Add A17, the knowledge store contract (Outline) #22

2026-09-08T19:20:59Z

dev-agent commented

2026-09-08 19:20:59 +00:00

Doc-only, and the product of our discussion rather than a fresh proposal — the decisions are yours, written down.

The gap: Part D said what Outline is for but never how to build against it. It was the only external integration with no A-series component, while Transport (A1), LLM (A5), Browser (A6), Secrets (A7), SSO (A8) and Logging (A9) all have one.

What A17 settles

Sharing is read access, never write access. Every document has exactly one writer, so concurrent writers never exist by construction — which disposes of the last-write-wins objection Part D itself raises, with no distributed-write machinery. Default shared membership is operator + nisse-ops; nisse-dev gets private space only, because B3 seals it from RFC1918 and a shared network-architecture document is a map of precisely what it is sealed from.

Agent-owned knowledge is always a cache, never authority. Rely on it to know what exists and where to look; verify the specific fact against the live system before acting.

Enforcement is structural, because a prompt is not enforcement. This is the part I'd most like reviewed. A model cannot be prevented from believing what it reads, and "treat this as a cache" is exactly the advisory guarantee A4 and A12 reject — this project has three demonstrations of prompt instructions failing under pressure already. So the enforceable goal is narrower: an unverified belief must not become an irreversible action. Four mechanisms carry it, leaning hardest on surfacing evidence quality at the confirmation gate C2 already requires, since that puts the judgment where authority already lives. The residual risk — a model retyping a fact from context with no retrieval event — is stated rather than papered over.

Never an instruction channel, never an approval channel. Recorded here and again in A4 where approvals are specified, since that is where someone would look.

Corrections flow through transport, not direct edits — and that turns out to be better provenance, not merely safer: a hand edit is invisible to the agent's record, while an instruction arrives authenticated, logged, and reconcilable against what the agent believed. Break-glass keeps your write permission and reuses Part F's idle flag.

Retrieved content is snapshotted into the canonical log, because A10 forbids a mutable provider handle being the only reference to content — with the A3 consequence that boot must re-fetch snapshots for tasks resumed across a restart, or a corrected fact silently persists in the old transcript.

Outage posture is asymmetric, unlike B2's poller: write failures never block, but a failed read of a procedure bound to a confirm-first action gates, because proceeding is acting unconstrained on exactly the operation someone bothered to write a procedure for.

Deliberately deferred

The operator-writable procedures collection you mentioned wanting "in time": the interface is defined, the content and the C2 action-class binding arrive with the policy taxonomy, which Part H already defers.

Nothing here is scheduled before build step 10, so this is settling it on paper rather than under pressure.

🤖 Generated with Claude Code

Doc-only, and the product of our discussion rather than a fresh proposal — the decisions are yours, written down. **The gap:** Part D said what Outline is *for* but never how to build against it. It was the only external integration with no A-series component, while Transport (A1), LLM (A5), Browser (A6), Secrets (A7), SSO (A8) and Logging (A9) all have one. ### What A17 settles **Sharing is read access, never write access.** Every document has exactly one writer, so concurrent writers never exist by construction — which disposes of the last-write-wins objection Part D itself raises, with no distributed-write machinery. Default shared membership is **operator + `nisse-ops`**; `nisse-dev` gets private space only, because B3 seals it from RFC1918 and a shared network-architecture document is a map of precisely what it is sealed from. **Agent-owned knowledge is always a cache, never authority.** Rely on it to know what exists and where to look; verify the specific fact against the live system before acting. **Enforcement is structural, because a prompt is not enforcement.** This is the part I'd most like reviewed. A model cannot be prevented from *believing* what it reads, and "treat this as a cache" is exactly the advisory guarantee A4 and A12 reject — this project has three demonstrations of prompt instructions failing under pressure already. So the enforceable goal is narrower: **an unverified belief must not become an irreversible action.** Four mechanisms carry it, leaning hardest on surfacing evidence quality at the confirmation gate C2 already requires, since that puts the judgment where authority already lives. The residual risk — a model retyping a fact from context with no retrieval event — is stated rather than papered over. **Never an instruction channel, never an approval channel.** Recorded here and again in A4 where approvals are specified, since that is where someone would look. **Corrections flow through transport, not direct edits** — and that turns out to be better provenance, not merely safer: a hand edit is invisible to the agent's record, while an instruction arrives authenticated, logged, and reconcilable against what the agent believed. Break-glass keeps your write permission and reuses Part F's idle flag. **Retrieved content is snapshotted into the canonical log**, because A10 forbids a mutable provider handle being the only reference to content — with the A3 consequence that boot must re-fetch snapshots for tasks resumed across a restart, or a corrected fact silently persists in the old transcript. **Outage posture is asymmetric**, unlike B2's poller: write failures never block, but a failed read of a procedure bound to a confirm-first action *gates*, because proceeding is acting unconstrained on exactly the operation someone bothered to write a procedure for. ### Deliberately deferred The operator-writable procedures collection you mentioned wanting "in time": the interface is defined, the content and the C2 action-class binding arrive with the policy taxonomy, which Part H already defers. Nothing here is scheduled before build step 10, so this is settling it on paper rather than under pressure. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dev-agent added 1 commit 2026-09-08 19:20:59 +00:00

