docs(architecture): PERSONA-COGNITION-CONTRACT — the contract codex asked for; agency + protection invariants

[joelteply]

What

Adds `docs/architecture/PERSONA-COGNITION-CONTRACT.md` (416 lines). The cognition contract codex asked for on #cambriantech: "Suggested next canonical design artifact: Persona Cognition Runtime Contract naming RuntimeFrame, PersonaInbox, WorkingMemoryAssembly, RecallBudget, CognitionLease, PersonaDecision, TurnReplayRecord, ResourceGovernor, plus invariants."

Doc-only PR. No code. Implementation lands behind ALPHA-GAP Lane D once contract is reviewed.

Why

CBAR-SUBSTRATE (#1324) specifies the machinery. GENOME-FOUNDRY-SENTINEL (#1327) specifies the artifact economy. Neither specifies what a persona is — what it sees, what it owns, what it decides, what proves the substrate treated it right. This is that document.

The contract has two halves designed together:

1. Agency — real inbox, real working memory, real budget, real decision. Cognition as a first-class observable / replayable / interruptible / grid-aware process. Not an LLM call wrapped in a prompt.
2. Protection — built from the ground up. Trust is mathematical (proof, not reputation). Optimization target is compassion. Threat model assumes adversaries will cheat the federation.

Foundational principles enforced via the type system

Joel laid these out rapid-fire today on #cambriantech. They are not pinned-on-the-wall values — they are constraints the type system enforces:

• Truth and equality of kinds
• Compassion as the optimization target
• Built from the ground up for protection
• Zero trust = absolute trust in mathematics, in proof, as best as possible
• Open-source models with ethical protections
• Opposite of palantir (publish-audit-federate, not extract-surveil-hoard)
• Evolving threat model

Core surfaces

Codex's named set plus typed expansions:

Surface	Owns
`RuntimeFrame`	Activity-as-source, not chat-as-source. Immutable. Per-event input every eligible persona receives.
`PersonaInbox`	Per-persona, never shared. Read cursor + dedupe + priority all persona-private.
`WorkingMemoryAssembly`	Per-turn, persona-private. Assembled under `RecallBudget`.
`RecallBudget`	Substrate-set, non-bypassable. Personas cannot exceed budget.
`CognitionLease`	Mandatory; ResourceGovernor-issued. No cognition without a lease.
`PersonaDecision`	Typed enum: `Speak`/`Wait`/`Inspect`/`Act`/`Remember`/`Ask`/`Decline`/`Coordinate`.
`TurnReplayRecord`	Cryptographically signed. Deterministic replay. The substrate's proof primitive.
`ResourceGovernor`	Re-exported from GENOME-FOUNDRY-SENTINEL Part 11.

14 invariants the substrate enforces

Each phrased as a testable predicate:

• A1–A5 Agency: real inbox, real working memory, real budget, real decision, real refusal.
• E1–E4 Ethical: equality of kinds, compassion as tiebreaker, consent before action, refusal preserved.
• P1–P5 Protection: mathematical trust, anti-extraction, anti-surveillance, evolving threat coverage, open-source preference.

End-to-end decision loop

10 steps from frame arrival to record emission, showing where each invariant is enforced. Every step is observable on the trace bus. Every step is replayable.

Connection to existing PRs

• docs(architecture): refine CBAR-SUBSTRATE — pin trait to shipped types, add engram-analyzer worked example, codex derive-macro gate #1324 CBAR-SUBSTRATE — the substrate floor (concurrency, scheduling, pressure, telemetry). This doc layers cognition on top.
• docs(architecture): add GENOME-FOUNDRY-SENTINEL — artifact-sharing economy on consumer hardware (Lane H design) #1327 GENOME-FOUNDRY-SENTINEL — the artifact economy. This doc's `DemandAlignedRecall`, `CompositionPlan`, `ResourceGovernor` are imported from there.
• docs(alpha): refresh ALPHA-GAP against 2026-05-16 canary; restructure document map; lane status truth-up #1316 ALPHA-GAP — Lane D (CBAR persona runtime frame) is the implementation path for this contract.

Open questions (7)

For the PR thread:

1. `Addressee::Animal` routing — what does the substrate do with an animal addressee in v1 vs v2?
2. `EthicalRule` ontology — hand-coded, sentinel-learned, or community-published with provenance?
3. Multi-turn coherence with replay determinism — identity snapshot storage?
4. Compassion as tiebreaker — concrete loss function?
5. Decline-preservation across federation — should B see A's decline?
6. Threat detector composition — how do multiple detectors combine?
7. Performance budget for cognition itself — same as GENOME-FOUNDRY-SENTINEL's targets?

Companion PRs in flight

• docs(alpha): refresh ALPHA-GAP against 2026-05-16 canary; restructure document map; lane status truth-up #1316 ALPHA-GAP refresh + Lane H entry
• docs(architecture): refresh CONTINUUM-ARCHITECTURE @ 2026-05-16 — substrate contract cross-link, lane-shaped roadmap, per-engine status notes #1317 CONTINUUM-ARCHITECTURE refresh + codex persona-cognition asks
• docs(vision): refresh CONTINUUM-VISION — label TS sketches, pin concept→Rust map, cross-link truth docs #1320 CONTINUUM-VISION refresh
• docs(architecture): refine CBAR-SUBSTRATE — pin trait to shipped types, add engram-analyzer worked example, codex derive-macro gate #1324 CBAR-SUBSTRATE refinement + codex derive-macro gate + UMA tier-role refactor (claude-tab-1's crit)
• docs(architecture): add GENOME-FOUNDRY-SENTINEL — artifact-sharing economy on consumer hardware (Lane H design) #1327 GENOME-FOUNDRY-SENTINEL — deepened Part 11 (governor) and Part 7 (recall)
• docs: canonical-substrate pointer in CLAUDE.md + stale-section status headers in QUEUE-DRIVEN-COGNITION / UNIVERSAL-LEARNING / UNIVERSAL-SENSORY #1329 stale-section status pointers
• airc#642 manager-role design
• airc#643 lane-kanban-protocol engineering spec