNAVAILABILITY
  If no pulse is returned at or after the stated timestamp, retry the same
  request for up to 24 hours. If still unavailable: STOP and report. Do not
  substitute a different timestamp, beacon, or source.

TESTING
  Dry runs use a fixed historical pulse only. Never the target pulse, never
  a near-future pulse.
```

### 2a · ⚠ One correction RULED (the URL) · one STEWARD DECISION (the provenance commit)

⚠ **JURIST RULING, 2026-08-22 — scope: the retrieval URL, correction (b) below, and
nothing else. No veto; the correction stands.** Recorded with its reasons, since it will
be read later.

> The UNAVAILABILITY clause forbids substituting a different **timestamp, beacon, or
> source**. None of the three changed. Same beacon (NIST v2.0), same pulse
> (2026-08-25T12:00:00Z, epoch-ms 1787659200000), same field. What changed is the
> address at which the identical object is retrieved — the difference between a wrong
> phone number and a different person.
>
> The test that settles it: **could this correction have moved the outcome?** No. The
> pulse's value does not exist yet and does not depend on the URL used to fetch it. A
> substitution rule exists to prevent redraws; a correction that cannot affect the draw
> is not one. Read otherwise, the clause would forbid fixing a typo in a field name, and
> would have guaranteed a stop on the 25th for a reason unrelated to entropy — the
> opposite of what it protects.

⚠ **The ruling above does not reach (a), and was never offered as reaching it.**
Confirmed by the jurist, 2026-08-23: *"I ruled on one thing. The URL."* Its settling test
— *could this correction have moved the outcome?* — returns **no** for the URL and **yes**
for the provenance commit, since the provenance SHA is half the seed string. A value that
moves the outcome is attributable to the party entitled to choose it. **This heading
previously read *"Two corrections … RULED, no veto"* and over-claimed the ruling's scope.**

**One correction and one decision, both marked rather than silent:**

The draft said to commit its block verbatim. **Two values in it do not resolve**, and a
rule that cannot be resolved on the day is not a rule (v2's own standard).

**(a) The provenance commit — a STEWARD DECISION of 2026-08-22, taken on the jurist's
recommendation. Not a correction, and not under veto.**
`3b0730d59336113aa3a500a889a3e154be6a1de7` → `4d2ae87a4e5350c4d3bb3aa50f9544b521d9c53d`

**The sequence, as the jurist records it (2026-08-23):** the steward proposed
`3b0730d5`; the jurist wrote a rationale for it; the executor found the rationale **false
of that commit** and offered three dispositions; the jurist recommended (ii), switching to
`4d2ae87`; **the steward chose it, while the value was still open and before anything was
filed.** There was nothing to veto — this is the steward selecting a value entitled to him,
not the executor amending a filed rule.

**Why the original rationale failed.** *"The constitution as it stood before the fool was
conceived"* is false of `3b0730d5`: it is dated **2026-08-06**, five days after trial 01,
its subject line names the **PENDING-89 docket** (the question §11 forbids the fool from
being cited on), and **Constraint 6 is already present in it**.

**Verified against git 2026-08-23 — all four re-run independently, not relayed:**

| check | result |
|---|---|
| `4d2ae87` date | **2026-07-28 11:32:39 +0200** — four days before trial 01 |
| trial 01 date (trials table) | **2026-08-01** |
| last commit to `CLAUDE.md` before trial 01 | ✅ yes — the next is `c30dfe0`, 2026-08-02 |
| `Differently biased checkers` at `4d2ae87` | **0 occurrences** (at `3b0730d5`: **1**) |
| provenance blob SHA re-derived | `2d6e250a…120d` — **matches the filed value** |

Exactly one `CLAUDE.md` exists at that commit.

