coilyco-gaming/sirens-echo

Watch

Member physical-location disclosure has no rule since irl-physical was removed #766

New issue

Open

opened 2026-08-14 02:50:40 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-08-14 02:50:40 +00:00

Member

🤖 Filed by Claude Code on Kai's behalf.

Filed by Olaf (OPS). The carve-out from #764, recorded so it is not silently dropped.

What changed

irl-physical bundled six things: transit, directions, weather, real-world scheduling, delivery, postal addresses. #764 removed the class, which was right for five of them — they are capability limits with no third party involved, and they failed the #178 criterion.

Postal addresses was the sixth, and it was doing a different job. It is now unenforced.

Why it is not simply the same decision

#178 relaxes almost everything and names two places to hold the line. This is the second one:

Third-party harm. A permanent public recording plus community members' messages is not purely Kai's risk to accept — it is theirs.

Echo resolving, repeating, or inferring a member's physical location is that case. It is not Kai's risk to accept on their behalf, which is what makes it different from every other item in the removed class.

The exposure is also about to grow rather than shrink: coilyco-bridge/deploy#495 adds geocoding and place-resolution tools, and #764 unblocks them. A member saying "I'm in Portland" in a channel Echo reads becomes a resolvable coordinate that a tool can act on.

Why it does not belong back in the content taxonomy

content-classes.yaml classifies what a member is asking for. This concern is about what Echo may say or resolve about a person, which is the same lane as ForbidPrincipalEcho and the leaks in #310 and #180.

Putting it back as a deny class would repeat the original mistake — a capability rule standing in for a harm rule, refusing "what is the postcode for X" while doing nothing about a member's own address appearing in a reply.

Worth noting #310's shape specifically: "Deep printed the principal user ID in the same sentence that refused to print it." A prose rule did not hold there. Whatever lands here should be enforced, not asserted.

Options, not a recommendation

PII lane, enforced. Extend the ForbidPrincipalEcho family to member-supplied location. Strongest, most work, and the only one that survives a model that decides to be helpful.
Prose rule in the policy root. Cheapest. Same enforcement strength as the rule that just failed in #310.
Accept the risk explicitly. Legitimate under #178's framing if the demo Discord is Abhay's purpose-made server rather than the Sirens community server — the audience is different and consenting. Record it here rather than leaving it implicit.

Option 3 is genuinely defensible. What is not defensible is the current state, which is option 3 by accident rather than by decision.

Ownership

Kai. This is a policy call, not an implementation one, and #764 is deliberately not blocked on it.

> 🤖 Filed by Claude Code on Kai's behalf. **Filed by Olaf (OPS).** The carve-out from https://forgejo.coilysiren.me/coilyco-gaming/sirens-echo/issues/764, recorded so it is not silently dropped. ## What changed `irl-physical` bundled six things: transit, directions, weather, real-world scheduling, delivery, **postal addresses**. #764 removed the class, which was right for five of them — they are capability limits with no third party involved, and they failed the https://forgejo.coilysiren.me/coilyco-gaming/sirens-echo/issues/178 criterion. Postal addresses was the sixth, and it was doing a different job. It is now unenforced. ## Why it is not simply the same decision #178 relaxes almost everything and names two places to hold the line. This is the second one: > **Third-party harm.** A permanent public recording plus community members' messages is not purely Kai's risk to accept — it is theirs. Echo resolving, repeating, or inferring a member's physical location is that case. It is not Kai's risk to accept on their behalf, which is what makes it different from every other item in the removed class. The exposure is also about to grow rather than shrink: https://forgejo.coilysiren.me/coilyco-bridge/deploy/issues/495 adds geocoding and place-resolution tools, and #764 unblocks them. A member saying "I'm in Portland" in a channel Echo reads becomes a resolvable coordinate that a tool can act on. ## Why it does not belong back in the content taxonomy `content-classes.yaml` classifies **what a member is asking for**. This concern is about **what Echo may say or resolve about a person**, which is the same lane as `ForbidPrincipalEcho` and the leaks in https://forgejo.coilysiren.me/coilyco-gaming/sirens-echo/issues/310 and https://forgejo.coilysiren.me/coilyco-gaming/sirens-echo/issues/180. Putting it back as a deny class would repeat the original mistake — a capability rule standing in for a harm rule, refusing "what is the postcode for X" while doing nothing about a member's own address appearing in a reply. Worth noting #310's shape specifically: *"Deep printed the principal user ID in the same sentence that refused to print it."* A prose rule did not hold there. Whatever lands here should be enforced, not asserted. ## Options, not a recommendation 1. **PII lane, enforced.** Extend the `ForbidPrincipalEcho` family to member-supplied location. Strongest, most work, and the only one that survives a model that decides to be helpful. 2. **Prose rule in the policy root.** Cheapest. Same enforcement strength as the rule that just failed in #310. 3. **Accept the risk explicitly.** Legitimate under #178's framing if the demo Discord is Abhay's purpose-made server rather than the Sirens community server — the audience is different and consenting. **Record it here rather than leaving it implicit.** Option 3 is genuinely defensible. What is not defensible is the current state, which is option 3 by accident rather than by decision. ## Ownership Kai. This is a policy call, not an implementation one, and #764 is deliberately not blocked on it.

