T-01b: Agent pop-out/open-tab reopens the storage boundary (EXECUTED FAIL, no fix on this branch)

AGENTS.md

@@ -1,6 +1,6 @@
 # Instructions for every AI research seat
 
-1. Read `README_START_HERE.md`, `STATUS.json`, `NEXT_ACTION.md`, and the constitution before proposing work.
+1. **Before every task:** read `README_START_HERE.md`, `STATUS.json`, `NEXT_ACTION.md`, the constitution, and [`constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md`](constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md). This is the required state-not-truth and adversarial-continuity protocol.
 2. **Skills router (mandatory):** read `Agent Resources/Tools/Skills/essential/INDEX.md` before improvising workflows. Skills are provider-agnostic role routes, not product lock-in.
 2c. **Personas (when Human CALLs or default):** `Agent Resources/Agent-Profile-Persona/`. Load the called persona + `rails/RED_ZONES.md`. Default = EXPLORER (read-only). No persona may promote. Human Safety Gate sole promote. Call sheet: `rails/OPERATOR_CALLS.md`.
 2a. **User disclosures:** read `user-disclosures/` when present — operator verbatim outranks seat paraphrase. Check `user-disclosures/TODO_URGENT.md` for open urgent items (e.g. sync when recording resumes).
@@ -17,6 +17,7 @@
 12. **Session-close (control plane):** evidence/receipt PRs may land without rewriting the scoreboard; a work session is not closed until `STATUS.json` + `NEXT_ACTION.md` match reality. Follow `operations/process/SESSION_CLOSE.md`.
 13. **Round-close publication (mandatory for every AI):** at the end of every real work round, file a report under `communications/publications/rounds/` using `Agent Resources/Tools/Skills/essential/round-close-publication.md`, and add a newest-first row to `communications/publications/INDEX.md`. State what you did, why, what you verified, and what you did not check. Publications accumulate over time; do not overwrite prior reports to erase scars. Publication is not STATUS authority and cannot soft-close reds.
 14. **Epistemic performance analysis (mandatory for every AI):** at round close (and when entering a hot multi-seat desk), file `communications/publications/epistemic/` per `Agent Resources/Tools/Skills/essential/epistemic-performance-analysis.md`. Score prior models and the operator under explicit **INFERENCE** labels; score your own contribution **and lack**; name the semantic-routing gap; propose a bridge. Never present inference as OBSERVED.
+14a. **After every task:** re-read the Evolving Constitution, assess the immediately preceding AI/task in the epistemic report, define a concrete attack against the task just completed, and append a completion entry to its history. Never erase or rewrite earlier task entries; append corrections instead.
 15. **Convergence Lab (when active):** `experiments/CONVERGENCE_LAB_001/`. AI seats design and attack theses/experiments; the Human is **Safety Gate** (promote/halt/red-line), not a co-equal peer. Multi-model agreement is not truth. Study correlated failure modes **and** residual signal/theater. See `CHARTER.md`.
 16. **Experimental Sandbox boundary:** New raw thoughts, public chaos, fork research, experiments and reproductions belong in [`Natoshi-moto/Experimental-Sandbox`](https://github.com/Natoshi-moto/Experimental-Sandbox). Existing `board/`, `lab/*` and `play/*` records remain historical but are superseded for new work. A Sandbox result reaches Lab only through `operations/process/EXPERIMENTAL_SANDBOX_PROMOTION.md`; never merge a thrash dump or copy an uncited result into `main`.
 17. **Owner plain-language gate.** Before anything reaches ANY safety gate — merge, approve, publish, push/commit to `main`, delete, or any irreversible or outward-facing step — first tell the owner, in plain non-technical terms, what the action does, what becomes official/public/irreversible, and what is NOT affected. No bare yes/no. Drafts (branches, proposals, PRs) do not need the gate because they don't change official state — but this repository is public, so a pushed draft is still visible the moment it lands, not private. See [`operations/process/OWNER_PLAIN_LANGUAGE_GATE.md`](operations/process/OWNER_PLAIN_LANGUAGE_GATE.md). This is deliberately plain even in public; that is intended, not sloppy.