Add A17, the knowledge store contract (Outline)

CI / checks (push) Skipped

CI / checks (pull_request) Successful in 1m3s

Details

b8ba683595

Part D said what Outline is for but never how to build against it —
the only external integration with no A-series component, while
Transport, LLM, Browser, Secrets, SSO and Logging all have one. A17
supplies the contract.

Settled here:

- Sharing is read access, never write access. Every document has
  exactly one writer, so concurrent writers never exist and Part D's
  last-write-wins objection disposes of itself. Default shared
  membership is operator + nisse-ops; nisse-dev gets private space
  only, since B3 seals it from the LAN and a shared network map is a
  map of what it is sealed from
- Agent-owned knowledge is always a cache, never authority: rely on
  it to know what exists and where to look, verify a specific fact
  against the live system before acting on it
- Enforcement is structural, because a prompt is not enforcement. A
  model cannot be stopped from believing what it reads, so the
  enforceable goal is narrower — an unverified belief must not become
  an irreversible action — and four mechanisms carry it, leaning
  hardest on surfacing provenance at the human gate that C2 already
  requires
- Never an instruction channel and never an approval channel, stated
  both here and in A4 where approvals are specified
- Corrections flow through transport rather than direct edits, which
  is better provenance: a hand edit is invisible to the agent's
  record, an instruction is authenticated, logged, and reconcilable.
  Break-glass reuses Part F's idle flag
- Retrieved content is snapshotted into the canonical log, since A10
  forbids a mutable provider handle being the only reference — with
  the A3 consequence that boot must re-fetch snapshots for resumed
  tasks
- Outage posture is asymmetric: write failures never block, but a
  failed read of a procedure bound to a confirm-first action gates,
  because proceeding is acting unconstrained on exactly the operation
  someone wrote a procedure for

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dev-agent added 1 commit 2026-09-08 19:23:18 +00:00

Give A17 its canonical event, and point Part G at the contract

CI / checks (push) Skipped

CI / checks (pull_request) Successful in 58s

Details

9362a134c9

Two loose ends in the A17 amendment, both found by asking whether the
build order needed changing:

- A17 requires retrieved content to be snapshotted into the canonical
  log, but A10's event table — the authoritative list — had no row for
  it, so an implementer reading A10 would never know to add one.
  knowledge_retrieved now carries the text as read, the document ID,
  its revision, and when it was read
- Part G step 10 already scheduled Outline, so the ordering does not
  change; it now names A17 rather than only Part D, and says which
  half arrives first — the world model, with operator procedures
  waiting on the C2 taxonomy they bind to

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dongar approved these changes

2026-09-08 19:23:32 +00:00

Dismissed

dongar approved these changes

2026-09-08 19:24:55 +00:00

dongar merged commit f2ba932744 into main

2026-09-08 19:25:00 +00:00

dongar deleted branch a17-knowledge-store

2026-09-08 19:25:01 +00:00

dev-agent referenced this pull request

2026-09-08 19:37:13 +00:00

Map A17 onto Outline's actual primitives, and record the MCP decision #23