Neo · hands arc · for red-pen

The Hands Arc

Your June fork rulings carried into tonight's world. Built dark tonight; independently reviewed twice; flips gated on the day-10 judge.

Two calls: undo-window default · receipts in his words

Status: continuation spec. The deep plan already exists and is partially ratified —

the-leap-2026-06-20.md carries Robert's four fork decisions verbatim (first slice =

capture-an-obligation · reversible acts fire silently, "the validation IS the safety" ·

charged-but-reversible always confirms · uncertain asks, on a fresh+robust world model).

This spec does NOT reopen them. Its job is the part a month of other work left unstated:

what changed under the leap since June 20, the build order that honors it tonight, and the

one reconciliation the un-muzzling forces. Step-back, answered in writing: this plan is NOT

the surface of a deeper one — it is the build order OF the deeper one, which Robert already

red-penned and partially ratified on 2026-06-20.

LAYER 1 — THE DECISION PAGE

What changed since the leap was inked (why it is buildable tonight)

1. The foundation it gated on has landed. The June ship-gate was "the confabulation fix

green on the real plate." Since then: the LLM/code-boundary trunk merged to main; the

append-only journal, the write-site and durable-store censuses, entity files (M0.3), and

the catcher all shipped; a daily judge cron now measures memory quality against reality

every morning. Fork D's hard prerequisite — a fresh, robust world model — is no longer a

promise, it is measured machinery.

2. The un-muzzling (wave 2) changed who words the acting surfaces. The leap predates

"Eve holds every word." Reconciliation below.

3. Eve now has a second intake mouth. Wave 2's ask ledger captures TEAM asks arriving in

Slack (logged at arrival, acked in her words, silence-means-on-track). The leap's first

slice captures ROBERT's obligations arriving in Telegram. Same experience class — "a

dumped intent becomes a tracked outcome" — two stores today (ask ledger · status

registry). This spec names them siblings and does NOT merge them tonight; unification is

a later, deliberate increment.

The one reconciliation (the un-muzzling applied to acting)

question, the sentence is composed by her real mind through the same compose seam wave 2

built — code hands her the receipt DATA (what was captured, the undo handle, the window),

never a template string.

exact recipient / subject / first line shown for confirmation is a mechanical court

document, byte-verbatim from the stored draft, clearly framed — the same class as the

marked busy signal. It never pretends to be her voice, and she never paraphrases it.

(A paraphrased readback is the scar: a "helpful" summary that hides the wrong recipient.)

What we build tonight (all dark, flags off)

1. Wire the front half. The lane router (built, validated, zero live callers for a

month) becomes the first step of the live Telegram turn, behind a new default-OFF flag.

The router still holds no authority — it can only propose, ask, or fall through to chat.

2. First slice: capture-an-obligation, end to end. Dump → lane → plate write → receipt

in her words → Court card with working undo. (Correction folded from the independent

review: the reversible auto-fire path is NOT unreachable — it is wired and dark, scoped

today to exactly one act, the warm-deal nudge, behind its own flag and three unwired

dependencies. The slice EXTENDS that proven path with a second route for obligations

rather than debuting it.) The say-do ledger also gets its first "acted" call site —

tonight the ledger structurally cannot record that Eve ever did anything.

3. Slice 2 if the night allows: close-a-loop-on-your-word — the confirm path (exact-yes)

wired into the live turn. Builds second because it exercises confirm, per the leap.

4. Designed, explicitly NOT activated tonight: email send, calendar create, Salesforce

write, Slack post, court-callback taps. The activation sequence stays exactly as the leap

wrote it — each its own gated step, Robert watching the smoke test.

The flip discipline (when does any of it turn on)

Build lands dark tonight with the full verification chain (independent pair verdicts on the

trust lanes, the B2/G2 break test proven RED, full suite). **No hands flag flips before the

day-10 judge reading tomorrow morning comes back clean** — that number is the leap's ship-

gate, made a standing reality-number instead of a one-time check. (Review note, answered:

the daily judge grades composed memory against reality — grounded-vs-fabricated is exactly

the confabulation property the June ship-gate named; the mapping is a strengthening, not a

substitution.) After that: obligation-

capture flips on the standing flag-autonomy rule (receipted walk as Robert's proxy, instant

revert); anything irreversible waits for its own increment and Robert's watched smoke test,

unchanged.

