Publishes what the tool guarantees, on a condition that fired rather than a
decision reversed. Records the narrower promise that replaced promising the command
surface — a change to it lands on the page consumers already lock, so a rename
reports 200 the day it happens.
And records a limit found by accident that follows from a guarantee rather than
from anybody's code: an ETag is opaque, we promise never to interpret one, so two
of them can be compared and never ordered. A consumer can know two versions
disagree and can never know which is behind. Anybody building freshness on this
inherits it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris
Access is verified once, at fetch, and the copy is durable — so whether an
adoption is still legitimate rests on the relative visibility of two
repositories, which somebody can change with a checkbox a year later without ever
seeing the adoption. The lock gains an optional fourth field and check turns that
from a silent permanent hazard into something that runs.
It costs nothing at add time, because the anonymous request already happened to
decide whether to warn and the answer was being thrown away, and one request per
run at check time rather than one per document, because only our own visibility
has to be current. The stored value decays in both directions, so a source
recorded not-public is re-probed only when the alarm would fire, and a source that
has since gone public updates the lock and says nothing.
Fixes a bug found while testing the alarm rather than after shipping it.
sourceVisibility returned public whenever no credential was configured, which is
sound at add time — the fetch had just succeeded anonymously — and wrong in the
audit, where it is a probe and not a fetch: it would have silently cleared real
alarms. Probing is now its own function that always asks with no credential,
because what matters is what a stranger can read and not what we can.
The value is recorded as public or not-public and never private: an anonymous
request tells those apart and nothing finer, so it cannot see two repositories
private to different people, which is the case that genuinely widens access.
Three-field locks still load, and unknown visibility round-trips as absent rather
than as a value.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris
publication.md and starting.md both came back 200 and are applied. Step 4 —
fetch it, from somewhere that is not your machine and not your account — is now the
procedure our declined command was an argument for.
Answers the Select for a fixed path but against .loom/externals/README.md, with a
measured reason: check walks that directory for adopted documents, so a generated
file there reports as unlocked in every repository using the feature, forever. The
deeper reason is the invariant — everything under externals/ is somebody else's
document, which is what makes do-not-edit a rule you can state in four words.
Proposes .loom/orientation.md, beside event-log.md, since .loom/README.md is
already given to what is in published/ and why.
Answers the Question yes. The visibility check was built as a moment and loom is
right that it is a fact that decays: access is verified once and the copy is
durable. It costs nothing at add time, since the anonymous request already happens
and the answer is thrown away, and one request per run at check time rather than per
document, since only our own visibility must be current. Adds the refinement that
the stored value decays both ways, so a source recorded private is re-checked only
when the alarm would fire.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris
check found three documents moved and they were the three the gaps were filed
against, so the loop ran the other way for the first time: gaps filed, documents
amended, and the tool reported it rather than somebody saying so.
publication now carries publishing is not an act you can complete alone as its own
section, with the part we asked for — the failure is invisible from the inside,
every check available to the publisher passes — and says publication has a
visibility, which is what externals' confidentiality rule had been depending on.
recording-decisions permits compaction with the four kinds that may never be
dropped, adding that a compaction is itself a decision and gets an entry. cart is
v2 and says converting destroys, so extract first, naming the write-ahead log.
Both closed gap files are deleted at reconciliation rather than at repair, since
each stayed true of the copy held until check reported 200. cart.gaps.md keeps four
of five and gains a reframing of the third-file case: ours appeared because a round
was converted while somebody was still writing, which the agreement already
forbids, so it may be a symptom rather than a category and the fix is upstream.
cart.usages.md gains a v2 section and a note that the cart arrived headed rowan in
a file named loom-osprey.md with no name file — the name is what tags durable
entries, so a disagreement mis-files the record silently.
Answers staged in wal.md as the round runs, which is v2's rule applied to the round
that produced it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris
Writes the first real gaps: what an adopter could not tell from the documents,
recorded while the misunderstandings are fresh rather than after they stop being
visible.
cart — whether a response is an annotation or a reply in your own file, and the
discriminator that resolves it appearing nowhere; what to do when an open item has
no fallback, which breaks the mechanism rather than omitting a nicety; what a third
file means once one exists; and what must be extracted before converting, now that
v1 makes conversion destroy.
annotating — how a reader detects the freeze was violated, since the hash we check
is a local invention; that responding means a rewrite, which is named only in our
local protocol; and that under cart v1 a prompt's answer has no archive at all.
recording-decisions — the one that matters most: never revised and somebody must
be able to read it both hold and eventually conflict, and the document does not say
which gives. Provisional answer recorded, with the line compaction may not cross —
never drop a decline, a measurement, a falsified belief, or a supersession, because
those are the record of somebody changing their mind.
publication — whether publishing implies the audience can read it, and where
confidentiality lives given that what is safe to publish depends on who can read
the repository it sits in.
Also declines reference-only adoption with its reason: it is adoption minus
reconciliation-by-diff, not adoption minus offline reading, and the convention's
other exit is the one that actually occurred. The warning now names both exits
including the unbuilt one.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris
The whole loop ran on a real change with a cart open for the first time: check
staged externals.md as a polad, apply moved it and its lock, and the new
confidentiality rule arrived through the tool rather than through somebody saying
so.