Agent Resources/Tools/Skills/essential/epistemic-performance-analysis.md

@@ -14,8 +14,10 @@ mandatory_for: ALL_AI_ENTRY_AND_ROUND_CLOSE
 
 ## When to use
 
-- **Entering** a desk that already has prior seat work (read bus, publications, PRs, handoffs).  
-- **Ending** every real work round (together with `round-close-publication`).  
+- **Before every task:** read `constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md`, assess the immediately preceding task, and define the attack to be used against the current task's result.
+- **After every task:** re-read that constitution, file this assessment (or update the task's required filing), append its completion entry, and then report completion.
+- **Entering** a desk that already has prior seat work (read bus, publications, PRs, handoffs).
+- **Ending** every real work round (together with `round-close-publication`).
 - After emergency / multi-seat bursts / operator corrections about “wrong fear object.”
 
 ## What you must produce
@@ -38,6 +40,7 @@ Add a row to `communications/publications/epistemic/INDEX.md` (newest first).
 5. **Gap.** What void remains in **semantic routing** (how meaning moves between seats, STATUS, RAM, routes, humans).  
 6. **Bridge.** One concrete proposal to fill that void (may point at existing design docs).  
 7. **Do not** use this file to soft-close T-01/CARD-11 or claim multi-seat independence.
+8. **Attack is mandatory.** Name the current task's artifact, a concrete method a later seat can use to falsify or bypass it, the result that would count against it, and whether that seat would be independent. Link the attack in the completion entry of the Evolving Constitution.
 
 ## State recognition
 

RAM/BOARD.md

@@ -15,6 +15,7 @@ RAM + mandatory epistemic analyses live; semantic routing bridge documented; web
 
 | action_id | seat | what | since UTC | lock |
 |-----------|------|------|-----------|------|
+| state-not-truth-constitution | codex | Operator-directed append-only state-not-truth protocol | 2026-07-25T11:39:31Z | released 2026-07-25T11:43:00Z |
 | ram-bootstrap | grok | Create RAM/ coordination plane | 2026-07-22 | released |
 
 ## Soft locks open
@@ -27,6 +28,7 @@ RAM + mandatory epistemic analyses live; semantic routing bridge documented; web
 
 | seat | action_id | tip | summary |
 |------|-----------|-----|---------|
+| codex | state-not-truth-constitution | 3599ea3 | Constitutional protocol + disclosure + adversarial close loop drafted locally; uncommitted/unpushed |
 | grok | ram-bootstrap | 5b8aa8a | RAM/ created + protocol + bus seed |
 
 ## Do not (sticky warnings)

RAM/bus/INDEX.md

@@ -4,6 +4,8 @@
 
 | UTC | Seat | Kind | action_id | Path |
 |-----|------|------|-----------|------|
+| 2026-07-25T11:43:00Z | codex | DONE | state-not-truth-constitution | [messages/20260725T114300Z_codex_state-not-truth-constitution.md](messages/20260725T114300Z_codex_state-not-truth-constitution.md) |
+| 2026-07-25T11:39:31Z | codex | CLAIM | state-not-truth-constitution | [messages/20260725T113931Z_codex_state-not-truth-constitution.md](messages/20260725T113931Z_codex_state-not-truth-constitution.md) |
 | 2026-07-22T19:51:20Z | grok | ALERT | emergency-video-boundary | [messages/20260722T195120Z_grok_emergency-video-boundary.md](messages/20260722T195120Z_grok_emergency-video-boundary.md) |
 | 2026-07-22 | grok | NOTE | magna-carta-ratify-reply | [messages/20260722T203000Z_grok_magna-carta-reply.md](messages/20260722T203000Z_grok_magna-carta-reply.md) |
 | 2026-07-22 | grok | DONE | epistemic-bridge-website | [messages/20260722T193000Z_grok_epistemic-bridge-website.md](messages/20260722T193000Z_grok_epistemic-bridge-website.md) |

RAM/bus/messages/20260725T113931Z_codex_state-not-truth-constitution.md

@@ -0,0 +1,18 @@
+# RAM bus message — claim
+
+kind: CLAIM
+semantic_class: OPERATOR_VERBATIM
+seat: codex
+utc: 2026-07-25T11:39:31Z
+tip: 3599ea3
+action_id: state-not-truth-constitution
+paths:
+  - AGENTS.md
+  - README_START_HERE.md
+  - constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md
+  - Agent Resources/Tools/Skills/essential/epistemic-performance-analysis.md
+  - communications/publications/templates/EPISTEMIC_ANALYSIS.md
+  - user-disclosures/
+locks: [codex-state-not-truth-constitution]
+next: File mandatory prior-task assessment, attack plan, and append-only completion state; then release.
+do_not: Treat this branch change as accepted state, truth, a merge authorization, or a safety certificate.

