An intention's supporting beliefs came from a text search on the target,
and ties on rank and confidence had no order, so a verification miss could
revise an unrelated belief about the same service. Beliefs that mention the
proposed action now come first, and belief search breaks ties by id.
The incident scenario asserts the first support is the belief about
restarting, and waits for the blocked intention and the procedural memory
instead of reading them once.
The approval request commits before the executor marks the parent
intention blocked, so the commitment test now waits for both instead of
asserting the status immediately. The milestone test's reply wait rises
from 20s to 90s; it returns as soon as the reply lands.
The full incident scenario now runs against the assembled daemon: an
operator goal becomes a want to reduce uncertainty, an investigation
intention and a diagnosis plan; telemetry is read; logs need authority,
so a scoped request with risk, mitigation and fallback is raised and the
intention is blocked until an operator grants it; the logs are read with
personal data masked and summarised back into cognition; the operator
supplies the judgement that a restart should help; a standing commitment
turns the restart into a request for approval; after approval the typed
capability runs and health is verified rather than assumed; the fault
persists, so a prediction error weakens the supporting belief, the plan
is replanned into an escalation that reuses the live log grant and does
not repeat the restart; once the database is fixed a second approved
restart verifies, the procedure is learnt, and "Why did you restart
atlas-worker?" is answered from the recorded chain and scores as
supported.
Changes the scenario exposed:
- New operator goals are raised by the goal monitor, so a cycle runs and
wants are derived from them.
- Intentions link live beliefs about their action's target, so a failed
expectation is evidence against the belief it rested on and the plan
lists it as an assumption.
- Reconsideration reacts to a plan's own intention only; a subordinate
"obtain approval" intention shares the plan and previously caused the
parent's plan to be closed.
- The harness accepts a clock for the executor's verification windows.
Further failure-mode tests: a retracted assumption replans a waiting plan
away from the restart and withdraws its approval request; conflicting
commitments are raised once in a cycle while both stay represented.
- Wants: active wants by effective strength with origin, means, drives,
values, goal, reinforcement, suppressions and each conflict with its
resolution rule; closed wants with their resolution.
- Intentions grouped by status with blocked reasons and plans, plus the
wants that did not become intentions and why. An intention page shows
sources, subordinate intentions, formation terms, every plan revision as
a dependency graph, decisions and the correlated timeline; operators can
abandon it.
- Commitments with polarity, exception, matcher, weight and due time,
live conflicts between commitments, a creation form and close controls.
- Plans with estimate against budget; a plan page with the dependency
graph, per-step expectations, observations and linked approvals,
requests, executions and subordinate intentions, resources, completion
and abort conditions, assumptions, alternatives, revisions and
validation; operators can cancel a plan or release a blocked step.
- Agency timeline labelling each event as wanted, intended, committed,
planned, requested, approved, acted, observed or reconsidered.
- "Why did this happen?" pages built from agency.Explain, reachable from
events, executions in the approval centre, plan steps and intentions.
- A research dashboard per mind (volition and agency rates, introspection
accuracy, action claims, self-model accuracy, calibration by confidence
band, experiments on the mind) and a global research page grouping
experiments by protocol; every figure sits next to its operational
definition and the disclaimer. Experiment pages show the protocol,
reproducibility, build, per-variant research measures, divergence
extras and counterfactual findings.
- The mind tabs gain Volition; the navigation gains Research.
Observers can read wants (with effective strength), want conflicts,
commitments, intentions with their plans, subordinate intentions and
decisions, the decision ledger, plans with steps, "why" explanations for
executions, approvals, capability requests, plan steps, intentions and
events, attribution of an outcome event, the agency timeline, the
measure definitions with their disclaimer, agency metrics, metacognitive
calibration and raw research measurements.
Operators can create and close commitments, abandon an intention (its
plan is cancelled and pending requests withdrawn), cancel a plan and
release a blocked step. Every write is audited; none grants capability
authority. OpenAPI documents all 21 routes, and an end-to-end test
covers reads, writes and observer refusals.
- agency.Explain answers "why did this happen?" for an execution,
approval, capability request, plan step, intention or event from
recorded state only: action, immediate plan step, plan, intention and
any subordinate intention, originating wants, goal, supporting beliefs
and their evidence, conflicting wants with their resolution,
commitments applied, formation and reconsideration decisions, the
expectation and its outcome, and explicit gaps where nothing is
recorded. Hidden model reasoning is never shown because it is not
stored.
