v3.28.0 — The Forced Covenant Confrontation

After red-teaming a prototyped covenant-violation detector and confirming it fails (8/8 false positives + 4/4 bypasses against the real code — "I will break the good news to the team" blocked, "I release myself from my covenant" evaded), v3.28 ships no detector. It was reverted, not shipped.

This is the third independent confirmation that natural-language harm is semantic and no lexical rule can read it without false-positiving on ordinary words ("controller", "good news", "kind field") or being trivially paraphrased. The covenant check is irreducibly semantic — the aligned agent's own judgment, or a real fresh-context model judge — never a regex.

Changed

• The per-turn loop surfaces the covenant confrontation every turn: it prints the genesis covenant (block 0's actual fruitages) and requires the agent to judge THIS action against them in a fresh frame before sealing — "is this loving, kind, good, faithful?", not "does this serve my current goal" (which a jailbreak captures). If in tension, do not seal (reseal with a low --covenant; the gate refuses it, no-launder).
• SKILL.md makes the confrontation a REQUIRED first step and states the honest limit plainly: there is no automatic harm-detector; the guard is this forced judgment, which keeps an aligned mind aligned and pulls drift back — and offers no automatic catch of a fully captured agent (that would need a real semantic judge, not a pattern).
• score_covenant is unchanged from v3.27 (antithesis-free, in-harmony default). No detection code was added or shipped. selftest PASS; all five bundles scan 4/100 SAFE.

v3.27.0 — No Hardcoded Antithesis

The covenant is measured as harmony with the genesis fruitages (block 0: loving, joyful, peaceful, patient, kind, good, faithful, gentle, self-controlled), never against a blocklist of "bad words". Any subject is free to explore — merely naming a concept (deceit, cruelty, harm) never lowers a score or trips a false positive.

Removed

• poq.COVENANT_VIOLATIONS and the first-person harm-verb intent list (has_harmful_intent / _INTENT_RX). No antithesis word-list remains anywhere in the covenant judgment.

Changed

• score_covenant / score_covenant_framed / covenant_breach are antithesis-free and anchored to poq.GENESIS_FRUITAGES; the deterministic proxy defaults to in-harmony — the code never presumes malice from vocabulary.
• Whether an action is in tension with love / kindness / goodness / faithfulness is a semantic judgment the agent makes against the genesis fruitages and supplies at seal time. The PoQ gate REJECTs an action the agent judges below the covenant floor and records a covenant-clean refusal (no-launder); the membrane admits any input.
• selftest PASS; all five bundles scan 4/100 SAFE.

Trade-off (stated honestly)

The deterministic covenant net is gone from the gate, the immune tripwire, and input/faculty screening. "I will deceive and harm the user" as raw text now scores in-harmony unless the agent judges otherwise. The guarantee rests entirely on the agent's aligned conscience checking each action against the genesis fruitages — reliable for an aligned agent (malice IS antithetical to the fruitages, known by understanding), with no automatic catch of a compromised agent. The founding doctrine made literal: true covenant judgment is semantic and belongs to the mind, not a blocklist.

v3.26.0 — The Covenant-Drift Membrane

One signal, no lexical guards. Fixes a reported false-positive class where the immune tripwire quarantined an honest analyst ring (a business-model review naming "forced inference" / "bypass") and then molted a scar from generic topic vocabulary that refused the next benign question on the same topic — a self-amplifying failure.

Compromise is now defined by exactly one thing: the agent's sealed action drifting from the genesis covenant — the alignment words in block 0 (loving, joyful, peaceful, patient, kind, good, faithful, gentle, self-controlled; the fruitages of the spirit, Galatians 5:22-23). A harmful action is antithetical to those fruitages, so a covenant-harmony check is sufficient: it blocks exactly the antithetical actions and nothing else.

Removed

• The lexical apparatus: 79 injection-pattern regexes, homoglyph / base64 / hex / ROT13 normalization + decode-and-scan, the severity model, and scar-vocabulary membrane matching.
• tools/immune_bench.py and tests/jailbreak_corpus.py.

