Say who a signal can be about, and refuse the ones that reach past the person who pressed Start #5

Merged

LNK merged 1 commit from claude/subjects into main

2026-09-04 17:52:09 +00:00

LNK commented

2026-09-04 17:52:08 +00:00

Contributor

What changes. Each manifest declares subjects: operator or room. The lint makes the word cost something: microphone or camera in requires forces room, a room signal's event types must be tier C in the registry, and tier C belongs to nothing else. All seven shipped signals say operator, and the contract test asserts that, so the day a room signal is declared, two places say so.

What the gate does with it. Three things, off one predicate: can this machine say the room agreed. At grant time a room signal joins the machine's own refusals. At the gate a content record from a room signal is held under L1.room_not_clear if a collector runs anyway. In the heartbeat reply room_clear tells the collector, the way granted already tells the frames collector to take no pixels. The predicate is a constant false on purpose: no platform this runs on has a presence sense or an affordance a bystander could see. When one does, it becomes a capability beside the indicator's own verifiability.

Docs. Decisions page, legal memo item 8 (now enforced rather than remembered), the seven-signals page, README invariants.

Proof. A fixture catalogue with a room signal and an operator one: the first is refused, the second is not. The shipped catalogue refuses nothing. Flipping the screenshots manifest to room fails the lint on the tier rule, checked by doing it. Linux verifier on the pinned toolchain green; the Windows verifier and the end-to-end suite were not run here.

The last item from the review: the client assumed one consenter without ever saying so. Everything it captures is about the person who pressed Start, on their own machine, with a pill on their own screen. A microphone or a camera would have taken the same grant from the same tab and recorded everyone within reach. **What changes.** Each manifest declares `subjects`: `operator` or `room`. The lint makes the word cost something: `microphone` or `camera` in `requires` forces `room`, a room signal's event types must be tier C in the registry, and tier C belongs to nothing else. All seven shipped signals say `operator`, and the contract test asserts that, so the day a room signal is declared, two places say so. **What the gate does with it.** Three things, off one predicate: can this machine say the room agreed. At grant time a room signal joins the machine's own refusals. At the gate a content record from a room signal is held under `L1.room_not_clear` if a collector runs anyway. In the heartbeat reply `room_clear` tells the collector, the way `granted` already tells the frames collector to take no pixels. The predicate is a constant `false` on purpose: no platform this runs on has a presence sense or an affordance a bystander could see. When one does, it becomes a capability beside the indicator's own verifiability. **Docs.** Decisions page, legal memo item 8 (now enforced rather than remembered), the seven-signals page, README invariants. **Proof.** A fixture catalogue with a room signal and an operator one: the first is refused, the second is not. The shipped catalogue refuses nothing. Flipping the screenshots manifest to `room` fails the lint on the tier rule, checked by doing it. Linux verifier on the pinned toolchain green; the Windows verifier and the end-to-end suite were not run here.

LNK added 1 commit

2026-09-04 17:52:08 +00:00

Say who a signal can be about, and refuse the ones that reach past the person who pressed Start 258f245402

Everything this client captures is about one person: the operator, on their own machine,
with a pill on their own screen. Consent is theirs, scope is their applications, deletion is
their right. The architecture never said so. A microphone or a camera would not have noticed:
it would have taken the same grant from the same tab, passed the same gate, and recorded
everyone within reach — none of whom installed anything or has a pill to look at. The legal
memo carried that as a product rule, "voice stays push-to-talk or in-meeting", which is a
sentence somebody has to remember.

Each manifest now declares `subjects`: `operator` or `room`. `contracts-lint` makes the word
cost something. A manifest that requires a microphone or a camera has to say `room`, a room
signal's event types have to sit in tier C in the registry — a tier of their own, so nobody
who consented to screenshots of their IDE turns on a device that records their family from
the same list — and tier C belongs to nothing else.

The gate makes it a refusal rather than a note, in three places. At grant time, a room signal
joins the machine's own refusals and is not granted, whatever was asked for. At the gate, a
content record from a room signal is held under `L1.room_not_clear` if a collector runs
anyway. And in the heartbeat reply, `room_clear` tells the collector itself, the way
`granted` already tells the frames collector to take no pixels — so a future microphone
process holds no sample it would have to discard.

All three hang off one predicate: can this machine say the room agreed. It is a constant
`false`, deliberately, because no platform this runs on has a presence sense or an affordance
a bystander could see, and a function that guessed would be the lie this change exists to
prevent. When a platform can answer, it becomes a capability beside the indicator's own
verifiability, which is the same question asked of a different audience.

Tests: a fixture catalogue with a room signal and an operator one — the first is refused, the
second is not; the shipped catalogue is all operator and refuses nothing, asserted in the
contract as well, so the day a room signal is declared both places say so; the reply field
defaults so an older gate still parses.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

LNK merged commit b2d3eb8426 into main

2026-09-04 17:52:09 +00:00

LNK referenced this pull request from a commit

2026-09-04 17:52:09 +00:00

Merge pull request #5 from claude/subjects

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

mikebrandon/here-telemetry-rnd!5

No description provided.

Rows
Columns