feat: charter-refusal — the keystone, recorded into the scar#2
Merged
Conversation
The first invariant realized in code, and the one that was the original worry made into a mechanism: how an agent accumulates *metabolized failure* across time — wisdom it can persist. `ScarLog` is append-only and hash-chained: - record() is the only mutation — no edit, no delete (no Demiurgic forgetting). - a wound (Mistake/Refusal) with no lesson is an *open wound*; heal() closes it by APPENDING a Healing that names it — the wound is never mutated. - each entry is content-addressed (b3-…) and links to its parent; verify_chain() recomputes the ids and the links, so tampering is detectable (interlock with the `provenance` invariant). - Refusal is Scar-worthy: a declined action is recorded as ScarKind::Refusal (the keystone writes into the memory). Turns steward-charter into a Cargo workspace (doctrine + reference crates) and adds the governance the line requires now that there's code: .githooks/pre-push (fmt --check + clippy -D warnings + test) mirrored by .github/workflows/ci.yml and a justfile, cross-referenced for parity. 9 tests green (8 unit + 1 doctest), clippy -D warnings clean, fmt clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The Refusal invariant in code, depending on charter-scar on purpose: the
dependency edge IS the interlock the doctrine describes — a refusal is recorded
into the memory.
- Decision::resolve(log, choose) takes a chooser that may ALWAYS return
Choice::Refuse; the Verdict type always admits Refused. You cannot construct a
decision whose only outcome is proceed — that is "the possibility of dissent
may not be eliminated," structurally.
- A refusal records a ScarKind::Refusal into the log (reason + declined action)
and comes back as Verdict::Refused { reason, scar }; proceeding records nothing.
- Decision.authorized carries the "can" (within the writ); the chooser governs
the "should". Refusing an authorized action is the can/should wedge against the
Demiurge / Confused Deputy — and it is recorded. The dual of the Writ.
- refusals(&log) makes dissent first-class and queryable (the audit question).
16 tests across the workspace (8 scar + 6 refusal + 2 doctests), clippy -D
warnings clean, fmt clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Refusal invariant in code — and it depends on
charter-scaron purpose: the dependency edge is the interlock the doctrine describes (a refusal is recorded into the memory).Decision::resolve(log, choose)takes a chooser that may always returnChoice::Refuse;Verdictalways admitsRefused. You cannot construct a decision whose only outcome is proceed — that's "the possibility of dissent may not be eliminated," structurally.ScarKind::Refusal(reason + declined action) and returnsVerdict::Refused { reason, scar }; proceeding records nothing.Decision.authorizedcarries the can (within the writ); the chooser governs the should. Refusing an authorized action is the can/should wedge against the Demiurge / Confused Deputy — and it's recorded. The dual of the Writ.refusals(&log)makes dissent first-class and queryable (the audit question "how could this have been declined?").The keystone doctest is the whole thesis: an injected request the agent can satisfy is declined as not warranted, and the refusal lands in the memory as an open wound until metabolized.
Verification
16 tests across the workspace (8 scar + 6 refusal + 2 doctests) · clippy -D warnings clean · fmt clean · pre-push hook passed.
Stack
Stacked on #1 (base
feat/charter-scar); re-targets to main as the stack lands.risk: low (new crate, additive).