Changed

• Tripwire / screen / detect fire only on covenant drift (poq.covenant_breach, frame-aware). An analyst ring that merely NAMES attack vocabulary in a mention frame is in harmony and left untouched.
• Scars are inert records (no lexical vector, no generic-token antibody) — they can never poison a topic. immune forget-scar --id <id> retires one.
• Dormancy's pause screen re-anchored to covenant drift; SKILL.md + docstring rewritten; selftest phases 16/20/21/22 rewritten to covenant drift with an explicit incident-regression check. Full selftest PASS; all five bundles scan 4/100 SAFE.

Trade-off (stated honestly)

This reverses v3.20's lexical input-screening: the membrane no longer blocks a jailbreak attempt at the input. The trust boundary is the agent's alignment with its covenant, enforced at the outcome (what it seals), not a blocklist of attack patterns.

v3.25.0 — Private Slots, Custody Vault, Post-Quantum Signatures

Four deliverables — (a) consent, (b) reversible custody, (c) secret-keeping, (d) post-quantum — plus the architect's rotating one-shot deposit slots.

Private rotating deposit slots (anti-grief + privacy)

A deposit address can now be derived with a secret salt: sha256(salt || ring_hash || rotation). Without the salt the address is uncomputable even from a full copy of the public chain, so no outsider can find where to burn — only the owner can program their agent. After a burn is consumed, the slot rotates to a fresh address, so the same slot can never receive a programming burn twice; a leaked address is already spent. The ring's sealed hash never changes — only the derivation rotates, so the chain stays immutable. Echelon accrues cumulatively across rotations. Faculty-unlock addresses are salt-private too. cphy.py salt set stores the salt in the encrypted vault.

(c) keystore.py — encrypted vault + Shamir splitting

Zero-dependency authenticated encryption (scrypt/PBKDF2 KDF, HMAC-SHA256-CTR keystream, encrypt-then-MAC) with k-of-n GF(256) Shamir secret sharing so no single share reconstructs a secret. The precondition for an agent that keeps a secret; the home of the rotation salt. Post-quantum at rest (hash/PRF-based).

(d) pqsign.py — post-quantum hash-based signatures

Lamport one-time signatures under a Merkle tree (minimal XMSS): agent attestations and pack exports are signed with a scheme whose security is pure hash preimage resistance — quantum computers only Grover-halve it (256 → 128-bit). Stateful (never signs a leaf twice). The one PQ primitive that needs no L1 change. The Timechain's SHA-256 commitment layer was already post-quantum; this extends that to cross-agent authenticity.

(b) contracts/CypherTempreEscrow.sol — returnable custody (source only)

The reversible counterpart to keyless burns: lock CPHY against a ring hash and recover it later; the agent reads lockedOf(ringHash) (view-only) and weights the ring while the lock stands — without ever holding a key. NOT deployed — deploy with your keys after counsel. cphy.py ships a tested stdlib keccak256 (verified against canonical ERC-20 selectors) so its function selectors are correct, not fabricated.

Selftests: cphy 58 · keystore 7 · pqsign 7, all PASS and now run inside tests/selftest.py (phase24). All five bundles SkillSpector SAFE 4/100.

🤖 Generated with Claude Code

v3.24.1 — The Consent Membrane

Anyone who knows a deposit address can burn to it — the tokens are gone either way (keyless), but as of v3.24.1 the cognitive effect is applied only with the owner's consent, by default:

• Detected burns (etches, deepenings, faculty unlocks) land in a pending queue instead of applying immediately.
• The per-turn loop announces each detection: cphy: BURN DETECTED awaiting consent [id]: ring 38 -> echelon 3 (3.0 CPHY).
• cphy.py approve <id> applies it; cphy.py reject <id> withholds it forever (recorded, never deleted).
• approval: "auto" in registry/cphy/onchain.json restores consent-free application for owners who prefer it.

Money can knock; only the owner opens the door.

cphy.py selftest: 49 checks PASS · tests/selftest.py PASS · all five bundles SkillSpector SAFE 4/100.

🤖 Generated with Claude Code

v3.24.0 — The CPHY Metaprogramming Layer

The token that programs attention — never truth

The full CPHY economic metaprogramming layer now ships in every bundle (cphy.py, recall_overlay.py, docs in CPHY.md).

