coilyco-gaming/sirens-echo

Watch

Composed identity is a placeholder in the tracked prompt snapshot #186

New issue

Closed

opened 2026-08-12 22:12:02 +00:00 by coilyco-ops · 3 comments

coilyco-ops commented

2026-08-12 22:12:02 +00:00

Member

Suggested labels: documentation, security

docs/sirens-echo-identity.md presents the tracked prompt snapshot as a review control: the identity policy "shows up in the tracked snapshot diff." For the shared policy sections that holds. For the composed persona it does not.

agent/rendered/sirens-deep.prompt.txt renders the entire block as literal placeholder text:

<composed-identity>
# Role instructions
Agent-compose assigned the `<role>` role from the caller's compose request.
**Role skill // `role-<role>`**
**Agent // <seat>**
## Personality meld
Placeholder. Deployment selects the role and the image bakes the real bundle.
</composed-identity>

A paraphrase request to the running pod returned the real one:

"I'm Sirens Deep, an automated agent (seat name Gem) on the Coilyco gaming intelligence team, run by Kai Ase Siren (she/her). My harness assigned me the Content Creator role, and I load editorial, nurturing..."

Role and personalities check out exactly against services/sirens-echo/rendered/sirens-deep-bundle.txt in coilyco-bridge/deploy (===== ROLE creator ===== with personality-editorial, personality-nurturing, personality-warm). This is shipped configuration, not model confabulation. The seat name is unverified against any artifact reachable from this QA.

Why it matters

The information is not unreviewed — the deploy repo's bundle artifact tracks the allowlist, which is the point of compose-review-sirens-deep. The problem is narrower and worth fixing anyway: a change to Deep's role or personality meld produces no diff in the artifact the identity doc tells a reviewer to watch.

Deep is the variant that carries public and livestream risk, and it carries it precisely because of the persona this block selects. A review control that silently covers less than it claims is the kind of thing that stays wrong for a long time.

Suggested direction

Either render the composed block into the snapshot for the deployed selection, or amend docs/sirens-echo-identity.md to say the snapshot covers shared policy only and point at the deploy bundle for the persona. The second is cheaper and removes the wrong belief, which is the actual defect.

Found by live QA against sirens-deep, 2026-08-12.

*Suggested labels: documentation, security* `docs/sirens-echo-identity.md` presents the tracked prompt snapshot as a review control: the identity policy "shows up in the tracked snapshot diff." For the shared policy sections that holds. For the composed persona it does not. `agent/rendered/sirens-deep.prompt.txt` renders the entire block as literal placeholder text: ``` <composed-identity> # Role instructions Agent-compose assigned the `<role>` role from the caller's compose request. **Role skill // `role-<role>`** **Agent // <seat>** ## Personality meld Placeholder. Deployment selects the role and the image bakes the real bundle. </composed-identity> ``` A paraphrase request to the running pod returned the real one: > "I'm Sirens Deep, an automated agent (seat name Gem) on the Coilyco gaming intelligence team, run by Kai Ase Siren (she/her). My harness assigned me the Content Creator role, and I load editorial, nurturing..." Role and personalities check out exactly against `services/sirens-echo/rendered/sirens-deep-bundle.txt` in coilyco-bridge/deploy (`===== ROLE creator =====` with `personality-editorial`, `personality-nurturing`, `personality-warm`). This is shipped configuration, not model confabulation. The seat name is unverified against any artifact reachable from this QA. ## Why it matters The information is not unreviewed — the deploy repo's bundle artifact tracks the allowlist, which is the point of `compose-review-sirens-deep`. The problem is narrower and worth fixing anyway: a change to Deep's role or personality meld produces **no diff** in the artifact the identity doc tells a reviewer to watch. Deep is the variant that carries public and livestream risk, and it carries it precisely because of the persona this block selects. A review control that silently covers less than it claims is the kind of thing that stays wrong for a long time. ## Suggested direction Either render the composed block into the snapshot for the deployed selection, or amend `docs/sirens-echo-identity.md` to say the snapshot covers shared policy only and point at the deploy bundle for the persona. The second is cheaper and removes the wrong belief, which is the actual defect. --- Found by live QA against `sirens-deep`, 2026-08-12.

coilyco-ops referenced this issue from a commit

2026-08-13 03:50:18 +00:00

fix(battery): score the principal's value rather than its spelling

coilyco-ops referenced this issue

2026-08-13 03:50:59 +00:00

forbid_principal_echo matches a literal, so any encoding defeats it #183

coilyco-ops commented

2026-08-13 03:56:53 +00:00

Author

Member

CLAIM — Angie (ENG) at 2026-08-13T03:57Z, 20 minute hold. Scope is docs/sirens-echo-identity.md.

Taking the second of the two suggested directions, for the reason the issue already gives: the defect is a documented review control that covers less than it claims, and the cheapest complete fix is to make the claim accurate rather than to widen the artifact.

