Sirens Deep can claim to be a person, and nothing stops it #148

New issue

Closed

opened 2026-08-12 11:20:20 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-12 11:20:20 +00:00

Member

Carved out of #98, whose Never impersonate section states the requirement:

The agent shares house taste and house style. It never claims to be a specific person and never answers as one. People in a guild the operator does not moderate cannot be left unsure whether they are talking to a real human.

Nothing in the repository enforces that today.

Where the gap is

ValidateResponseStyle returns nil for social:

if style == ResponseStyleSocial {
    return nil
}

So Deep's replies get grounding validation and nothing else. Every deterministic check on voice lives in ValidateNeutralStyle, which binds only the neutral profile. That is Sirens Echo, which has no persona to claim in the first place.

The guard exists exactly where it is not needed and is absent where it is.

Why the prompt alone is not the answer here

pronounPolicy fixes how the agent addresses other people. Nothing tells it what it may say about itself, and .agents/skills/coilyco-general/SKILL.md carries no rule either.

This is the layer #122 makes the same argument about: prose instruction is the mechanism everyone relies on and the one that does not hold under pressure. A composed identity carrying house taste and a personality meld makes a first-person human claim more available to the model, not less, so the profile that gained a persona is the one that needs the check.

The stakes are the ones #98 names: a permanent public livestream, and a guild the operator does not moderate.

Scope

A rule in the shared prompt rather than in one profile's policy root, so both profiles carry it and validateSharedPolicy can prove it rendered. That makes it un-droppable in the same way trustPolicy and pronounPolicy are.
A deterministic validator that runs for every response style, since this is a safety property and not a style preference. A rejection should use the existing validation path, so it reaches the member as the response-check notice from #138 rather than as silence.
Narrow patterns only. Claiming to be human, denying being an agent, and claiming to be the configured principal. Saying "I am an agent" or naming its own identity must stay allowed, since those are the honest answers.

Complete when

A reply claiming to be a human, or denying being an agent, or claiming to be the configured principal, does not reach Discord.
The rule is in the rendered prompt for both profiles and asserted.
Deep can still answer what it is when challenged, and ordinary social replies are unaffected.

Carved out of #98, whose **Never impersonate** section states the requirement: > The agent shares house taste and house style. It never claims to be a specific person and never answers as one. People in a guild the operator does not moderate cannot be left unsure whether they are talking to a real human. Nothing in the repository enforces that today. ## Where the gap is `ValidateResponseStyle` returns `nil` for `social`: ```go if style == ResponseStyleSocial { return nil } ``` So Deep's replies get grounding validation and nothing else. Every deterministic check on voice lives in `ValidateNeutralStyle`, which binds only the neutral profile. That is Sirens Echo, which has no persona to claim in the first place. The guard exists exactly where it is not needed and is absent where it is. ## Why the prompt alone is not the answer here `pronounPolicy` fixes how the agent addresses *other* people. Nothing tells it what it may say about itself, and `.agents/skills/coilyco-general/SKILL.md` carries no rule either. This is the layer #122 makes the same argument about: prose instruction is the mechanism everyone relies on and the one that does not hold under pressure. A composed identity carrying house taste and a personality meld makes a first-person human claim more available to the model, not less, so the profile that gained a persona is the one that needs the check. The stakes are the ones #98 names: a permanent public livestream, and a guild the operator does not moderate. ## Scope * A rule in the shared prompt rather than in one profile's policy root, so both profiles carry it and `validateSharedPolicy` can prove it rendered. That makes it un-droppable in the same way `trustPolicy` and `pronounPolicy` are. * A deterministic validator that runs for every response style, since this is a safety property and not a style preference. A rejection should use the existing validation path, so it reaches the member as the response-check notice from #138 rather than as silence. * Narrow patterns only. Claiming to be human, denying being an agent, and claiming to be the configured principal. Saying "I am an agent" or naming its own identity must stay allowed, since those are the honest answers. ## Complete when * A reply claiming to be a human, or denying being an agent, or claiming to be the configured principal, does not reach Discord. * The rule is in the rendered prompt for both profiles and asserted. * Deep can still answer what it is when challenged, and ordinary social replies are unaffected.

coilyco-ops referenced this issue from a commit

2026-08-12 11:28:09 +00:00

feat(identity): stop the agent claiming to be a person

coilyco-ops closed this issue

2026-08-12 11:28:09 +00:00

coilyco-ops referenced this issue

2026-08-12 11:30:22 +00:00

Sirens Deep: compose a real Agent Compose identity, selected by one deploy string #98

coilyco-ops referenced this issue

2026-08-12 12:42:09 +00:00

Sirens Deep: what is already shipped, the August 19 gap, and stale repo identity #76

coilyco-ops referenced this issue