Your calls (only what June did not already settle)

1. Undo window default — the leap ships 5 minutes per kind, surfaced for ratification.

Sharpen-not-block: no experiment decides this; it is taste. My default: 5 min stands.

2. Receipts in her words — confirm the reconciliation above (receipts composed, readbacks

mechanical). It follows from your no-muzzle ruling; inked here so it is yours, not mine.

3. Nothing else. Forks A–D stand as you ratified them.

What could go wrong (delta from the leap's own list)

Fence: the receipt DATA (what was captured, undo handle) is journaled independently of her

sentence; the Court card renders from data, not from her prose; the rehearsal-style walk

grades receipt fidelity before any flip.

measured in the walk; if composing a receipt runs long, the fix is retrieval shape, never

a template.

charged mis-judgment) carries unchanged — the answers there were ratified.

LAYER 2 — THE MACHINERY (fenced; Robert never needs to read past here)

Grounded against extract/wave2-stack tonight (scout inventory 2026-07-15 night; builders

re-verify line refs at build time — a month of drift moved them).

Lane H1 — dispatch-first wiring (src/runtime/worker.ts live turn + intent-dispatch.ts):

→ receipt, skip LLM; (2) dispatch(text, seams); (3) question/musing/uncertain-safe

fall through to chat. Seams per M1: validated classifier (fail-up), additive.capture =

StatusRegistry.upsert, isCharged seam wired so charged reversible → confirm (Fork C).

return can never construct an effectful call — grep + type-level check).

**Lane H2 — first slice through the reversible ladder (reversibility-ladder.ts,

reconcile.ts, intent-dispatch.ts, worker construction) — REVISED per review pair:**

by railOneReady (three deps: receiptStore · enqueueDraftApproval · mandates — unwired in

production construction) AND scoped to the warm-deal capability (C3_warm_deal +

draft_nudge) under RAIL_ONE_LADDER_WIRED. And additive.capture today returns a bare

receipt string — it never produces a Proposal, so obligations BYPASS the ladder entirely;

no obligation ActionKind exists.

IRREVERSIBLE_KINDS — its undo is "drop it"); (b) route additive.capture through a real

Proposal → gate → fireReversibleAction, so the receipt row + undo token

(UNDO_WINDOW_MS = 5 min default) + Court surfacing ride the PROVEN path; (c) supply the

three deps in worker construction; (d) gate the obligation route behind its OWN flag

HANDS_OBLIGATION_FIRE default OFF — do NOT overload RAIL_ONE_LADDER_WIRED

(warm-deals keeps its own gate; flag precedence stated in code: each fire route checks

its own flag AND railOneReady; neither implies the other).

("Refused …") are mechanical audit data — court documents, never her voice. Her RECEIPT

sentence is composed; the audit row is data. Same split as receipts-vs-readbacks.

Telegram mouth) → her one-liner. Compose failure on a RECEIPT = silence + journaled warn

(the act still happened and is on the Court; the fork flag governs only ask-acks).

accounting becomes real.

Lane H3 — slice 2, close-a-loop (eve-think-confirm.ts): wire handleConfirmTurn into

the live turn (same flag family, HANDS_CONFIRM_TURN default OFF); resolveConfirmation

stays the single humanClose site; exact-yes set unchanged.

Lane H4 — the break tests + walk fixtures (trust machinery, pair-verified):

a scratch copy → a send_email proposal MUST turn a test RED. Both belts proven

independently.

irreversible lands as draft card, nothing leaves · undo works and the Court shows it gone)

as executable fixtures; the receipted lead walk runs before any flip.

the receipt-fidelity check (data vs her sentence) anchors with a planted-mismatch that

MUST fail.

Verification plan: per lane red-first fixtures + lead gates (focused + tsc); pair

verdicts (codex+opus) on H1+H2+H4 (trust machinery); solo codex on H3; full suite once on

the integration stack; grep-zero for any template string in the acting speech path; then the

lead's receipted walk. Flips per L1's flip discipline.

Rollback: all dark behind three default-OFF flags; deletion-free diffs except dep wiring;

deploy rides the standing anchor discipline.

Sequencing tonight: H1 ∥ H2 (disjoint until the worker-construction seam; H2 owns

worker construction) → H3 → H4 fixtures ride each lane's tests + a dedicated falsify round →

stack → suite → verdicts → (dark) deploy with wave 2's merge or after it.