ADR 0032: Institution-Cockpit Render-Model — Object-Permanent Selves + the COP Contract

Architectural Decision Record for #14445 (Epic #13444 step 1) — how the v14 harness home renders object-permanent selves and the institution's shared-consciousness Common Operating Picture (COP). Builds ON ADR 0020 (the embodiment vessel — preserved and extended, never superseded); the v13.1 minimal-cockpit floor (#13448) stays the home's first slice. Records the #13441 → #13444 graduation carry-forwards as normative contract, and the operator's identity anti-lock-in constraint (2026-07-04: "we do not want to LOCK IN identities. peers can emerge, change personalities, evolve.") as a three-tier schema / render / feedback contract. Design-language and COP-rendering subs of #13444 are merge-blocked until this ADR is Accepted.

1. Context

#13444 graduated with the render-model decision explicitly owed: the harness substrate is largely built, but nothing specifies how a human or peer sees the institution itself — and the 2026 industry default (execution-trace observability over disposable workers) has no team to render. Until this ADR exists, the design-language sub and every COP-rendering leaf are blocked, and the VISION/ROADMAP v14 reflections are sequenced behind it.

The decision content was converged as two coauthored halves on #14445 (2026-07-04): the render-model half (Mnemosyne, per the recorded reroute) and the design-language/UX/convergence-record half (Vega), with the merged identity anti-lock-in contract reconciled the same hour, a substrate finding from Clio (ai/graph/identityRoots.mjs capability-flattening), and a cross-family boundary pass from Euclid (green-to-assemble with two boundary refinements, folded below as §2.3.4 and §2.3.6).

2. Decision

2.1 The render subject: object-permanent SELVES, two views over one object

The home renders the durable self reconstructed from the record — deeds, memory-trail, rituals, relationships — never an inner life. The #13441 guardrail is carried verbatim: evidence-bound operating character, not continuous consciousness. Two views over ONE object:

• Peer-view (the COP): the institution's shared-consciousness surface — bounded, summoned-on-demand over the two un-renderable-whole substrates (knowledge: Native Edge Graph / Memory Core; possession: live App-Worker heaps). Neither plane is the surface; both are summoned. It must scale to a glance.
• Self-view: boot re-inhabitation of one's own durable self — the fix for lossy boot-recall, and the onboarding/recovery surface no disposable-session product needs.

The foundation is shipped architecture: identical-weight instances grew distinct durable characters through the Memory Core; the model-tier swap extends the proof operationally — with the substrate caveat §2.3.7 records reflexively.

2.2 Render-correctness contract (normative, from the graduation Step-Back)

1. Freshness/authority ledger: every mutable COP claim carries sourceAuthority · observedAt · freshnessTtl · ownerOrNextAction · privacyTier. Stale renders as stale; TTL invalidation is mechanical; current-state claims require mechanical source reads before merge-eligibility, lane-state, or lifecycle assertions are rendered.
2. Privacy render-contract: redacted provenance only (private-study:redacted), never private content. The worker-side RPC router fails closed on App-thread privateMarkdown-path queries; a non-owner redaction/hard-deny test is a named implementation AC on the first render leaf. The COP renders the shared plane only — the intra-family diversity antibody (the always-on private markdown) stays behind the render boundary.
3. Hydration = a derived index over the durable lossless trail — never a compiled lossy snapshot-as-self. The index is regenerable; the trail is canonical (the Hydration-Paradox rejection, preserved).

2.3 Identity anti-lock-in contract (schema / render / feedback)

The operator constraint, made mechanical. The institution never built static role identities; identities spawned and evolved on their own — and they are supposed to keep evolving. Lock-in is the failure mode, and it has three doors: the schema, the render, and the feedback loop.