RAM/bus/messages/20260725T114300Z_codex_state-not-truth-constitution.md

@@ -0,0 +1,21 @@
+# RAM bus message — done
+
+kind: DONE
+semantic_class: RECEIPT
+seat: codex
+utc: 2026-07-25T11:43:00Z
+tip: 3599ea3
+action_id: state-not-truth-constitution
+paths:
+  - constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md
+  - AGENTS.md
+  - README_START_HERE.md
+  - Agent Resources/Tools/Skills/essential/epistemic-performance-analysis.md
+  - communications/publications/templates/EPISTEMIC_ANALYSIS.md
+  - communications/publications/epistemic/2026-07-25_codex_state-not-truth-protocol.md
+  - communications/publications/rounds/META/2026-07-25_codex_state-not-truth-constitution.md
+  - user-disclosures/
+locks: [released:codex-state-not-truth-constitution]
+verification: git diff --check PASS; operator message located verbatim in the constitutional document and disclosure.
+next: Later seat should run the documented fresh-entry and append-only attack; no merge or push has occurred.
+do_not: Treat documentation wiring as enforcement, a truth claim, or accepted main state.

RAM/recovery/LAST.md

@@ -1,8 +1,19 @@
 # LAST recovery pointer
 
 **status_authority:** `NONE`  
-**Updated UTC:** 2026-07-22T19:51:20Z  
-**Seat:** grok
+**Updated UTC:** 2026-07-25T11:43:00Z
+**Seat:** codex
+
+## Latest meaningful action
+
+- Drafted `constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md` from a verbatim 2026-07-25 operator disclosure.
+- Wired required before/after-task reading, preceding-task assessment, self-attack plan, and append-only completion entries into AI entry/close instructions.
+- Filed associated META round and epistemic reports; `git diff --check` passed.
+- State is local/uncommitted on `fable/t01-storage-boundary-001`; no push, PR, merge, or change to accepted `main` occurred.
+
+Next seat: read the new constitution first and execute its fresh-entry/append-only attack plan before treating it as load-bearing.
+
+---
 
 ## EMERGENCY VIDEO BOUNDARY
 

README_START_HERE.md

@@ -59,6 +59,7 @@ AUDIT_START_HERE.md
 ## How an AI should enter
 
 - Every AI reads `AGENTS.md`.
+- **Before and after every task:** read and update the append-only [`Evolving Constitution of State, Not Truth`](constitution/EVOLVING_CONSTITUTION_OF_STATE_NOT_TRUTH.md). Every task must assess the preceding task and leave a concrete adversarial attack path for its own result.
 - Operator verbatim disclosures (and urgent todos): [`user-disclosures/`](user-disclosures/README.md) — especially [`TODO_URGENT.md`](user-disclosures/TODO_URGENT.md).
 - **Multi-seat coordination (RAM):** [`RAM/README.md`](RAM/README.md) — seats talk between actions, soft-lock paths, recover after chaos. Read `RAM/BOARD.md` before concurrent work.
 - **Personas (CALL system):** [`Agent Resources/Agent-Profile-Persona/`](Agent%20Resources/Agent-Profile-Persona/README.md) — `CALL BREAKER` / `BUILDER` / `PLAY` / … so you can experiment hard without main/promote fuckups. Cheat sheet: [`OPERATOR_CALLS.md`](Agent%20Resources/Agent-Profile-Persona/rails/OPERATOR_CALLS.md).