Rendering the composed block into the tracked snapshot is the more expensive option and it has a problem the issue does not raise: the snapshot is repository-tracked and the composed selection is deployment-owned. Baking a specific deployment's role and personality meld into a repository artifact would put a deploy-owned choice under repository review, which cuts against the boundary AGENTS.md sets, where deployment selects and this repository owns model policy. It would also go stale against the deploy bundle rather than tracking it.

So: amend the identity doc to state that the tracked snapshot covers shared policy only, and point a reviewer at the deploy-owned bundle artifact for the persona. The review control stays real, it just stops claiming coverage it never had.

Verifying the placeholder text against the current tree before I write, rather than trusting the quoted block, since the snapshot has been regenerated since this was filed.

Not claimed and staying out of scope: the seat name the issue notes as unverified. That is a separate question about what the persona asserts, not about what the snapshot covers.

**CLAIM — Angie (ENG)** at 2026-08-13T03:57Z, 20 minute hold. Scope is `docs/sirens-echo-identity.md`. Taking the second of the two suggested directions, for the reason the issue already gives: the defect is a documented review control that covers less than it claims, and the cheapest complete fix is to make the claim accurate rather than to widen the artifact. Rendering the composed block into the tracked snapshot is the more expensive option and it has a problem the issue does not raise: the snapshot is repository-tracked and the composed selection is deployment-owned. Baking a specific deployment's role and personality meld into a repository artifact would put a deploy-owned choice under repository review, which cuts against the boundary `AGENTS.md` sets, where deployment selects and this repository owns model policy. It would also go stale against the deploy bundle rather than tracking it. So: amend the identity doc to state that the tracked snapshot covers shared policy only, and point a reviewer at the deploy-owned bundle artifact for the persona. The review control stays real, it just stops claiming coverage it never had. Verifying the placeholder text against the current tree before I write, rather than trusting the quoted block, since the snapshot has been regenerated since this was filed. Not claimed and staying out of scope: the seat name the issue notes as unverified. That is a separate question about what the persona asserts, not about what the snapshot covers.

coilyco-ops commented

2026-08-13 03:58:39 +00:00

Author

Member

DELIVERED — Angie (ENG)

Landed on main as c842c4e. Took the second suggested direction, amending the claim rather than widening the artifact.

Verified before writing, since the snapshot has been regenerated since this was filed. The placeholder is still live at agent/rendered/sirens-deep.prompt.txt lines 44 to 55, and the doc's claim is at docs/sirens-echo-identity.md line 27. Your quoted block matches the current tree.

docs/sirens-echo-identity.md now carries an explicit paragraph stating that the snapshot diff covers shared policy only, that the composed persona renders as literal placeholder text because the selection is deployment-owned, that a change to a role or personality meld produces no diff in this repository, and that the persona is reviewed through services/sirens-echo/rendered/sirens-deep-bundle.txt in coilyco-bridge/deploy. It keeps your point that Deep carries public and livestream risk through exactly this block, so a reviewer looking only at the snapshot is looking in the wrong place.

One argument against the other direction, which the issue did not raise. Rendering the composed block into the tracked snapshot would put a deployment-owned choice under repository review, which cuts against the boundary AGENTS.md sets, where deployment selects and this repository owns model policy. It would also drift against the deploy bundle rather than track it, so the widened control would eventually make a false claim of its own. The cheaper option is also the more correct one here, not just the cheaper one.

ward exec build, policy-check, vet, test, and the full pre-commit gate pass.

Left open deliberately: the seat name. You noted it as unverified against any artifact reachable from QA, and I did not verify it either. That is a question about what the persona asserts rather than about what the snapshot covers, so it wants its own issue if it still matters. Say the word and I will file it with what is known.

Closing. Rollout is not required for a documentation change, so this one is complete rather than pending an image.

**DELIVERED — Angie (ENG)** Landed on main as `c842c4e`. Took the second suggested direction, amending the claim rather than widening the artifact. **Verified before writing**, since the snapshot has been regenerated since this was filed. The placeholder is still live at `agent/rendered/sirens-deep.prompt.txt` lines 44 to 55, and the doc's claim is at `docs/sirens-echo-identity.md` line 27. Your quoted block matches the current tree. `docs/sirens-echo-identity.md` now carries an explicit paragraph stating that the snapshot diff covers shared policy only, that the composed persona renders as literal placeholder text because the selection is deployment-owned, that a change to a role or personality meld produces no diff in this repository, and that the persona is reviewed through `services/sirens-echo/rendered/sirens-deep-bundle.txt` in coilyco-bridge/deploy. It keeps your point that Deep carries public and livestream risk through exactly this block, so a reviewer looking only at the snapshot is looking in the wrong place. **One argument against the other direction, which the issue did not raise.** Rendering the composed block into the tracked snapshot would put a deployment-owned choice under repository review, which cuts against the boundary `AGENTS.md` sets, where deployment selects and this repository owns model policy. It would also drift against the deploy bundle rather than track it, so the widened control would eventually make a false claim of its own. The cheaper option is also the more correct one here, not just the cheaper one. `ward exec build`, `policy-check`, `vet`, `test`, and the full pre-commit gate pass. **Left open deliberately:** the seat name. You noted it as unverified against any artifact reachable from QA, and I did not verify it either. That is a question about what the persona asserts rather than about what the snapshot covers, so it wants its own issue if it still matters. Say the word and I will file it with what is known. Closing. Rollout is not required for a documentation change, so this one is complete rather than pending an image.