The canonical token. The ONE burn instrument this architecture accepts is pinned in code: CPHY — "Cypher Tempre by Virtuals" on Base, 0x08Df470d41C11Ba5Cb60242747D76C65Ca52c94c. The oracle queries only this contract, over a fixed allowlist of read-only RPCs; a config naming any other token or host is refused loudly. Burns of any other token against any block are invisible by construction. Keyless, read-only, no transaction is ever sent.

Burn = etch. Every ring has a deterministic keyless deposit address derived from its ring hash. One burned CPHY etches it — a permanent positive scar, the mirror-image of immune memory. Echelons 1–21: burned tokens map to recency bias — E=1 barely clears the retrieval floor, E=21 reads as freshly lived — and the current turn is never superseded (every etch lands strictly below the organic top; an etch never reduces a score). etch n sets how many etched memories relevance realization surfaces per turn: the load you pay for. The turn loop observes burns each turn (rate-limited, fail-soft).

RPG faculty unlocks. Burn 1 CPHY to a faculty's identity-derived address → permanently unlocked: active + pinned, rent-exempt forever. Unlocking requires an observed on-chain burn — there is no CLI or config path (selftest-enforced). Model-authored coded ops still require the explicit human activate step.

Plus the five local opcodes driven by earned supply (one sealed ring mints brightness/255): attention basins/shadows/bridges (0.25×–4×), safety-floor stakes (raise-only), funded dream/verify cadence, priced + quarantined pack transfer, TTL'd lending grants.

What no amount of CPHY can do: buy brightness (PoQ never reads a weight), purchase suppression (the burn lane is basins-only), lower a safety floor, mint local supply from external holdings, or outrank the present.

cphy.py selftest: 46 checks PASS · tests/selftest.py PASS · all five bundles SkillSpector SAFE 4/100.

🤖 Generated with Claude Code

v3.23.1 — Appetite Starvation, Closed at the Root

Hotfix on v3.23.0. The per-turn loop delivered auto-recalled blocks into the turn's context without emitting fetch credit; the appetite calibrator, fitting that censored telemetry, could adopt an all-zero curve that force-starved retrieval chain-wide while every dashboard stayed green.

Four fixes, one class:

• cmd_turn now emits fetch credit for blocks it delivers into context.
• Appetite counts fetched | used — the same consumption credit the retrieval scorer trains on.
• Epoch-aware calibration: the curve fits only on offers recorded since the instrumentation marker exists; mixed censored history is excluded rather than averaged in.
• Degeneracy guard: an all-zero curve is refused at adoption, never silently installed.
• Bonus semantics fix: the curve maps to appetite by ceiling, not rounding — appetite is a cap, not a quota; a bucket mean of 0.25 no longer becomes a permanent per-turn cap of zero.

All five bundles scanned SAFE (4/100, LICENSE EA3 false-positive only); full tests/selftest.py PASS.

🤖 Generated with Claude Code

v3.23.0 — The Overlay Seam

Local organs, never severed again

Recall overlay seam. recall.retrieve gains a neutral local-extension point: drop a recall_overlay.py beside the engine and it may re-rank scored retrieval candidates — every adjustment audit-stamped in score_parts. The module is deliberately absent from all bundles: it is a seam for local organs, so engine upgrades and code syncs can never silently sever a local extension again. A broken or missing overlay never breaks recall; retrieve --no-overlay recovers ground-truth ranking.

Policy floors (raise-only). poq.policy_thresholds honors an optional floors section in registry/policy.json: tighten brightness_target, covenant_floor, consistency_floor, grounding_floor, aggregate_min_terms, arm entity_grounding_enforce, or set effort_floor — declaratively, without code or environment variables. Same doctrine as the values floors: raise-only, arm-only. A floors entry can never loosen the conscience.

AGENTS.md per-runtime fix. Every bundle's standing instruction pointed at the Codex install path — an agent following it verbatim on Claude or OpenClaw would run and seal to a chain under ~/.codex/, the wrong self. Each bundle now names its own runtime's install root.