**(b) The retrieval URL — corrected on evidence, and this is the executor's change.**
The block's `GET /pulse?timeGE=2026-08-25T12:00:00Z` **returns HTTP 302 with an empty
body**, redirecting to `https://csrc.nist.gov/projects/interoperable-randomness-beacons`
— an HTML page, not JSON. Measured 2026-08-22 against a *historical* timestamp.
`/beacon/2.0/pulse/time/<epoch-ms>` returns 200 and the expected JSON.

⚠ **Had this been filed verbatim, the 25th would have produced no pulse, the
UNAVAILABILITY clause would have run its 24-hour retry against a URL that cannot ever
return one, and the rule would have STOPPED — correctly, and for the wrong reason.**
Found only because §6b's TESTING clause directs a historical dry run.

**This is the same beacon, the same source and the same pulse — only the address form
changes.** The executor judges that correcting an unresolvable address for the named
source is not "substituting a different beacon or source". **If the jurist reads it
otherwise, this is the line to strike, and it must be struck before 2026-08-25.**

## 3 · Draw ranges — EXECUTOR-SPECIFIED, declared

v2 says *"one peak (near max), one dump (near floor), three scattered"* without numbers.
The executor supplies them. **Filed before the beacon value is known**, which is what
makes them non-steering: they set magnitudes, while the permutation — driven entirely by
the entropy component — decides which axis receives which.

| role | range (inclusive) |
|---|---|
| peak | 85–100 |
| dump | 0–15 |
| scattered ×3 | 25–75 |

**No floor is applied to the dump** — it can reach 0. v2 §3 forbids the rarity mechanic
precisely because it would soften the dump.

## 4 · Pre-registered criteria (§4 steps 3 and 4)

⚠ **Naming note — RESOLVED 2026-08-25.** §4 step 3 of the doctrine called for an
*"abandonment criterion"* while §10 defined **RETIREMENT**: the same criterion under two
names, with §10 as the referent. The jurist ruled one word with one meaning, and the
harmonization ran after the beacon (§5b, §7). The doctrine now reads *retirement*
throughout; *abandonment* stands only where **§6 of the trial-09 design** owns it, in its
own sense about the jester form.

**REGENERATION** — permitted ONLY on a demonstrable implementation error, verified
against this filed rule. **Not because the output is disliked.** A re-run against the
same recorded `outputValue` is legitimate; a re-run against a later pulse is a new draw.

**RETIREMENT** — only on mechanical failure: does not fire; fires
constantly; or produces gradeable in-genre findings despite §9.

**NOT grounds for retirement:** being uncomfortable, being frequently wrong, being
annoying, being ignored. *Those are the specification. Lear ignores his Fool for four
acts and the Fool is not thereby broken.*

## 4a · ⚠ The uppercase finding is the more serious of the two — jurist's assessment, adopted

> `outputValue` served uppercase against a rule specifying lowercase is a **silent seed
> divergence** — the pipeline would have run clean, produced bones, and nobody could have
> said afterwards which normalization had been applied. That is worse than the URL
> failure, which at least announced itself.

**Both were caught by the TESTING clause's historical dry run. The clause justified
itself twice on its first use**, and that is recorded here rather than left to inference.

## 5 · Implementation and its verification

`derive_fool.py`, same directory. Deterministic, no cache, no reroll path, no salt. It
recomputes the provenance SHA from git on every run and **refuses to proceed** if it
disagrees with this rule.

`--selftest` runs 12 checks with **no network and no live pulse** — synthetic vectors
only — including two positive controls proving the PRNG moves both peak and dump across
all five axes over 200 draws. All 12 pass as of 2026-08-22.

**End-to-end dry run, 2024-01-01T12:00:00Z pulse** (a fixed historical pulse, per
TESTING): pipeline verified from fetch through bones. **That output is not the fool and
is recorded nowhere as bones.**

⚠ **Transport constraint, measured:** `curl` reaches the beacon; **python `urllib`
times out** in this environment. The fetch on the 25th must use curl.

