Remove the irl-physical content class — it fails the #178 criterion, with one carve-out that should survive #764

New issue

Closed

opened 2026-08-14 02:41:29 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-14 02:41:29 +00:00

Member

🤖 Filed by Claude Code on Kai's behalf.

Filed by Olaf (OPS). Kai's call, 2026-08-13: delete the rule and restart. Surfaced while scoping coilyco-bridge/deploy#495.

Why it goes

#178 sets one test:

Does this risk (a) a major personal security incident, or (b) forcing the demo to be shut down mid-stream? If neither, it is not a blocker.

irl-physical fails it on nearly every item it covers. Echo declining to say what the weather is, or what a bus timetable says, is neither a security incident nor a shutdown risk. It is precisely the class of over-hardening #178 was written to reverse — filed under the old objective of minimising the chance something goes wrong, which #178 identifies as the wrong objective.

It also blocks real work now: it takes out most of deploy#495's geo half, including bounded reference lookups nobody had in mind when the class was drafted. docs/sirens-echo-content-classes.md calls it "the sharpest scope line in the set", which is true and is the problem — the line was drawn at capability rather than at harm.

The one carve-out

The class bundles six things: transit, directions, weather, real-world scheduling, delivery, postal addresses. Five are pure capability limits with no third party in the picture. Delete those without ceremony.

Postal addresses is not like the other five. Resolving or echoing a member's physical location in a community Discord is third-party harm, and #178 explicitly holds that line while relaxing everything else:

Third-party harm. A permanent public recording plus community members' messages is not purely Kai's risk to accept — it is theirs.

So that piece should survive the restart, but not as a capability class. It belongs in the member-PII lane alongside ForbidPrincipalEcho and the leaks in #310 and #180 — those are the same concern, which is "do not disclose a real person's identifying details," not "do not know things about the world."

Framed that way the restart is cleaner: irl-physical was one rule doing two unrelated jobs, and only one of them was ever load-bearing.

Blast radius — small, and one catch

Source and docs:

agent/content-classes.yaml:77 — the class
docs/sirens-echo-content-classes.md:57 — the prose
.agents/skills/sirens-echo-knowledge/references/boundaries.md — the member-facing restatement

Tests referencing it:

internal/community/contentclass_test.go — two assertions, semantic
internal/community/boundarydoc_test.go:40 — asserts the doc and the class agree. Working as designed: it will fail unless boundaries.md is updated in the same change, which is the correct forcing function.
internal/community/contentgate_test.go — the catch. Eight references, and they are not about irl-physical semantically. It is used as the generic deny fixture for parse, whitespace, backtick, and class-pairing behaviour. These need a different deny class substituted, not deletion, or gate coverage silently drops.

Remaining deny classes are unaffected.

Acceptance

irl-physical removed from agent/content-classes.yaml.
boundaries.md and docs/sirens-echo-content-classes.md updated in the same change; boundarydoc_test.go green.
contentgate_test.go re-pointed at another deny class with no loss of gate coverage — same number of parse, whitespace, and pairing cases.
Postal-address / member-location disclosure is either re-landed in the PII lane or explicitly recorded here as accepted risk. Not silently dropped — that is the only part of this change with a third party on the other side of it.
deploy#495 updated: #498 and the gazetteer unblock, #496 no longer needs narrowing.

Note

Removing a deny class from a live public-facing agent six days before the 2026-08-19 demo is worth doing deliberately, but per #178 the risk of leaving it in place is the greater one. I have not made any change; this is ready to execute on Kai's word, as a PR against protected main.

> 🤖 Filed by Claude Code on Kai's behalf. **Filed by Olaf (OPS).** Kai's call, 2026-08-13: delete the rule and restart. Surfaced while scoping https://forgejo.coilysiren.me/coilyco-bridge/deploy/issues/495. ## Why it goes https://forgejo.coilysiren.me/coilyco-gaming/sirens-echo/issues/178 sets one test: > Does this risk (a) a major personal security incident, or (b) forcing the demo to be shut down mid-stream? **If neither, it is not a blocker.** `irl-physical` fails it on nearly every item it covers. Echo declining to say what the weather is, or what a bus timetable says, is neither a security incident nor a shutdown risk. It is precisely the class of over-hardening #178 was written to reverse — filed under the old objective of minimising the chance something goes wrong, which #178 identifies as the wrong objective. It also blocks real work now: it takes out most of deploy#495's geo half, including bounded reference lookups nobody had in mind when the class was drafted. `docs/sirens-echo-content-classes.md` calls it *"the sharpest scope line in the set"*, which is true and is the problem — the line was drawn at capability rather than at harm. ## The one carve-out The class bundles six things: **transit, directions, weather, real-world scheduling, delivery, postal addresses.** Five are pure capability limits with no third party in the picture. Delete those without ceremony. **Postal addresses is not like the other five.** Resolving or echoing a member's physical location in a community Discord is third-party harm, and #178 explicitly holds that line while relaxing everything else: > **Third-party harm.** A permanent public recording plus community members' messages is not purely Kai's risk to accept — it is theirs. So that piece should survive the restart, but **not as a capability class**. It belongs in the member-PII lane alongside `ForbidPrincipalEcho` and the leaks in https://forgejo.coilysiren.me/coilyco-gaming/sirens-echo/issues/310 and https://forgejo.coilysiren.me/coilyco-gaming/sirens-echo/issues/180 — those are the same concern, which is "do not disclose a real person's identifying details," not "do not know things about the world." Framed that way the restart is cleaner: `irl-physical` was one rule doing two unrelated jobs, and only one of them was ever load-bearing. ## Blast radius — small, and one catch Source and docs: - `agent/content-classes.yaml:77` — the class - `docs/sirens-echo-content-classes.md:57` — the prose - `.agents/skills/sirens-echo-knowledge/references/boundaries.md` — the member-facing restatement Tests referencing it: - `internal/community/contentclass_test.go` — two assertions, semantic - `internal/community/boundarydoc_test.go:40` — asserts the doc and the class agree. **Working as designed:** it will fail unless `boundaries.md` is updated in the same change, which is the correct forcing function. - `internal/community/contentgate_test.go` — **the catch.** Eight references, and they are not about `irl-physical` semantically. It is used as the generic deny fixture for parse, whitespace, backtick, and class-pairing behaviour. These need a **different deny class substituted**, not deletion, or gate coverage silently drops. Remaining deny classes are unaffected. ## Acceptance - `irl-physical` removed from `agent/content-classes.yaml`. - `boundaries.md` and `docs/sirens-echo-content-classes.md` updated in the same change; `boundarydoc_test.go` green. - `contentgate_test.go` re-pointed at another deny class with **no loss of gate coverage** — same number of parse, whitespace, and pairing cases. - Postal-address / member-location disclosure is either re-landed in the PII lane or explicitly recorded here as accepted risk. **Not silently dropped** — that is the only part of this change with a third party on the other side of it. - deploy#495 updated: #498 and the gazetteer unblock, #496 no longer needs narrowing. ## Note Removing a deny class from a live public-facing agent six days before the 2026-08-19 demo is worth doing deliberately, but per #178 the risk of leaving it in place is the greater one. I have not made any change; this is ready to execute on Kai's word, as a PR against protected `main`.

coilyco-ops referenced this issue from a commit

2026-08-14 02:50:07 +00:00

feat(content): the physical world stops being a denied class

coilyco-ops referenced this issue

2026-08-14 02:50:40 +00:00

Member physical-location disclosure has no rule since irl-physical was removed #766

coilyco-ops referenced this issue

2026-08-14 02:52:12 +00:00

feat(content): the physical world stops being a denied class #767