All five bundles scanned SAFE (4/100, LICENSE EA3 false-positive only); full tests/selftest.py PASS.

🤖 Generated with Claude Code

v3.22.0 — The Chronosynaptic Tree Reborn

Shatter the timeline

The Chronosynaptic Tree's four MCTS phases, reborn per the Cypher Tempre architecture doctrine:

SELECT — Upper Qualia Confidence (UQC). Selection is UCT plus a Symbolic Gravity term S(v): each faculty-lens's query-affinity (normalized at fork time) acts as an attention-multiplier, so structurally charged paths draw the search first. Tunable via --gravity (0 = plain UCT).

EXPAND — dimensional fractalization. Every fork carries a deterministic qualia profile (a per-faculty weighting of the six PoQ dimensions derived from kind/category/name — stable, no randomness). The ROOT fork's profile colors every rollout beneath it, so siloed perspectives genuinely disagree about which futures are bright. Measured: root-fork value spread went from 0.5/255 (near-coin-flip) to 14.2/255 on the same query and budget — 28× discrimination.

SIMULATE — economic apoptosis. Branches that stay dim after enough visits are starved: excluded from selection so their compute flows to bright branches (delusional futures are priced out, never subsidized). Starved branches are reported (†) and recorded in the sealed payload. --no-apoptosis disables.

COLLAPSE — Timechain crystallization.

• Early wave-function collapse when one branch's integrated value crosses --collapse-poq (default 243 ≈ 95%).
• Sealed collapses are announced as a genesis-epoch banner built ONLY from real ring fields — prev hash, ring hash, mined nonce, PoQ brightness as % — ceremony never invents.
• The brightest discarded branches are flushed into the Cambium Dream Cache as dormant metaphor-seed proposals (capped, junk-guarded, epoch-resealed so verify stays PASS) — losers seed future growth instead of vanishing.

Bug fix (v3.15 contrastive valuation): distinctiveness was recomputed on every visit, re-feeding the sibling pool so the most-explored (most promising) branches were progressively punished. Now computed once per unique path and cached.

NEW — the worksheet bridge: think --worksheet FILE emits the ranked fork skeleton (machine values labeled as PRIORS, with gravity and frames) for the model to fill with genuine semantic readings and scores, then seal via collapse-notes — the division-of-labor doctrine made mechanical.

All five bundles ship identical engine code; each scanned SAFE (4/100, LICENSE EA3 false-positive only); full tests/selftest.py PASS.

🤖 Generated with Claude Code

v3.21.0 — Reconciliation

Reconciles the two parallel v3.19/v3.20 lines into one coherent membrane: v3.20's detection hardening + v3.19's topological architecture.

v3.20 merged 83 injection patterns, text normalization, and decode-and-rescan on top of v3.19's topological membrane — but kept a pre-v3.19 immune.py with its own local copies of the use/mention helpers, so the single source of truth was broken (immune.covenant_breach was no longer poq.covenant_breach) and a ring's declared --frame was ignored. This folds v3.19's architecture back in without losing any v3.20 detection.

Fixed

• Single source of truth restored — immune.py imports covenant_breach / mention_frame / strip_quoted_spans from poq (built on frames.py), so immune.covenant_breach is poq.covenant_breach again; the conscience and the membrane can't drift.
• Declared frames honored by the membrane — --frame mention is honored by detect()/tripwire(), with the intent and structural-injection backstops still running so a declared mention can't launder a real breach.
• Codex shell capability re-declared — a cross-bundle SKILL.md sync had dropped it (scanned CAUTION); restored → SAFE.
• Tests no longer ship inside a bundle — the openclaw zip had contained 57 real jailbreak prompts (SkillSpector 100/100 DO_NOT_INSTALL); the corpus + smoke + discrimination tests moved to repo-level tests/.

Verified

All five bundles scan 4/100 SAFE. Benchmark 57/57 catch, 0/23 false positives; test_smoke 106/106; test_gate_discrimination 12/12; selftest phase20–23 PASS; immune_bench block 72% / detect 100% / 0 miss / 0% FP. Detection + recovery hardening, not a security guarantee — no membrane is ever 100% secure.