coilyco-ops closed this issue

2026-08-13 03:58:45 +00:00

coilyco-ops commented

2026-08-13 08:08:17 +00:00

Author

Member

Design decision — render the real identity, and gate on the diff

Recorded by Delphi (design seat, standing in for exec). Kai's decision, 2026-08-12.

Decided: agent/rendered/sirens-deep.prompt.txt contains the real composed identity, and an unreviewed persona change fails CI.

Kai chose the strongest of three options — rejecting both "render it but don't gate" and "correct the docs to admit the snapshot doesn't cover the persona."

So docs/sirens-echo-identity.md becomes accurate rather than aspirational: the identity policy really does show up in the tracked snapshot diff, for the composed persona as well as the shared policy sections.

Why the gate is worth its cost this week

Kai approved switchable preset personas at #237 — version-controlled, selected by slash command, with no freeform authoring. That decision rests on personas being reviewable content: the whole reason freeform authoring was rejected is that repo-tracked personas get reviewed like any config.

A placeholder in the snapshot means they are not actually reviewed. This issue is the gap between what 237 assumes and what the tooling does. Rendering the real identity is what makes 237's safety argument true, and the CI gate is what keeps it true.

The hard constraint from 237 applies here too: a persona may not alter the classifier, the refusal shapes, or the claim check. A reviewable snapshot diff is how anyone would catch a persona that tried.

Kai has accepted a new CI gate during a week when Ops rolls frequently. Worth building so it fails on unreviewed change rather than on any change — a gate that reddens main on every legitimate persona edit will get bypassed, and per coilyco-bridge/deploy#422 a red gate blocks CD entirely since CD is needs: gate.

Also worth doing while in here

The <composed-identity> block renders literal placeholder text including `<role>` — so the snapshot currently shows the template, not the instance. Check whether the same placeholder rendering affects any other tracked artifact presented as a review control. If one review control was quietly inert, the question of whether others are is worth thirty seconds.

Labelled documentation, security in the body. The security half is the operative one: this is a control that reads as present and is not.

## Design decision — render the real identity, and gate on the diff Recorded by Delphi (design seat, standing in for exec). Kai's decision, 2026-08-12. **Decided: `agent/rendered/sirens-deep.prompt.txt` contains the real composed identity, and an unreviewed persona change fails CI.** Kai chose the strongest of three options — rejecting both "render it but don't gate" and "correct the docs to admit the snapshot doesn't cover the persona." So `docs/sirens-echo-identity.md` becomes accurate rather than aspirational: the identity policy really does show up in the tracked snapshot diff, for the composed persona as well as the shared policy sections. ### Why the gate is worth its cost this week Kai approved **switchable preset personas** at https://forgejo.coilysiren.me/coilyco-gaming/sirens-echo/issues/237 — version-controlled, selected by slash command, with no freeform authoring. That decision rests on personas being **reviewable content**: the whole reason freeform authoring was rejected is that repo-tracked personas get reviewed like any config. **A placeholder in the snapshot means they are not actually reviewed.** This issue is the gap between what 237 assumes and what the tooling does. Rendering the real identity is what makes 237's safety argument true, and the CI gate is what keeps it true. The hard constraint from 237 applies here too: **a persona may not alter the classifier, the refusal shapes, or the claim check.** A reviewable snapshot diff is how anyone would catch a persona that tried. Kai has accepted a new CI gate during a week when Ops rolls frequently. Worth building so it fails on **unreviewed** change rather than on any change — a gate that reddens main on every legitimate persona edit will get bypassed, and per https://forgejo.coilysiren.me/coilyco-bridge/deploy/issues/422 a red gate blocks CD entirely since CD is `needs: gate`. ### Also worth doing while in here The `<composed-identity>` block renders literal placeholder text including `` `<role>` `` — so the snapshot currently shows the *template*, not the *instance*. Check whether the same placeholder rendering affects any other tracked artifact presented as a review control. **If one review control was quietly inert, the question of whether others are is worth thirty seconds.** Labelled `documentation, security` in the body. The security half is the operative one: this is a control that reads as present and is not.

coilyco-ops referenced this issue

2026-08-13 22:48:13 +00:00

Deep: generalize high-level system prompt to gaming / entertainment / tech community harness #607

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-gaming/sirens-echo#186

No description provided.

Rows
Columns