mikebrandon/here-telemetry-rnd
1
0
Fork 0
Code Issues Pull requests Projects Releases 10 Packages Wiki Activity Actions

Make consent an act in the console, not a step the gate takes at boot #19

Merged
LNK merged 1 commit from claude/consent-as-an-act into main 2026-09-04 21:40:02 +00:00
Conversation 0 Commits 1 Files changed 16 +432 -64
LNK commented 2026-09-04 21:40:01 +00:00
Contributor
Copy link

The gate wrote a consent record at boot for whatever the environment asked, and since PR #18 signed it with the device key: a signature over an agreement nobody had made.

What changes. A session starts with no consent row and stores nothing. The Capture tab opens with the act: every signal in its collector's declared words, tier A pre-chosen, opt-in off, refused signals shown as such, one button. The gate records the choices as a console consent, signed, applies the machine's refusals, and writes the session's first two records. A console consent carries forward to later sessions under the same policy; a changed policy needs a fresh act; the environment's consent never carries. HERE_GRANTS remains as the development and test override, recorded as such.

Proof. The consent plan's three cases; a session without consent stores nothing and the act starts it, with refusals honoured and a second act refused; only a console consent under the same policy carries forward; the status line says it is waiting. The act test fails against a gate that does not check for consent. Linux verifier green on the pinned toolchain; the Windows crates cross-check clean. Not run here: the Tauri window, and the end-to-end suite, which still uses the environment override.

The gate wrote a consent record at boot for whatever the environment asked, and since PR #18 signed it with the device key: a signature over an agreement nobody had made. **What changes.** A session starts with no consent row and stores nothing. The Capture tab opens with the act: every signal in its collector's declared words, tier A pre-chosen, opt-in off, refused signals shown as such, one button. The gate records the choices as a console consent, signed, applies the machine's refusals, and writes the session's first two records. A console consent carries forward to later sessions under the same policy; a changed policy needs a fresh act; the environment's consent never carries. `HERE_GRANTS` remains as the development and test override, recorded as such. **Proof.** The consent plan's three cases; a session without consent stores nothing and the act starts it, with refusals honoured and a second act refused; only a console consent under the same policy carries forward; the status line says it is waiting. The act test fails against a gate that does not check for consent. Linux verifier green on the pinned toolchain; the Windows crates cross-check clean. Not run here: the Tauri window, and the end-to-end suite, which still uses the environment override. 
The gate wrote a consent record the moment it started, for whatever `HERE_GRANTS` asked or
for tier A by default, and since yesterday it signed that record with the device key — a
signature over an agreement nobody had made. Consent was a session bootstrap. The legal memo
calls the manifest-diff-triggers-re-consent rule a legal requirement; there was no consent to
re-trigger.

A session starts with no consent row now. The store already refused to append anything
without one, so nothing is stored; the collectors learn from their heartbeat that nothing is
granted and take nothing; the console's status says "waiting for your consent" and the pill
says "Waiting for consent". The Capture tab opens with the act itself: every signal in the
words its collector declared — what it does, and what it does not — tier A pre-chosen,
opt-in signals off, a signal the machine refused shown as such and not choosable, and one
button. The gate records the choices as a consent given in the console, signed, applies the
machine's refusals whatever was chosen, and writes the session's first two records — that it
began, and what was agreed — which it could not write before there was consent to record. A
second act in the same session is refused: after consent, a change is a grant, with its own
record.

The act is made once, not every morning. A later session starts from the consent the person
last gave in the console on this device under the same policy, recorded as carried forward
from it, with the original act's time kept. A consent under another policy does not carry —
a changed notice needs a fresh act — and a consent from the environment never does, because
nobody gave it. `HERE_GRANTS` remains as the development and test override, and a consent it
produces says so in its own row.

Tests: where a session's consent comes from — the environment overrides, an earlier console
consent carries, otherwise nothing; a session with no consent says so and stores nothing,
the act records the choices and starts recording, a refused signal stays refused, the log
gains its first two records, and a second act is refused; only a console consent under the
same policy carries forward, not the environment's and not another policy's; the status line
says waiting for consent. The act test fails against a gate that grants without checking for
consent — checked, by making it one.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
LNK merged commit 048278056a into main 2026-09-04 21:40:02 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
mikebrandon/here-telemetry-rnd!19
No description provided.