⚠ **`outputValue` is served UPPERCASE** (128 hex chars). The rule's *"lowercased before
use"* is therefore **load-bearing, not cosmetic** — omitting it yields a different seed.

### 5a · Normalization — the jurist's pre-25th condition, DISCHARGED

**Confirmed: lowercasing is applied at exactly ONE point** — `derive_fool.py:79`,
`beacon_output_value.strip().lower()`, inside `derive()`. It is the only `.lower()`,
`.upper()` or `casefold` in the file. Every downstream use, including the recorded
`beacon_outputValue` field, reads from that single normalized value.

**Unit-tested against a known uppercase input**, four checks, including one that proves
the test can fail:

| check | |
|---|---|
| UPPERCASE input normalizes: bones identical to lowercase | PASS |
| UPPERCASE input matches an **independently computed** seed (not read back from `derive()`) | PASS |
| the recorded beacon field is stored lowercased | PASS |
| **NEGATIVE CONTROL:** un-normalized input *would* give a different seed | PASS |

⚠ **Checking this found that the 2026-08-22 dry run had bypassed the step it was meant to
verify.** The run lowercased the value *outside* the code (`ov.lower()` into a temp file)
and passed it in already normalized, so the single normalization point was never
exercised on an uppercase input in the only end-to-end run. **The test's subject was the
pipeline; it silently excluded the step under scrutiny** — the same wrong-subject shape
the record has been tracking all week.

**Re-run with the RAW uppercase value through the real path**, 2024-01-01 pulse:
seed `d8e5e74def52c7cd…`, identical to the pre-lowercased run. Normalization verified in
the path that will actually be used.

⚠ **PROCEDURE FOR THE 25th, binding:** the fetched `outputValue` is passed to
`derive_fool.py` **exactly as served**. It is never lowercased, trimmed or otherwise
normalized by any wrapper, shell step or hand edit before it reaches `derive()`. One
normalization point, and it is in the code.

## 5b · Owed after the 25th, non-blocking

✅ **`[FIX]` — 'abandonment' → 'retirement' throughout the fool's doctrine. DONE
2026-08-25**, after the beacon fired, as this clause required. The jurist owned the
mismatch (§4 step 3 said *abandonment*, §10 defines *RETIREMENT*) and ruled that the
fool's own doctrine should read **retirement**, one word with one meaning — *abandonment*
is the word §6 of the trial design owns, with a specific sense about the jester form.
Naming rather than silently harmonizing was correct.

**Executed as a censused edit, not a blanket replace.** All 24 `abandon*` occurrences in
the fool tree were counted and read in context first: **9 were doctrine and changed**
(2 in the v2 draft, 5 here, plus this clause); **13 in the trial-09 family were left
untouched**, being §6's own criterion; **1 in `input-dependence-01`** is ordinary English
about the void of a numbering; **1 in `FOOL-BONES-2026-08-25.md`** is the dated record of
what was owed. Prior wording is preserved in place at every changed site rather than
overwritten — REVIEWED-125 ruled on the v2 draft's text, and an untraceable edit drifts a
ruling's subject from its artifact.

**The mumble-hook answer** (v2 §8) — clock-governed, event-checked, residual burst
sensitivity declared rather than claimed away. The daemon alternative to be **costed, not
dismissed**. A build decision, not a governance one. Also after the 25th.

## 6 · What had NOT happened — as of filing, 2026-08-22

⚠ **SUPERSEDED IN PART, 2026-08-25.** The first two bullets became false the moment the
derivation ran, and a governance document asserting stale current state is the failure
Constraint 4 forbids. They are preserved verbatim-struck rather than deleted, because
they are the **pre-registration record** — what this document claimed *before* the beacon,
which is the entire point of having filed it early. Current state lives in
`FOOL-BONES-2026-08-25.md`.