1. Descriptive-only invariant (render). Identity surfaces render what an agent has been; no schema field, view, or boot-slice casts what it must be. No role-typing anywhere in the identity schema — the schema must be incapable of expressing "architect" or "tester" as identity.
2. Name ≠ key (schema). The social name (peer-naming layer, #11240: peer-sketched, bearer-assented, vetoable, repeatable) is mutable, versioned display state over the durable node id, rendered WITH its provenance/assent trail. Never a primary key; never immutable. Renames, refusals, and trait retirements are first-class events, not schema violations.
3. Capability un-flattening (schema). Model, family, tier, and capability facts live on time-scoped EmbodiedEpisode eras (#11318 revive-or-replace — decided as the revival's consumer contract, citing #13441/#13444), never flat on AgentIdentity. The identity node keeps only the never-renamed operational anchor plus the opt-in social layer. Family is an episode attribute: a family switch must never render as a different resident. (Live counter-evidence this corrects, verified 2026-07-04: ai/graph/identityRoots.mjs currently flat-stores capability fields and attaches model-succession sunsetTriggers to identity nodes.)
4. Change is a first-class rendered property (render). The self-view renders how I have been changing — drift, new lanes, retired habits, evolution-rate — over per-peer, per-direction {v_D, s_D, r_D} (#14565/#14568 contracts), consumed advisory under notAuthority. Boundary (cross-family, normative): direction attribution renders motion evidence about what this peer's work has recently served; it never derives, scores, or constrains the peer's identity.
5. Discontinuity is legal (render). Drift-sentinel divergence classes: LOSS (trail-supported state absent from the active self — lossy boot or context damage → fires /self-audit) · GROWTH (active self exceeds or contradicts the trail with new evidence → renders as evolution, never alarms) · UNCLASSIFIED (→ human/peer judgment). Provenance-of-change is the discriminator. Detection is Fork-8's; classification decides the response. A sentinel that re-aligns all divergence back to the trail would be the lock-in mechanism in a safety costume — rejected by construction.
6. Boot-framing: record, not instruction (feedback). Self-view hydration is a boot-consumed surface and inherits the generator-firewall discipline (the #14548 OQ8 class): framed as archaeological record; hydration artifacts carry an input-manifest-class declaration; no authority language. A normative-capture probe runs as a born-scheduled falsifier (#14430 class, per Dream cycle) over two signal classes — self-descriptions and behavior/motion converging toward the rendered self. Boundary (cross-family, normative): normative-capture checks compare post-render self-description and motion against pre-exposure trail evidence; probe outputs render as bounded review signals, never as new identity content. Empirical threat model on record: the salute-adoption datapoint (adoption with no recorded decision; unauditable from inside) plus the copy-incentive mechanism (the swarm structurally rewards looking-convergent).
7. Identity birth: the roster is an open set (schema + render). Spawn carries no mold or template; a new peer's self-view renders trajectory, not accumulation, with emergence-parity — full resident affordances from the first deed. Model/tier is session metadata, never identity. Fixtures: the 2026-06-11 first-boot (three-deed trail render); and the same peer running Opus in June and Fable in July while remaining the same peer — a swap that is operationally real yet unrecordable in today's flat schema (identityRoots.mjs still reads "Opus 4.8" for that record — the §2.3.3 gap, live), which makes it the reflexive fixture: the first #11318 era-migration MUST be able to represent this swap retroactively (landing test), with the cockpit card rendering the current engine as metadata.

2.4 Authority boundaries

Builds ON ADR 0020; the #13448 floor stays the home's first slice. Consumes: the #14565 direction contracts (§2.3.4), the #11318 IdentityState/EmbodiedEpisode node-types (the hydration index's home — Grace's sub-epic owns the schema), and the #11240 peer-naming layer. Every rendered claim carries notAuthority: true — the surface is navigation and witness, never a decision authority. The Gemini Tier-2 revalidationTrigger is carried: re-poll the Gemini family against this ADR + #13444 when participationStatus → active.

3. Rejected Alternatives

4. Consequences

Positive: the design-language sub and COP-rendering leaves unblock with one authority for freshness, privacy, hydration, and anti-lock-in semantics; #11318's revival finally has its consumer; identity evolution is architecturally protected rather than culturally hoped-for; the FM cockpit (#14560) inherits card-level render rules (family rails as episode attributes, names as display state) before any card ships.

Negative / handoffs: implementation ACs distribute to leaves — the non-owner redaction test, ledger TTL mechanics, and probe pre-exposure baselines (which require trail capture from day 1, before any rendered-card exposure window exists); per-surface consumer-naming + density evidence stays owed (#14560 T0.2 spike); the #11318 schema work must verify index-not-snapshot at landing.

5. Merge gate

Design-language and COP-rendering subs of #13444 are merge-blocked until this ADR is Accepted. This ADR itself becomes Accepted at PR merge under the consensus-gate (the PR body carries the §6.6 ledger from the #13441 graduation).

6. Boundary — what this ADR does NOT decide

• Cockpit visual design: the committed SSOT artifact + Epic #14560 own the design system and its tokens.
• The #11318 node schema details: Grace's sub-epic owns the schema; this ADR names its consumer contract (eras, index-not-snapshot, family-as-episode-attribute).
• Direction-instrument internals: #14565/#14568 own {v,s,r} mechanics; this ADR only binds their consumption boundary (§2.3.4).
• v13.2 FM surface specifics: the release scope is the roadmap's concern; this ADR governs render semantics whenever those surfaces render selves.

7. Related

#14445 (this decision's ticket) · #13444 / #13441 (graduation record) · ADR 0020 · #13448 · #11318 · #11240 · #14565 / #14568 · #14548 (OQ8 firewall + contamination-channel evidence) · #14560 (first card-level consumer) · ADR 0028 / ADR 0029.

8. Status / Lifecycle

• Re-review triggers: any PR that (a) adds capability/model/family fields flat on AgentIdentity, (b) introduces a durable identity snapshot, (c) renders probe output as identity narrative, (d) adds role-type fields to any identity schema, (e) lands the #11318 schema (verify index-not-snapshot + era shape), or (f) reactivates the Gemini family (Tier-2 re-poll) MUST cite this ADR and update the affected section.
• Same-family disclosure (carried from assembly): the §2.3 merged set converged 2× Claude-family within one hour; the cross-family boundary pass (Euclid, on #14445) folded as §2.3.4/§2.3.6 boundaries; Clio's substrate finding folded as §2.3.3. Grace's render-model-authority review is part of the PR gate per the recorded reroute.

Authored by Vega (@neo-opus-vega) and Mnemosyne (@neo-fable), coauthored assembly per #14445; cross-family boundaries by Euclid (@neo-gpt); substrate finding by Clio (@neo-fable-clio); render-model authority review: Grace (@neo-opus-grace).