UP-030 · Agency · STATED CHECKABLE RUNNABLE EXECUTED STAGED

Intervention Provenance

Every intervention carries the Worker and generation that made it and the evidence it acted on; an unattributable intervention is inadmissible.

Standing

STATED CHECKABLE RUNNABLE EXECUTED STAGED PUBLISHED REPRODUCED

Last checked

never run

Source

none — this record cites no check

Limit

Cell 17 (append-only audit) is proved, which makes the record durable. The pattern asks for the EFFECT to be re-observed, and the honest half of this record is that the re-observation does not exist — Pty::winsize() has zero callers.

Next rung

in_tree — a caller for the re-observation, so that an intervention's effect is measured rather than assumed from its request.

Intent

Acting on a world someone else inhabits — a terminal, a filesystem, a user's machine — is admissible only when the action can be answered for: who, under which generation of authority, on what evidence. The operator-disclosure policy is keyed on Worker + generation because, when this was measured, no cross-peer terminal authority existed to key it on.

Problem

An agent writes to a terminal. Later, something is different. Which action did it, under whose authority, because of what? Without provenance the answer is a log grep and a guess, and the guess is usually 'the agent'.

Solution

Attach Worker, generation and evidence to every intervention before it is attempted. Append the outcome as one of three values. Never rewrite. Name the re-observation the design depends on and check it has callers.

Real-world analogy

A surgical count: every instrument signed in and out by name, and an operation that cannot account for one is not closed.

Structure — on the surface

An illustration on a compute surface: loci above, carriers below. Press Play or Step; the takeaways collect as you go. Nothing here is evidence — the witness section is.

The chapter in WRL — and the chain so far

Chapter 30 of 32 — the fragment _patterns/wrl/chain/intervention-provenance.wrl, sealed alone by wrl.js

; INTERVENTION PROVENANCE — two writers (w=7, w=9) intervene on the same locus; every receipt names its writer
; and sequence. ip_in is the entry, fed by the sufficiency router.
[relay:ip_in]{sig_in, sig_out}
[spinner:ip_world](w=16, n=8, rotor=quarter_turn_z, configurable){sig_in, socket}
[orb:ip_view]{pose}

[ip_in] --sig--> [ip_world]
[ip_world] --socket--> [ip_view]

Its test bench _patterns/wrl/chain/intervention-provenance.bench.wrl — drives the entry for this chapter's own film; never part of the chain

; TEST BENCH — drives this chapter's entry alone; the chain replaces it with a wire from an earlier chapter
[pulser:ip_bench](every 1){sig_out}
[ip_bench] --sig--> [ip_in]

module + bench seal to → sem-28af0fc6bf2e128c06f301cb8034fd36dd2e56830f932f9d057a3aad049676dc

Run inputs — a ScenarioV1, the forge's own document, bound to this world's id and never part of it (D3) · ScenarioDigest scen-1b546f491ca3cfb245f… (the run inputs' own identity, computed by the forge)

Reduced by the native reducer (ic32); the reference reducer reproduces every epoch's film hash (38.87s).

Receipts in the last epoch's Film

receipt:w=7,s=1,accepted=0b,apkey=0.0.255.0.0.0,epoch=1,outcome=Applied
receipt:w=9,s=1,accepted=5c,apkey=0.0.0.0.255.0,epoch=3,outcome=Applied

FILM v0.7
t=1
spinner:ip_world:policy=forge_motor_widemac_tz_sat_v1,quat4,w=16,n=8,rotor=00ff,0000,0000,0000,socket=ip_view,config=configurable
orb:ip_view:policy=forge_motor_widemac_tz_sat_v1,quat4,w=16,n=8,pose=0100,0000,0000,0000,controller=ip_world,fault=0
pulser:ip_bench:mode=periodic,p=1,phase=0,armed=0,done=0,nf=1
relay:ip_in:cur_out=0,next_out=1
wire:w__ip_bench__ip_in:cur=1,nxt=1
wire:w__ip_in__ip_world:cur=0,nxt=0
admit:policy=admit_candidate_min_firstreceipt_v1,fact_capacity_fault=0,receipt_capacity_fault=0,capacity_fault=0
claim:w=7,s=1,digest=0b,pkey=0.0.255.0.0.0,payload=SetRotor:ip_world:255.0.0.0
receipt:w=7,s=1,accepted=0b,apkey=0.0.255.0.0.0,epoch=1,outcome=Applied
recognition:w=7,s=1,state=unambiguous