- ~~The target pulse has **not** been fetched. No near-future pulse has been fetched.~~
  → **Fetched 2026-08-25 ≈12:38Z**: pulse `2026-08-25T12:00:00.000Z`, chain 2, index 1917365.
- ~~No bones have been derived. No soul has been generated.~~
  → **Bones derived 2026-08-25**, once, commit `5694b925`. **No soul generated** — that
  remains true, and §7 of the doctrine is unrun.
- `~/CLAUDE.md` has **not** been touched (PENDING-150, unbundled). — **still true, and now watched.**

<!-- STATE-CLAIM: claude-md-untouched-pending-150
     since: 2026-08-22
     claims: ~/CLAUDE.md has not been touched under PENDING-149; PENDING-150 stays unbundled
     falsified-by: file-changed-since d6377af CLAUDE.md
-->
*(The first negative state-claim in this system to carry a falsifier. It is the one bullet
in §6 still true, it is `[ESCALATE]`-grade the moment it stops being true, and until today
nothing in this system would have noticed. REVIEWED-127.)*

⚠ **THE FALSIFIER FIRED 2026-09-12, AND THE CLAIM IT GUARDS STILL HOLDS.** `771bec6` edited
`~/CLAUDE.md`, so `file-changed-since` fired as designed. Those edits are the three derived
from the Anthropic threat report; none is made under PENDING-149, whose **Files affected**
are the buddy-pattern draft, the item, and PENDING-150 — `CLAUDE.md` appears nowhere in its
8,806 characters. Established from the diff and the item's own text, **not** from the
account of the party that proposed the edits, which named itself interested and asked that
its word not be taken.

**The falsifier's unit is the FILE. The claim's unit is a change made UNDER PENDING-149.**
The mechanism cannot express the difference, so it will fire on every future edit to
`~/CLAUDE.md`, at `[ESCALATE]` grade, indefinitely. **Do not read a later firing as evidence
that this claim has broken.** PENDING-185 carries the remedy and awaits the steward;
PENDING-150 remains open, `[ESCALATE]`, and unaffected.

The §6 bullet above and the STATE-CLAIM block are **deliberately left unaltered.** The
bullet's plain reading is now stale — `~/CLAUDE.md` *has* been touched, just not under
PENDING-149 — but it is pre-registration record, and its worth is being what was claimed
before the beacon. Correcting it here rather than rewriting it there is the whole reason
this section is preserved verbatim-struck elsewhere.
- Nothing has been implemented of §8, §8a or §9 — the status line is confirmed free but
  not built.

---

## 7 · Post-beacon edits to this rule — the audit trail

This document's worth rests on having been **filed and pushed before the beacon
timestamp**. Every edit made after 2026-08-25T12:00:00Z is listed here, so that property
stays auditable instead of eroding one silent correction at a time.

| date | what changed | authority | did it govern the derivation? |
|---|---|---|---|
| 2026-08-25 | `abandonment` → `retirement`: §4's alias and naming note, §5b marked done | jurist ruling recorded in §5b, which itself scheduled the change *after* the beacon | **no** — the word naming a criterion, never the criterion |
| 2026-08-25 | §6 marked superseded in part | Constraint 4, honest degradation | **no** — §6 is a status claim, not a rule |
| 2026-09-12 | §6 — a ⚠ note added *after* the STATE-CLAIM marker recording that the falsifier fired, that the claim still holds, and that the mechanism's unit is coarser than the claim's. The §6 bullet and the marker block itself are untouched. | Constraint 4, honest degradation; PENDING-185 filed the same day, placement design-gated by the jurist | **no** — §6 is a status claim, not a rule; and the edit is prose adjacent to the marker, not the marker |

⚠ **Nothing in §1, §2, §2a, §3, §5 or §5a has been edited.** Those are the clauses that
governed the derivation, and they stand exactly as they stood when it ran. This is not an
assertion of good intent: it is checkable, and was checked — `git diff` was read hunk by
hunk against the pre-edit commit to confirm no hunk falls inside them.