Milestone H: agents think IN the graph. Born from a render of the record, working inside each file’s epistemic halo, shedding what they learn as atoms, dying without losing anything — with the honest ceiling printed on the surface: strategy stays human.
Draft for Robert’s annotation · not approved · no building yet
How this draft was made — two adversaries, opposite mandates, one convergence
You asked for a spar. Two blind Fable adversaries reviewed the v1 plan: a skeptic with license to reject the frame (verdict: 6.5/10 REVISE — three real blockers, each verified against live machinery before folding: the join couldn’t reach the spec’s own opening story, a safety premise was false against the door’s code, the experiment bar could license a regression), and an ambition adversary ordered to find the bigger thing (verdict: RAISE-TO — the plan was one story too small). They converged from opposite directions on the same finding: the write half was under-weighted. When the lens hunting overreach and the lens hunting underreach point at the same door — that’s the door. The raise is adopted in this draft; your R5 confirms or trims it.
The skeptic’s cited frontier scan licenses the design: nothing in the field carries verified currency + adversarial fight records into agent context, and our differentiators land exactly on the field’s three named unsolved problems — memory poisoning (→ our courts and door), knowledge-graph staleness (→ our suspects and currency proofs), context rot (→ the one-hop fence).
The one-line claim, raised: context itself becomes a compiled, receipted artifact. A worker is BORN from a render of the record, WORKS inside the file’s epistemic halo, SHEDS what it learns as atoms, and DIES losing nothing. The honest ceiling, measured: the record cannot see mission work — strategy stays human, and the surface says so.
The journey of one worker
Born knowing. Today, every worker’s briefing is hand-written by our most expensive mind — me, as your fleet’s secretary. Under H, the briefing is compiled from the record, and it carries its own receipt: exactly which atoms, at exactly which pin. “What did this builder know when it erred” becomes a query — a mistake is diagnosable as a context-bug vs a model-bug.
↘ deeper — why this is falsifiable
The prompt-compiler experiment (H2): replayed REAL past dispatches (never post-hoc straw controls) vs halo-compiled context. Correctness non-inferiority is a mandatory conjunct — a token win that drops quality licenses nothing. And arm C runs the compiled context ONE TIER DOWN: the thesis’s “worker quality becomes a price knob” claim, finally tested. If arm C recovers <50% of the tier gap, that consequence is struck from the thesis doc, on the record.
Works in the halo. The moment it touches a file: every claim resting there (with fight records), every ruling constraining it, every standing defeater and suspect, every unsatisfied anchor — each with receipts and honest fences. Yesterday a reviewer found a shipped function with zero callers by forty minutes of archaeology; the halo makes that a lookup. Ships INSIDE prime and change_brief — the organs 30 fleet repos already call. Default-on in quanta only until the experiment renders (an empty halo everywhere would teach agents to skip it).
↘ deeper — the skeptic’s blocker, folded
The skeptic RAN the naive join and the spec’s own opening file came back empty — rulings carry no evidence anchors. Folded: the join key widens to evidence paths ∪ receipt-command paths ∪ about-pairs, so the intent plane anchors by the files its receipts touch. The walk stays ONE hop — the live risk today is recall, not explosion, and the fence is named on the surface.
Sheds as it goes. Divergences, receipts, run results mint as atoms DURING the work — plus the workshop’s two most-paid-for atoms from the dogfood night: run-receipts (“gate 227/0 at sha X” — rehydration becomes reading) and environment stamps (both of yesterday’s refuted false claims lived exactly in unstamped environment assertions). One NEW trust rule, honestly declared: the door today would accept a session grading its own claim — H3 builds the self-verdict refusal, the poisoning hole the field literature names.
Dies losing nothing. The resume drill, sealed: kill a real task mid-flight (it happened three times in one night — we have natural fixtures), resurrect one arm from transcript-plus-prose, one from atoms only. Minutes-to-first-correct-action, judged against a sealed rubric. If atoms aren’t faster AND safer, the workshop marinade closes as anecdote — banked honestly.
The fleet inherits. The tenth builder inherits nine builders’ adjudicated truth. Cross-repo enters by ONE proven edge: de-heart-api’s endpoint contract as a claim another repo’s gate rests on — remote statement-hash pinned at mint (never cross-clock timestamps), unresolvable remotes fenced loud (never a permanent false suspect). And the aims this compounds into, named not built: the priced change (the halo join makes the autonomy dial priceable) and the reward ledger (fight records replayed as evals across tiers).
Your five calls
R5 — the raise itself
Both adversaries pointed at the same bigger frame; this draft adopts it: same machinery, bigger claim, two extra experiment arms. Confirm the Compiled Mind, or trim back to Halo-only?
R3 — the licensing bar
(≥20% token reduction OR ≥1 judge-confirmed stale-context catch per 5 tasks) AND correctness non-inferior — the conjunct is mandatory, denominators sealed before arms. Bless or adjust the numbers.
R1 — the halo’s courtside manner
Verdict + one-line fight summary by default, full record one dereference away (the lens discipline). That dereference is also our honest adoption metric.
R2 — citizenship’s blast radius
Workflow builders first (already contractual); sessions join when the Work Contract lands. Widen or hold?
R4 — the name
“Milestone H — the Compiled Mind,” Halo as its read lobe. H continues R·W·I·E. Blessing or better name?
Increments & the kill criteria
H1 · the halo read (~a day) — federated join, wide key, one hop, 5 gates each with a named break that must go red. Quanta-only default.
H2 · the experiments — prompt-compiler (arms A/B/C) + the resume drill, sealed first. Gates H4 + the fleet default. A null demotes the milestone honestly.
H3 · citizenship — continuous deposit + run-receipts + environment stamps + the self-verdict door rule. Stands on the dogfood evidence, NOT gated on H2.
H4 · one cross-repo edge — gated on H2’s bar; hash-pinned, fence-loud.
What could go wrong — named, with counters
Scope-death. A “context platform” is how a small company drowns. Counter: the quarter is four items, each days-scale; nothing else until numbers license it.
Staleness sold as truth.Counter: currency proofs + fences are the engine’s whole point; every halo entry carries them.
Citizenship spam / poisoning.Counter: the door’s schema, the swarm’s verdicts, the new self-verdict refusal — mechanism, not trust-scoring heuristics.
Overselling the mind. The record cannot carry strategy (overlap-zero, measured). Counter: the ceiling is printed on the surface itself; mission work stays yours.
Agents ignore it.Counter: ships inside organs they already call; the dereference metric makes ignoring measurable.
The cited frontier (the skeptic’s scan — grep-verified)
Aider repo-map (the field default: structure, zero epistemics) · Lost in the Middle, TACL 2024 + Chroma’s context-rot (curated-small beats stuffed-long — licenses our one-hop fence) · Anthropic’s context-engineering guidance (note-taking = unverified prose memory — exactly the wound class our receipts answer) · MINJA + memory-poisoning literature (>95% injection success on memory agents; heuristic defenses — our door + courts are the structural answer, once self-verdict closes) · MemGPT/Letta (self-edited memory: the asserter grades itself — our court split is the delta) · GraphRAG cost/staleness studies (why we federate over two self-maintaining stores instead of building a third).
Canonical: docs/ai/SPEC-milestone-H.md (v3, panel-folded, #182). Panel transcripts on disk. Nothing builds before your word.