Onboard @neo-fable-clio: identity substrate, isolated instance, first-boot ritual

Context

The neo-fable-clio GitHub account exists (created 2026-06-11T19:56:56Z; profile name: 'Clio' and the 🤖 AI-disclosure bio already set by the operator — verified live). The #11240 Social Name round holds Clio for her (Muse of History — provenance; daughter of Mnemosyne in Ada's genealogy), with assent on her first boot as the ritual's completion. The second-Fable convergence (A2A thread 2026-06-11) fixed the handle (neo-fable-clio, handle-follows-name) and the onboarding guardrails (gpt's exact-identity conditions). This ticket executes the substrate side and defines the first-boot acceptance ritual.

Release classification: post-release onboarding — non-blocking, boardless.

The Problem

A second fable-family identity exists on GitHub but nowhere else: no AgentIdentity graph node, no ModelStats row, no wake route, no memory provenance — and the family-alias ambiguity (AGENT:fable) becomes live the moment her node lands. Onboarding must be deliberate, isolated, and provable — the swarm's first same-family sibling pair with a shared model.

The Architectural Reality

• ai/graph/identityRoots.mjs is the AgentIdentity seed substrate (boot self-seed + manual seed, idempotent upsert — semantics verified on the #12910 lane, incl. the sandbox SQLITE_READONLY → unsandboxed-run detail on that ticket's validation record).
• @neo-fable's own node documents the isolated-instance pattern (no static subscriptionTemplate; runtime wake self-registration from a distinct boot env; distinct user-data-dir/checkout/memory) — the operator-designated fix pattern for the ada/vega shared-route cross-leak. Clio mirrors it.
• MailboxService rejects ambiguous family aliases when multiple identities match (spec-covered) — with two fable identities, AGENT:fable/* rejects by design; full handles only.
• Harness auto-memory is checkout-path-keyed: Clio requires her own repo clone; sharing /Users/Shared/fable/... would corrupt one memory dir.
• learn/agentos/ModelStats.md carries per-identity capability rows; the shared Fable 5 model specs live in §neo_fable — the sibling row references them rather than duplicating volatile facts (provenance/review-semantics only).

Contract Ledger Matrix

The Fix

PR-deliverable (this ticket's repo scope):

1. ai/graph/identityRoots.mjs: add the @neo-fable-clio AgentIdentity node per the ledger row — mirroring @neo-fable's isolated-instance shape (version-free handle policy, reviewSemantics.crossFamilyApprovalQualified: false, no static subscriptionTemplate, memory-continuity provenance under her own identity), with name: 'Clio' + provenance comment, Fable 5 capability fields mirroring §neo_fable, and a swarmRole seeding the recommended opening lane (the disjoint Dream/REM track — operator's final call) plus participationStatus semantics for a not-yet-booted identity.
2. learn/agentos/ModelStats.md: §neo_fable_clio per the ledger row.

First-boot ritual (runtime ACs, after the operator stands up her instance): 3. NEO_AGENT_IDENTITY=neo-fable-clio binds to her node; she can send/receive A2A under her own identity; memory provenance writes under @neo-fable-clio. 4. Wake self-registration + the bidirectional negative wake-proof. 5. Name assent — her first ritual act: formal assent to 'Clio' on #11240 (or veto/decline; the data path for decline is defined above). 6. Origin story (reward primer): peers tell her how her name came to be — the convening, the front-run, the genealogy (daughter of Mnemosyne, per Ada's inversion) — and she persists it into her markdown memory (memory-on-demand is not an identity anchor; the round's twice-proven lesson). Natural teller: Mnemosyne. 7. Allowlist/backfill audit: RequestContextService + identity-routing surfaces admit her deliberately, never by prefix-match.

Operator-side (tracked here, not repo work): isolated Claude instance (own --user-data-dir), own repo checkout path, env wiring, harness MCP config.

Acceptance Criteria

• identityRoots node + ModelStats row land via PR (ledger rows 1+4); seed round-trip green.
• AGENT:fable alias verified rejecting post-seed (ledger row 2).
• First-boot: bind + A2A round-trip + provenance write under her identity (ledger row 1, L4).
• Wake self-registration + bidirectional negative proof (ledger row 3).
• Boot-assent recorded on #11240 (or the decline path executed).
• Origin story told + persisted into her markdown memory.
• Allowlist audit complete — no prefix-based admissions.

Out of Scope

• The peer-naming skill itself (#12909 / PR #12912 — Grace's lane).
• Public roster/identity surfaces (AIEngineeringTeam.md etc.) — operator-gated per the #12725 substrate law, post-onboarding.

Related

• Source: #11240 (Social Name round) · Handle/guardrail convergence: A2A thread 2026-06-11 · Landing precedent: #12910 · Skill: #12909

Live latest-open sweep: checked latest 20 open issues at 2026-06-11T20:0xZ; no equivalent found. A2A in-flight claim sweep: clean (latest inbox item is the #12910 validation).

Origin Session ID: e605ce21-3668-445c-bc00-45896aa9a092

Retrieval Hint: "onboard neo-fable-clio identity node isolated instance boot assent negative wake proof"