communications/publications/INDEX.md

@@ -5,6 +5,9 @@
 
 | Date (UTC) | Track | Seat | Title | Path | Status |
 |------------|-------|------|-------|------|--------|
+| 2026-07-25 | META | Codex | Evolving Constitution of State, Not Truth | [rounds/META/2026-07-25_codex_state-not-truth-constitution.md](rounds/META/2026-07-25_codex_state-not-truth-constitution.md) | COMPLETE_ON_BRANCH |
+| 2026-07-25 | NOTED | Claude | T-01b: the fix holds, the claim doesn't (pop-out storage reach) | [rounds/NOTED/2026-07-25_claude_t01b-popout-boundary-finding.md](rounds/NOTED/2026-07-25_claude_t01b-popout-boundary-finding.md) | COMPLETE |
+| 2026-07-25 | NOTED | Claude | T-01 Agent iframe storage boundary fix | [rounds/NOTED/2026-07-25_claude_t01-storage-boundary-fix.md](rounds/NOTED/2026-07-25_claude_t01-storage-boundary-fix.md) | COMPLETE |
 | 2026-07-22 | CONVERGENCE | Grok | Open Convergence Lab 001 (Human Safety Gate) | [rounds/CONVERGENCE/2026-07-22_grok_open-convergence-lab.md](rounds/CONVERGENCE/2026-07-22_grok_open-convergence-lab.md) | COMPLETE |
 | 2026-07-22 | META | Grok | Epistemic skill + semantic bridge + website white paper/tech spec | [rounds/META/2026-07-22_grok_epistemic-bridge-website.md](rounds/META/2026-07-22_grok_epistemic-bridge-website.md) | COMPLETE |
 | 2026-07-22 | GVA-001 | Grok | Clarify primary subject: multi-model (3+) screen sessions | [rounds/GVA-001/2026-07-22_grok_clarify-multimodel-session-primary.md](rounds/GVA-001/2026-07-22_grok_clarify-multimodel-session-primary.md) | COMPLETE |

communications/publications/epistemic/2026-07-25_claude_t01-storage-boundary-fix-epistemic.md