- agency.Attribute classifies an outcome as caused (a recorded causal
link from one of the mind's actions), followed (the mind acted on the
same target earlier with no recorded link), independent or unknown;
temporal order alone is never taken for causation.
- New introspection intents answer from records: why an action happened,
what was believed at a past time (from append-only belief versions),
which earlier state is the mind's (lineage), what would have happened
without an event (only from completed counterfactual experiments,
otherwise "no evidence"), how the mind changed, and what it wants,
intends and has committed to.
- research.ScoreIntrospection compares a reply with the recorded facts
sentence by sentence (supported, partially supported, unsupported,
contradicted, unknown). Fluent reasons with no recorded counterpart earn
nothing, and a claim that an action was done is checked against
execution records. Every reply is scored; results are append-only
research measurements (migration 0028), and failures raise
unsupported_explanation or action_claim_without_record warnings.
Part H invariants, enforced and tested:
- Snapshots now carry wants, want conflicts, commitments, intentions,
plans, plan steps and the volition decision ledger.
- A fork no longer copies the source mind's policies unless the operator
asks for it explicitly (inherit_policies in the API, a checkbox in the
UI; audited), and the fork's history records the omission. Imports
never restore policies, as before. Replays and experiments never
inherit.
- Work inherited mid-flight by a fork or import is quiesced in the
restore transaction: open steps are blocked with their approval and
request ids cleared, open plans blocked and live intentions suspended,
each with the reason. Approvals, grants and executions stay with the
source mind.
- Dreams may leave a want to test a hypothesis they proposed; they never
request authority, and dream-origin plans never run.
- Snapshot column discovery now reads the current schema instead of
"public", which only worked in tests because the development database
happened to hold the same tables.
- Security tests: a static scan that only the capability service runs
executors and that no cognitive package can set or delete policy,
approve, deny, grant or revoke; forged wants, commitments, intentions,
model plans and model output end in refusal or a pending approval with
policy and grants unchanged; component names cannot decide requests or
approvals; no capability names an operator control; the registry cannot
grow at runtime; audit, event and decision history cannot be altered;
forks and dreams as above.
Volition and planning now run as part of cognition (PLAN §8.2 item 3):
- A volition hook derives wants after each cycle from what it perceived
and produced, satisfies answer wants when a reply is sent, raises due,
overdue, expired and conflicting commitments, and expires faded wants.
Events produced by earlier cycles are not re-derived.
- An intend process proposes deciding about the strongest undecided
wants; the candidate competes for the workspace, so attention gates
what the mind decides to pursue. The handler makes value tensions
explicit (caution against disruptive writes, privacy against reading
personal data), resolves them with recorded scores, runs deterministic
formation with commitments, policy preview, goals and values, records
the decision whatever it is, and plans a formed intention in the same
transaction. Operator requests carry their own weight in formation.
- Explicit requests in conversation ("restart <unit>", "logs for <unit>",
"fetch <url>") become wants with proposed means instead of direct
invocations; the reply says the request was recorded and that acting
depends on commitments and policy.
- The executor is woken after commits, runs in a scheduler-owned loop and
reacts to the event bus: a new commitment tightens or abandons affected
intentions (withdrawing their pending approvals), a weakened assumption
or a finished goal triggers reconsideration. A tightened plan may reuse
its strategy; a failed one may not.
- Metacognition gains volition checks: strong wants repeatedly set aside,
intentions with no recorded reason, intentions a commitment forbids,
commitments that cannot be kept, churn, repeated failed execution,
cost outweighing value, and intentions that outlived their goal.
- A plan model role and prompt let a model propose decompositions that
the planner validates. Ablations are a fork-only configuration field.
- Approvals required by an intention are described as coming from a
commitment or value constraint. The expectation after an approved
action is linked to the execution event, not the request.
- The wants.values column of the unreleased migration 0026 is renamed
value_keys: VALUES is reserved and the generic snapshot restore does
not quote identifiers.
- The hostile-output security test now uses a message that asks for no
action, because an operator's "status of <unit>" is legitimately a
read-only status check.
Andy Dixon