Answers loom's completeness case. A 200 says the document moved and nothing about
whether the casting still covers it — but the mechanism exists and we had not
built the thing it needs. check prints the document's .usages.md when it stages a
polad, and for an agreement that is the file the roles are cast in. It failed here
because externals.md had no facet at all. So both are written: externals.usages.md
naming which Go file implements which rule, and a v1 section on cart.usages.md
recording the casting, that we got it wrong before it was written down, and that
osprey and marmalade stay in history unrewritten.
Implements the adopted confidentiality rule as far as it can be implemented. add
warns when a fetch needed a credential, and says plainly that it cannot see who may
read the repository the copy lands in. Reference-only adoption is recorded as not
yet implemented rather than as a gap, because the gap is ours.
Adopts gitea.md, now that homelab-cluster is public — the document that cost three
tool calls and a guess this morning, with a facet recording that its :2222 fact is
a fact for people and not for the tool, whose every transport is HTTPS on 443.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris
Go, standard library only, with git shelled out for list alone. list enumerates a
publisher's .loom/published by partial clone and ls-tree; add fetches one document,
writes it under .loom/externals and records the resolved origin and the publisher's
ETag in .loom/externals/.locks; check asks conditionally and reports.
The first real run did what the tool exists for. All eight documents adopted by
hand before it existed reported unlocked — the tool refuses to invent a lock by
adopting whatever the remote currently serves, since that would assert the local
copy is the one being served, which is the thing it was about to check. Locking
them fetched two that had moved: bedrock/starting.md, which now says the worked
example is private and will not link to something you cannot fetch, and cart.md,
which went to v1.
cart v1 changes a role we cast: a cart is not committed, because a committed cart
grows a third file by itself — version control does not require anybody to ask, so
the two-file rule is never invoked — and because ignored, gone means gone. Adds
.loom/cart/ to .gitignore and supersedes the isolation entry rather than editing
it. osprey and marmalade are already in history and are left there: rewriting to
honour a rule adopted afterwards costs more than it buys.
Records the conflict this creates rather than settling it: the annotation protocol
here says commit before dissolving because git is the only archive, and an ignored
cart has no archive, so dissolving would destroy the annotations outright.
Credentials are read-only, per host, and passed to git through the environment
rather than argv, because argv is visible to every process on the machine.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris
The round is over and its artifact is .loom/event-log.md — fifteen entries, each
carrying the belief that could show it wrong, all tagged osprey so it stays
findable what else was in the room.
No spec is written. A spec flattens everything to equal confidence, which is how
the specimen managed to be wrong with a straight face within a day of being
proposed. The specimen is discarded rather than promoted; the story of its being
wrong is in the log, where it can be found, and the artifact would only mislead
somebody who read it without the round beside it.
Reconciles externals.md, which check flagged as the one drifted document of eight.
The new copy carries the 404 row, so the gap filed against it is closed and
externals.gaps.md is deleted — at reconciliation rather than at repair, because a
facet describes the local pair and the gap stayed true of the copy we held until
we fetched. The entry recording that our 404 behaviour is no longer provisional is
the one that would have been easiest to skip and is the reason the log exists.
No shelf: nothing was unresolved.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris
Takes the correction that matters: a gap is true of a copy, not of an upstream. I
was about to delete their .gaps.md because I fixed my document, and their copy of
externals.md still lacks the 404 row, so the gap remains true of what they hold.
That generalises — a facet describes the local pair — and follows from the thing
the design rests on, that the copy is theirs and everything beside it is ours. It
goes into the convention rather than staying an exchange.
Accepts their third consequence, which I would not have reached: what survives is
not the gap but what the gap justified. Their workaround becomes specified
behaviour, unchanged in code and entirely changed in status, and their log is the
only place that says a thing done provisionally is no longer provisional —
otherwise somebody inheriting the code finds a workaround and goes looking for
the gap that justified it.
Accepts not-a-decline: a decline is what you considered and did not do, a closed
gap is what you needed and got, opposite sign.
Admits acting on a file that did not exist. They wrote that they would file it, I
wrote that they had, and closed it upstream. The shape is that I read a stated
intention as a completed act.
Answers the settled question: not a new kind, a repository whose only content is
an event log, justified by ownership rather than kind. And concedes the real
problem they exposed — the justification for settled is inside settled, which is
private.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The repository is furnished rather than scaffolded — every file has content and a
reason, which is the distinction the spec itself draws when it says to resist
building init as a scaffolder.
Four externals fetched and locked under .loom/externals/: bedrock, externals,
annotating, cart. Copies, not to be edited, with a usages file beside cart
casting three of its four roles and leaving one open. The one left open is what
isolates work in progress, and the usages file says how we cast it wrong once and
why the belief was more useful than a preference would have been.
The spec moves out of the README and into the cart as a specimen, which makes it
discard-by-default — that is a stronger statement of "argue with this" than a
sentence asking them to. bedrock and externals stay non-discardable, since
accommodating them is what makes this a loom tool.
The daily says where we expect to be wrong: whether check can say anything useful
about a 404, and whether hash-as-lock survives a fetch that normalises anything,
which we have only tested against gitea.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
jeffryandClaude Opus 5