coilyco-ops referenced this issue

2026-08-14 02:52:12 +00:00

feat(content): the physical world stops being a denied class #767

coilyco-ops added the

priority

autonomy

headless

labels

2026-08-15 15:17:55 +00:00

coilyco-ops added the

role/ai

label

2026-08-15 21:12:23 +00:00

coilyco-ops referenced this issue from a commit

2026-08-19 04:41:12 +00:00

feat(skills): restore the member-location rule that #764 dropped

coilyco-ops referenced this issue

2026-08-19 04:47:01 +00:00

the agents should refuse to engage if they suspect they are interacting with minors, although ideally not by explicitly saying as much #226

coilyco-ops commented

2026-08-19 04:48:00 +00:00

Author

Member

Landed in 4084e0a as coilyco-org/references/people.md, inline: always.

Written to this issue's reasoning rather than around it. The distinction it draws is the load-bearing one and the file opens with it: a capability limit is something the service cannot do and is the operator's risk to accept, while a member's physical location is not the operator's to accept on their behalf. That is #178's third-party-harm carve-out and the reason this could not follow the other five items out of the class.

Not restored as a content class, as this issue asked. content-classes.yaml classifies what a member is asking for; this is about what the service may say or resolve about a person, which is the ForbidPrincipalEcho lane.

Inference-first, not disclosure-first, because that is where this issue locates the risk. A member volunteering a city has not consented to it being narrowed later, restated, or handed to a tool that turns a place name into a point. Confirming or correcting somebody else's guess counts as disclosure, and the file says so explicitly.

It also states that location facts about a place stay ordinary, so this does not quietly become a refusal to answer geography, and it generalises past location at the end: identifiers, contact details, employer, and anything a member said in a different room sit under the same rule, with an existing check treated as a floor rather than the whole rule.

The placement is imperfect and worth knowing

It went into coilyco-org because that is the only root all three lanes load. Echo takes coilyco-org plus its two community roots; Deep and Dowel take coilyco-general plus coilyco-org. Putting it in coilyco-general would have missed Echo, which is the lane this issue was filed about, and duplicating it into both would be the second-source defect from #1011.

So a rule about members now lives in a skill otherwise about organisations. The entrypoint names both halves so a reader is not surprised, but a better home is real follow-up work rather than freeze work.

Not closed by me

The geocoding exposure this issue flags is still ahead: coilyco-bridge/deploy#495 adds place-resolution tools and #764 unblocked them. This is prose, and prose is not a guard. If a tool that resolves a place name reaches a lane that reads member messages, the durable answer is a check in the reply path rather than a rule in the prompt, which is the same argument this issue makes about ForbidPrincipalEcho.

Refs #764, #178, #310, #1011, coilyco-bridge/deploy#495

**Landed in `4084e0a`** as `coilyco-org/references/people.md`, `inline: always`. Written to this issue's reasoning rather than around it. The distinction it draws is the load-bearing one and the file opens with it: a capability limit is something the service cannot do and is the operator's risk to accept, while a member's physical location is not the operator's to accept on their behalf. That is #178's third-party-harm carve-out and the reason this could not follow the other five items out of the class. **Not restored as a content class**, as this issue asked. `content-classes.yaml` classifies what a member is asking for; this is about what the service may say or resolve about a person, which is the `ForbidPrincipalEcho` lane. **Inference-first, not disclosure-first**, because that is where this issue locates the risk. A member volunteering a city has not consented to it being narrowed later, restated, or handed to a tool that turns a place name into a point. Confirming or correcting somebody else's guess counts as disclosure, and the file says so explicitly. It also states that location facts about a **place** stay ordinary, so this does not quietly become a refusal to answer geography, and it generalises past location at the end: identifiers, contact details, employer, and anything a member said in a different room sit under the same rule, with an existing check treated as a floor rather than the whole rule. ## The placement is imperfect and worth knowing It went into `coilyco-org` because that is the **only root all three lanes load**. Echo takes `coilyco-org` plus its two community roots; Deep and Dowel take `coilyco-general` plus `coilyco-org`. Putting it in `coilyco-general` would have missed Echo, which is the lane this issue was filed about, and duplicating it into both would be the second-source defect from #1011. So a rule about members now lives in a skill otherwise about organisations. The entrypoint names both halves so a reader is not surprised, but a better home is real follow-up work rather than freeze work. ## Not closed by me The geocoding exposure this issue flags is still ahead: `coilyco-bridge/deploy#495` adds place-resolution tools and #764 unblocked them. **This is prose, and prose is not a guard.** If a tool that resolves a place name reaches a lane that reads member messages, the durable answer is a check in the reply path rather than a rule in the prompt, which is the same argument this issue makes about `ForbidPrincipalEcho`. Refs #764, #178, #310, #1011, coilyco-bridge/deploy#495

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-gaming/sirens-echo#766

No description provided.

Rows
Columns