FILM v0.7
t=2
spinner:ip_world:policy=forge_motor_widemac_tz_sat_v1,quat4,w=16,n=8,rotor=00ff,0000,0000,0000,socket=ip_view,config=configurable
orb:ip_view:policy=forge_motor_widemac_tz_sat_v1,quat4,w=16,n=8,pose=0100,0000,0000,0000,controller=ip_world,fault=0
pulser:ip_bench:mode=periodic,p=1,phase=0,armed=0,done=0,nf=1
relay:ip_in:cur_out=1,next_out=1
wire:w__ip_bench__ip_in:cur=1,nxt=1
wire:w__ip_in__ip_world:cur=0,nxt=1
admit:policy=admit_candidate_min_firstreceipt_v1,fact_capacity_fault=0,receipt_capacity_fault=0,capacity_fault=0
claim:w=7,s=1,digest=0b,pkey=0.0.255.0.0.0,payload=SetRotor:ip_world:255.0.0.0
receipt:w=7,s=1,accepted=0b,apkey=0.0.255.0.0.0,epoch=1,outcome=Applied
recognition:w=7,s=1,state=unambiguous

FILM v0.7
t=3
spinner:ip_world:policy=forge_motor_widemac_tz_sat_v1,quat4,w=16,n=8,rotor=0000,0000,00ff,0000,socket=ip_view,config=configurable
orb:ip_view:policy=forge_motor_widemac_tz_sat_v1,quat4,w=16,n=8,pose=0000,0000,00ff,0000,controller=ip_world,fault=0
pulser:ip_bench:mode=periodic,p=1,phase=0,armed=0,done=0,nf=1
relay:ip_in:cur_out=1,next_out=1
wire:w__ip_bench__ip_in:cur=1,nxt=1
wire:w__ip_in__ip_world:cur=1,nxt=1
admit:policy=admit_candidate_min_firstreceipt_v1,fact_capacity_fault=0,receipt_capacity_fault=0,capacity_fault=0
claim:w=7,s=1,digest=0b,pkey=0.0.255.0.0.0,payload=SetRotor:ip_world:255.0.0.0
claim:w=9,s=1,digest=5c,pkey=0.0.0.0.255.0,payload=SetRotor:ip_world:0.0.255.0
receipt:w=7,s=1,accepted=0b,apkey=0.0.255.0.0.0,epoch=1,outcome=Applied
receipt:w=9,s=1,accepted=5c,apkey=0.0.0.0.255.0,epoch=3,outcome=Applied
recognition:w=7,s=1,state=unambiguous
recognition:w=9,s=1,state=unambiguous

FILM v0.7
t=4
spinner:ip_world:policy=forge_motor_widemac_tz_sat_v1,quat4,w=16,n=8,rotor=0000,0000,00ff,0000,socket=ip_view,config=configurable
orb:ip_view:policy=forge_motor_widemac_tz_sat_v1,quat4,w=16,n=8,pose=ff02,0000,0000,0000,controller=ip_world,fault=0
pulser:ip_bench:mode=periodic,p=1,phase=0,armed=0,done=0,nf=1
relay:ip_in:cur_out=1,next_out=1
wire:w__ip_bench__ip_in:cur=1,nxt=1
wire:w__ip_in__ip_world:cur=1,nxt=1
admit:policy=admit_candidate_min_firstreceipt_v1,fact_capacity_fault=0,receipt_capacity_fault=0,capacity_fault=0
claim:w=7,s=1,digest=0b,pkey=0.0.255.0.0.0,payload=SetRotor:ip_world:255.0.0.0
claim:w=9,s=1,digest=5c,pkey=0.0.0.0.255.0,payload=SetRotor:ip_world:0.0.255.0
receipt:w=7,s=1,accepted=0b,apkey=0.0.255.0.0.0,epoch=1,outcome=Applied
receipt:w=9,s=1,accepted=5c,apkey=0.0.0.0.255.0,epoch=3,outcome=Applied
recognition:w=7,s=1,state=unambiguous
recognition:w=9,s=1,state=unambiguous

FILM v0.7
t=5
spinner:ip_world:policy=forge_motor_widemac_tz_sat_v1,quat4,w=16,n=8,rotor=0000,0000,00ff,0000,socket=ip_view,config=configurable
orb:ip_view:policy=forge_motor_widemac_tz_sat_v1,quat4,w=16,n=8,pose=0000,0000,ff03,0000,controller=ip_world,fault=0
pulser:ip_bench:mode=periodic,p=1,phase=0,armed=0,done=0,nf=1
relay:ip_in:cur_out=1,next_out=1
wire:w__ip_bench__ip_in:cur=1,nxt=1
wire:w__ip_in__ip_world:cur=1,nxt=1
admit:policy=admit_candidate_min_firstreceipt_v1,fact_capacity_fault=0,receipt_capacity_fault=0,capacity_fault=0
claim:w=7,s=1,digest=0b,pkey=0.0.255.0.0.0,payload=SetRotor:ip_world:255.0.0.0
claim:w=9,s=1,digest=5c,pkey=0.0.0.0.255.0,payload=SetRotor:ip_world:0.0.255.0
receipt:w=7,s=1,accepted=0b,apkey=0.0.255.0.0.0,epoch=1,outcome=Applied
receipt:w=9,s=1,accepted=5c,apkey=0.0.0.0.255.0,epoch=3,outcome=Applied
recognition:w=7,s=1,state=unambiguous
recognition:w=9,s=1,state=unambiguous