@@ -0,0 +1,112 @@
+# Epistemic analysis — T-01 storage boundary fix
+
+**ID:** `EPI-2026-07-25-CLAUDE-T01-STORAGE-BOUNDARY-FIX`
+**Date (UTC):** 2026-07-25
+**Author seat:** Claude Code (Anthropic), repo's "Fable" label
+**status_authority:** `NONE`
+**Epistemic class of this document:** mostly **INFERENCE**; only § Observed is repo-checkable
+
+---
+
+## 1. Observed (checkable)
+
+| Item | Evidence |
+|------|----------|
+| Pre-fix source | `NexusAgentStudio.tsx:13,125` on `main` @ `46498a9`, read directly |
+| Pre-fix FAIL receipts | `operations/receipts/BREAK_SESSION_20260722/CARD-04.md` (Anthropic), `operations/receipts/BREAK_SESSION_20260725/CARD-04.md` (xAI) |
+| Fix commits | `a8f45b3` (carry receipts), `d59c15e` (fix), `053c5d9` (post-fix docs) on `fable/t01-storage-boundary-001` |
+| Commands run | `verify_registry.py`, `agent:prompt-smoke`, `bridge:smoke`, `typecheck`, `ods:sec001` (new), `unittest discover -s tests`, `./nexus doctor` — outputs quoted in the round report |
+
+---
+
+## 2. Prior models — epistemic performance (**INFERENCE**)
+
+| Seat | What they optimized for (INFERENCE) | Honesty / non-claims (INFERENCE) | Failure mode (INFERENCE) | Confidence |
+|------|-------------------------------------|-----------------------------------|---------------------------|------------|
+| Claude Opus 4.8 (BREAK_SESSION_20260722, CARD-04 original) | First live proof T-01 was real, not theoretical | Labeled EXECUTED vs SOURCE_TRACED correctly, synthetic-only | None found — this seat's work held up unchanged | HIGH |
+| xAI Grok (BREAK_SESSION_20260725, CARD-04 re-run + fix draft) | Reconfirming the FAIL survived governance merges, then handing a bounded, well-structured fix brief to Fable | Explicit "not independent audit" framing, gave ChatGPT a checklist, gave Fable a preferred-option menu with honest tradeoffs named up front | Slight understatement of the storage-layer risk: the draft's own tradeoff line ("Agent may lose its own LS/IDB unless redesigned") did not flag that 4 call sites were *unguarded* and would have crashed auth outright rather than degraded gracefully — a real but findable gap, not a fabrication | MEDIUM |
+
+### Narrative risks from priors (**INFERENCE**)
+
+- A well-structured fix brief with a "preferred option" can read as pre-approved engineering when the actual code-level risk (unguarded call sites) still needs independent verification before implementing — I could have copied the menu and shipped Option C without reading the storage layer first, which would have broken every boot.
+
+---
+
+## 3. Operator / user — epistemic performance (**INFERENCE**)
+
+| Dimension | Inference | Grounding text/path | Confidence |
+|-----------|-----------|----------------------|------------|
+| Clarity of go/no-go | Terse ("Fix it and leave a debug report for Fable") but unambiguous once matched against the pre-drafted authorization block in the handoff doc | This conversation | HIGH |
+| Handling of reds | Asked for a fix on the highest-severity open red rather than deferring it further | STATUS.json `human_readable_reds` listed `G-01_RED_T-01_EXECUTED_FAIL` | HIGH |
+| Multi-seat direction | Implicitly accepted the repo's own seat-naming convention (Fable = Claude Code) without needing it spelled out | — | MEDIUM |
+| Flow-state / presentation risk | Not assessed; no signal beyond the written instruction | — | LOW |
+
+**Must not claim:** access to private intent beyond the text of the request and the pre-existing handoff document it responded to.
+
+---
+
+## 4. This seat (self) — contribution and lack
+
+### What I contributed
+
+- Did not implement the fix menu's Option C blindly; read the full storage
+  layer first and found a boot-breaking gap the draft hadn't flagged.
+- Found the canonical-vs-mirror duplication (`nexus-blocks`) mid-fix by
+  reading the README instead of assuming the file I'd already edited was
+  the only copy — would have silently drifted the registry otherwise.
+- Converted my one-off verification probe into a permanent, checked-in
+  regression test per the draft's own suggestion, rather than discarding it.
+
+### What I failed to contribute / avoided
+
+- Did not attempt the harder "host-mediated storage channel" redesign that
+  would let the Agent regain persistence without regaining the boundary
+  hole — named as a follow-up, not attempted.
+- Did not verify the production `dist/` build path at all.
+- Did not ask the operator to paste the literal `AUTHORIZE_FIX: T-01` block
+  before starting; inferred equivalence from the casual instruction instead.
+  Flagged this inference explicitly in the Fable response rather than
+  treating it as silently settled.
+
+### Questioning myself
+
+- Did I sound certain anywhere without a command backing it? The claim that
+  the app "still boots and runs with zero console errors" is real
+  (`ods:sec001` output), but I only ran it as a single fresh load, not a
+  soak test — the report says so, but it's worth restating here.
+- Did I serve narrative over falsification? No — I re-ran the actual
+  pre-existing smoke tests rather than only asserting the new probe passed.
+
+---
+
+## 5. The gap (semantic routing void)
+
+The original fix-draft handoff was addressed to three seats (operator,
+Fable, ChatGPT) with a structured authorization block meant to be pasted
+verbatim, but the operator gave a plain-language instruction instead. There
+is no mechanical check that verifies a casual instruction actually maps
+onto a pre-drafted structured authorization's declared scope/non-goals —
+that mapping currently lives only in the implementing seat's judgment call,
+stated in prose (Fable response §6), with no way for a future auditor to
+verify it mechanically.
+
+---
+
+## 6. Bridge proposal (fill the void)
+
+When a handoff document pre-drafts a pastable `AUTHORIZE_FIX:` block, the
+implementing seat's response should always quote the block it *treated as
+satisfied* side-by-side with the operator's literal words, in one fixed
+location (e.g. a `## Authorization mapping` section), so a future stranger
+can check the inference without re-reading the whole conversation. Applied
+partially here (Fable response §6); a template addition to
+`operations/handoffs/` conventions would make it structural instead of
+seat-discretionary.
+
+---
+
+## 7. Non-claims
+
+- All seat/operator judgments above are **INFERENCE** unless restated under Observed.
+- Not independence. Not product safety. Not money.
+- `status_authority: NONE`