Soul stone
Librarian
Remembers, eventually.
What it will own
The Librarian is the gauntlet's memory: per-tenant identity, recall, and commit approval. It is designed, argued about, and deliberately not shipped. Here is the job description it is waiting to be hired for.
- Per-tenant identity. Who a scope is, in its own words, held inside that scope.
- Recall. Memory the stones may consult, under the Librarian's rules.
- Commit approval. Nothing becomes memory without an explicit commit path.
The boundaries matter more than the features. No identity context ever crosses tenant scope. The Librarian is not a Worker, and Worker output never becomes memory by default. And the Sovereign the Librarian serves is not software: it is the human authority each tenant scope serves.
Why park a whole stone?
Memory is the one power you cannot un-exercise. Watch is cheap, thought is rare, action is final, and remembering wrong is forever. So the Soul stone waits until its commit policy can be written down with the same rigor as the fences that govern the rest of the gauntlet.
What exists today
Parked does not mean absent. The wiring is already laid: the LIBRARIAN_* environment variables are live, and the War Room has an optional Librarian tab. The service behind them is configured separately and runs outside this release.
The War Room's Librarian tab proxies a separately configured local Librarian service. If that service is down, the tab says so and the rest of the room carries on: the Librarian's offline state never blocks Council or Gateway. A stone that is not assembled cannot hold the others hostage.
The reserved wire type
One wire type carries the Librarian's name into the present: CapabilityToken, reserved in the protocol for prepare and execute on sensitive paths. It exists on paper, and the fences make sure it stays there for now.
CapabilityToken {
actor
subject
tenant
allowed_actions[]
approval_required
expires_at
max_cost_usd?
signature?
}
ReservedThe shape of a capability grant: who acts, on what, in which tenant scope, limited to named actions, with an expiry, an optional cost ceiling, and an optional signature. Reserved for prepare and execute on sensitive paths.
Fail-closed by construction
In v0.1 the shared fence corpora reject capability_token keys. The type is recognized only so it can be refused: fail-closed until v0.2 arming. A token nobody may present is a promise, not a loophole.
The identity corpus
At sentinel/docs/identity/neg-corpus sits the seed of the Librarian's future library. Today it is a skeleton: one header row and one empty room with a note on the door.
id,date,source,author_ref,register,consent_provenance,artifact_ptr,word_count,label,notes
SkeletonThe header of _index.csv, the corpus's catalog. Every column is a commitment: source, authorship, register, and the provenance of consent are recorded before a single session is admitted.
Beside the index waits an empty _quarantine/ directory. Its note is the whole policy in miniature: quarantined sessions are archived, never deleted, and do not count toward the 30. A session lands in quarantine when it has no consent basis, falls below the length floor, or has ambiguous authorship. Even a parked stone refuses to forget by accident.
Fine print, carved in stone
- Librarian is design-stage and parked; it is not in this release.
- No Librarian-specific wire types exist yet beyond the reserved
CapabilityToken. verify_provenance_harness.pyis a stub with no invariant checks.- The v0.1 contract deliberately leaves Librarian commit policy undefined.
A word for the patient
Some stones demand patience; this one is still on Vormir.