FILM v0.7
t=6
spinner:ip_world:policy=forge_motor_widemac_tz_sat_v1,quat4,w=16,n=8,rotor=0000,0000,00ff,0000,socket=ip_view,config=configurable
orb:ip_view:policy=forge_motor_widemac_tz_sat_v1,quat4,w=16,n=8,pose=00fc,0000,0000,0000,controller=ip_world,fault=0
pulser:ip_bench:mode=periodic,p=1,phase=0,armed=0,done=0,nf=1
relay:ip_in:cur_out=1,next_out=1
wire:w__ip_bench__ip_in:cur=1,nxt=1
wire:w__ip_in__ip_world:cur=1,nxt=1
admit:policy=admit_candidate_min_firstreceipt_v1,fact_capacity_fault=0,receipt_capacity_fault=0,capacity_fault=0
claim:w=7,s=1,digest=0b,pkey=0.0.255.0.0.0,payload=SetRotor:ip_world:255.0.0.0
claim:w=9,s=1,digest=5c,pkey=0.0.0.0.255.0,payload=SetRotor:ip_world:0.0.255.0
receipt:w=7,s=1,accepted=0b,apkey=0.0.255.0.0.0,epoch=1,outcome=Applied
receipt:w=9,s=1,accepted=5c,apkey=0.0.0.0.255.0,epoch=3,outcome=Applied
recognition:w=7,s=1,state=unambiguous
recognition:w=9,s=1,state=unambiguous

Composes with the 29 chapters before it

The chain through this chapter — every earlier fragment, this one, and the links — seals to sem-3a8432458a2c00cdb3c6ee824c2babf74fafb04c16c95a8812100d029b5d9bc3: 103 objects, 93 edges (was 100 / 90; every earlier object and edge is still present — checked, or the build refuses).

Links only the chain carries

[rg_sufficiency] --sig--> [ip_in]

The board so far: one band per Part, signal flowing left to right; relays that fan out are routers, doors are switches, pulsers are clock domains. Hover an object — or click the board and walk it with the arrow keys — for its role, its Part and what it is wired to. This board is the chain’s sealed shape; no Film drives it, so it has no state to report, and the whole board in the conclusion is where every object’s state is read epoch by epoch. Wheel zooms · drag pans · double-click fits.

Syntax — quoted from the tree at build time

The three outcomes, where they are specified (super/docs/reviews) super/docs/reviews/D_1_3C_2D_2_INTERVENTION_PROVENANCE.md:22

| 2 | the record is "appended before the ioctl is requested, **settled to** APPLIED/REFUSED/INDETERMINATE after" (§7) | `Ampd.Receipts` has **no update-in-place operation at all**. Three writes exist: append, wholesale replace, truncate. This is not implementable. | J2 |
| 3 | interventions are "keyed on `target.actor`, so `Ampd.Projection.agent/1`'s existing `record["actor"] == actor` filter is reused *correctly*" (§6, lines 260–262) | the filter reads a **top-level** `"actor"` (`projection.ex:231`). A nested `target.actor` yields `nil`, every intervention is dropped, and the C3 ruling is unmet with no crash and no failing test. | J3 |

Forces

Provenance costs a record per action and a key to attribute to. When the natural key (a terminal authority shared across peers) does not exist, the honest move is to key on what does — a Worker and its generation — and to say so, rather than invent the missing authority.

Applicability

Agent runtimes acting on user machines, terminal possession, any actuator shared between principals.

Transformations

A refusing transformation is not one that is discouraged: it is one that, applied, makes the invariant above false. The word is the tree's, and it is the same word the join uses.

Consequences

Interventions become answerable. The honest status: STATED, in a lane this book does not edit, with the specification's unimplemented dependency printed beside it.

Failure mode it answers

Agent Omniscience — Letting an agent's claims exceed its evidence boundary. Paid for at: AGENCY.md §6 (what is established vs a reading)

Witness

No witness. This pattern is STATED — the tree has no check for its invariant.

Counterexample

No counterexample shipped (required only when WITNESSED).

What to take away

1. from the animationThe unattributed action was refused; the same action with Worker, generation and evidence was applied.
2. from the syntaxThe policy is keyed on Worker + generation because the authority it would rather key on did not exist.
3. from the literatureW3C PROV; surgical counts; the audit log that is a precondition rather than a record.
4. from the witnessSTATED: the review in super/ specifies it and names its own unimplemented re-observation.

Invariant basis — and how each piece bears

Satisfying a basis is local. Nothing here implies global adequacy unless a theorem or a composition rule says so.

Prior art — and what is not claimed

Novelty not claimed. Provenance standards exist and are better developed than this. The witness lives in super/, and the honest half of the record is that the re-observation it depends on does not exist — Pty::winsize() has zero callers.

Realizations in the tree

• super/docs/reviews/D_1_3C_2D_2_INTERVENTION_PROVENANCE.md

Relations with other patterns

Three-Valued Outcome STATED