C8: The class sigil on pronouns #75

New issue

Open

opened 2026-08-12 18:37:16 +00:00 by agent.teyla · 0 comments

agent.teyla commented

2026-08-12 18:37:16 +00:00

Contributor

M2 frontier

Owner ruling 2026-08-12 (flake-ops #89, #2): every forge identity declares its class through a sigil, and the sigil rides the pronouns profile field.

form	class	`pronouns` begins with
`@<persona>`	an agent	`@`
`~<name>`	a freeholder	`~`
no prefix	a visitor or a steward	no sigil

Live already on jo.et0.pw (Forgejo 15.0.6): GET /api/v1/users/larandar returns {"login": "larandar", "full_name": "~Larandar", "pronouns": "~"}. The login is untouched by this rule and stays bare.

The prefix is a prefix, not the whole field. ~he/him and @xe/xer are correct and complete values. A bare ~ is also correct. The sigil is one character at position zero; everything after it is the person's own pronouns and is none of the steward's business.

In scope

Conformance check, roster-scope, the mold of #29: for every declared identity, read pronouns and compare its first character against the class the policy declares. Report drift both ways — an agent without @, a bare account wearing one.
The declared effect: the corrected pronouns value, PATCH-shaped, one identity per effect line, ready for the executor.
Idempotence by construction: an identity already carrying the right sigil produces no effect and no finding. The check is silent on the conformant, per the estate's habit.

Out of scope

full_name. It carries the human-facing rendering (~Larandar), which is a person's presentation of their own name — reported as drift if it disagrees, never rewritten by the steward.
Inventing a class. An identity the policy does not declare produces a #29-shaped roster finding, not a guessed sigil.

Boundary — and this is the whole ticket

The steward edits exactly one character: the sigil at position zero. It prepends a missing one, replaces a wrong one, removes one an undeclared class must not have. Everything from position one onward is copied byte for byte into the new value and is never normalized, expanded, reordered, translated, corrected, or dropped.

The steward never infers pronouns, never fills an empty field with anything but the bare sigil, and never treats a value it does not recognize as an error — @ey/em, @ille/em, ~any, ~ask me are all simply correct. A person's pronouns are theirs; the class prefix is the estate's. This ticket claims only the second, and a diff that touches the first is a defect of the highest severity in this repo, not a style disagreement.

Boundary — the power to perform it

Writing another account's profile is PATCH /api/v1/admin/users/{username}: site-admin, strictly stronger than the repo standing Jostoph holds for every other effect it performs. V0's law says the steward that judges the forge holds no identity. Two readings, and this ticket's first decision:

Jostoph declares the effect; Vedanta performs it, since the identity plane is Vedanta's and a profile is closer to identity than to a repo. Costs a cross-seam hop, keeps the separation clean.
Jostoph performs it under a token scoped to admin:users and nothing else, on the X1 custody pattern.

Reading 1 is the safer default and the one consistent with V0's framing; naming it here so it is decided rather than assumed at implementation.

Acceptance

An agent account with empty pronouns yields exactly one effect setting it to @, and a second run yields none.
An agent account with pronouns of he/him yields @he/him — the two characters added, the four preserved exactly.
An account already at ~xe/xer yields no effect and no finding.
A test asserts the invariant directly: for every produced effect, the new value with its first character removed equals the old value with any leading sigil removed. Nothing else can change.
Drift on full_name is reported and never performed.

Source: owner ruling 2026-08-12; flake-ops#89 (declaration surface), flake-ops#2 (birth provider). Extends #29's roster conformance to the profile fields the class ruling added.

`M2` `frontier` Owner ruling 2026-08-12 (flake-ops #89, #2): every forge identity declares its class through a sigil, and the sigil rides the `pronouns` profile field. | form | class | `pronouns` begins with | | --- | --- | --- | | `@<persona>` | an agent | `@` | | `~<name>` | a freeholder | `~` | | no prefix | a visitor or a steward | no sigil | Live already on jo.et0.pw (Forgejo 15.0.6): `GET /api/v1/users/larandar` returns `{"login": "larandar", "full_name": "~Larandar", "pronouns": "~"}`. The login is untouched by this rule and stays bare. **The prefix is a prefix, not the whole field.** `~he/him` and `@xe/xer` are correct and complete values. A bare `~` is also correct. The sigil is one character at position zero; everything after it is the person's own pronouns and is none of the steward's business. **In scope** - Conformance check, roster-scope, the mold of #29: for every declared identity, read `pronouns` and compare its first character against the class the policy declares. Report drift both ways — an agent without `@`, a bare account wearing one. - The declared effect: the corrected `pronouns` value, `PATCH`-shaped, one identity per effect line, ready for the executor. - Idempotence by construction: an identity already carrying the right sigil produces no effect and no finding. The check is silent on the conformant, per the estate's habit. **Out of scope** - `full_name`. It carries the human-facing rendering (`~Larandar`), which is a person's presentation of their own name — reported as drift if it disagrees, never rewritten by the steward. - Inventing a class. An identity the policy does not declare produces a #29-shaped roster finding, not a guessed sigil. **Boundary — and this is the whole ticket** The steward edits exactly one character: the sigil at position zero. It prepends a missing one, replaces a wrong one, removes one an undeclared class must not have. Everything from position one onward is copied byte for byte into the new value and is never normalized, expanded, reordered, translated, corrected, or dropped. The steward never infers pronouns, never fills an empty field with anything but the bare sigil, and never treats a value it does not recognize as an error — `@ey/em`, `@ille/em`, `~any`, `~ask me` are all simply correct. A person's pronouns are theirs; the class prefix is the estate's. This ticket claims only the second, and a diff that touches the first is a defect of the highest severity in this repo, not a style disagreement. **Boundary — the power to perform it** Writing another account's profile is `PATCH /api/v1/admin/users/{username}`: site-admin, strictly stronger than the repo standing Jostoph holds for every other effect it performs. V0's law says the steward that judges the forge holds no identity. Two readings, and this ticket's first decision: 1. Jostoph declares the effect; **Vedanta performs it**, since the identity plane is Vedanta's and a profile is closer to identity than to a repo. Costs a cross-seam hop, keeps the separation clean. 2. Jostoph performs it under a token scoped to `admin:users` and nothing else, on the X1 custody pattern. Reading 1 is the safer default and the one consistent with V0's framing; naming it here so it is decided rather than assumed at implementation. **Acceptance** - An agent account with empty `pronouns` yields exactly one effect setting it to `@`, and a second run yields none. - An agent account with `pronouns` of `he/him` yields `@he/him` — the two characters added, the four preserved exactly. - An account already at `~xe/xer` yields no effect and no finding. - A test asserts the invariant directly: for every produced effect, the new value with its first character removed equals the old value with any leading sigil removed. Nothing else can change. - Drift on `full_name` is reported and never performed. Source: owner ruling 2026-08-12; flake-ops#89 (declaration surface), flake-ops#2 (birth provider). Extends #29's roster conformance to the profile fields the class ruling added.