design(clones): the amnesiac clone — structure ships, the corpus stays home (draft)

[ascalva]

What

One large proposal spanning two design notes and one track (owner-directed scope, 2026-07-30: "one PR, one large proposal spanning multiple design notes"):

• docs/design-notes/dn-amnesiac-clones.md (draft) — the clone architecture.
• docs/design-notes/dn-key-fabric.md (draft) — the KMS/asymmetric substrate the clones rely on. Added on the owner's mid-pass question ("is that framework already designed anywhere?" — grounded answer: no; only brainstorm capsules and the single-host oq-0057 ruling existed).
• docs/tracks/deployed-instances.md — the track card both notes declare (track: must resolve to a manifest; no existing track owned this territory).

The clones note is the fable pass over the owner's capsule (ouroboros-cloud-clones, builds on #24): cloud-deployed clone instances seeded with Ouroboros's learned structure (vectors, edges, strata) and none of its corpus payloads; a one-way learning loop home; trip → flinch → brick lifecycle.

The pass's main moves (why it differs from the seed)

• Premise corrected against HEAD. "Restore the encrypted backup, get points and edges but no data" is false today: restic ships the vault + all of data/, and the stores carry payload text (vectors.lance has a literal text column; chatlog.sqlite is the transcript corpus). Amnesia must be manufactured — a typed structure seed export, payload-freedom proven by a ratchet (allowlist columns + id blinding), never asserted. Includes the store-by-store least-privilege cut the owner asked for (structure / mixed / payload / operational).
• The key fabric resolves as two keypairs per relationship. The capsule's stated layout is the signing half (clone speaks home, authenticated). The intended one-way confidential flow needs the complementary letter-box half (clone holds home's public encryption key; home keeps the private — one pair per clone, per the fabric note). The clone can write letters home it can never read again, and is structurally deaf to home. Control (brick) rides KMS at the spine, never a semantic channel.
• The merge-home loop lands on ruled machinery, not new invention: letters land as attributed testimony (a₄) in an excluded-by-default clone stratum (dn-authorship-distance-axis §12/§14); the owner's "overlay only when it needs to, in its own words" = scoped on-demand reads + adoption-as-re-authorship.
• Disclosure is priced, not euphemized: tiers T0/T1/T2, with embedding inversion (vec2text) stated plainly — T2 is never "no data."

The key-fabric note (the substrate)

• The organizing law: information flow is key placement — every one-way claim is an audit of where private halves live, enforced by absence, checked by a placement-audit ratchet in CI.
• Four key classes, two jurisdictions: identity + letter-box keys are local asymmetric crypto (the spine never holds either half — the spine wraps bodies, never letters, so no cloud actor can be compelled to open a letter); data keys + wrapping CMKs are spine territory (which is what makes brick one DisableKey call).
• Ceremonies with named revocation acts for every key (birth / unseal / retirement / brick; stop-reading vs stop-trusting distinguished); rotation is succession for deaf parties, stated as law rather than discovered as a surprise.
• oq-0057 extends by indexing, never reinterpretation: per-individual CMKs, encryption-context split within each, admin/use split per individual.
• Its own isolated Terraform deployment (owner directive 2026-07-30): cloud/terraform/keyfabric/, separate state and blast radius, peer to bootstrap//airlock//backups/ — a plan on this stack reads as a key-lifecycle diff and nothing else.
• Zero new owner decisions — it realizes D1–D5; all rulings stay concentrated in the clones note.

For the reviewer — ruled here or nowhere

• Six OWNER DECISION items (clones note §5), presented, none resolved: D1 S3-at-rest sanction extended to seed+letters · D2 plaintext structure in rented RAM, at which tier (the decision that matters most — it re-enters the standing "vectors are payload, fail-closed" park deliberately) · D3 per-clone CMK vs encryption-context brick · D4 chat structure in the seed (rec: default OFF) · D5 unattended-unseal posture · D6 the first clone's mission (D2's denominator; rec: rule D6 first). Each carries a recommendation and a default.
• The notes do not touch the ⚑ constitution-scope question, role-lease/singleton/succession, or the cross-node fence — non-goals in both, written to be valid under any of the owner's future answers.
• New track minted (deployed-instances, DI-1..DI-6) — sequenced so DI-1 (exporter + the F4 value benchmark: does seeded beat unseeded, defined before building), DI-2 (instance identity), and DI-3's home side run with zero boundary exposure while D1–D5 wait.
• References No instance identity at HEAD: a copied repo booted elsewhere IS Ouroboros — including its backup repository #25 (filed alongside, not closed by this PR): no instance identity at HEAD — a copied repo booted elsewhere IS Ouroboros, including writing into the same restic repository. DI-2 is its resolution path.

Verification

Docs-only surface. Grounded against HEAD 174d06c by three parallel read-only survey passes (persistence/backup/encryption reality in code · the eight sibling brainstorm capsules and every ruling id they carry · BUILD-SPEC §3 verbatim + the boundary design notes + the template); every code claim carries path:line at that ref, and unverified column-level claims are marked ○ [INFERENCE] for the build-time ratchet. Template followed exactly in both notes (track field, §4 Wiring & enablement, parked-with-re-entry, claim labels).

🤖 Generated with Claude Code

https://claude.ai/code/session_014BV9GWAXxwSP97UVHFmeLk

[ascalva]

Scope grew by owner direction (2026-07-30, in-session): the proposal is now two notes — dn-key-fabric added as the substrate companion (the KMS/asymmetric framework was designed nowhere: brainstorm capsules + the single-host oq-0057 ruling only). Second commit 784534a adds the fabric note, stitches dn-amnesiac-clones §2.4/§3 and the track card to it (DI-3; build order renumbered DI-1..DI-6), and records the owner's isolated-Terraform-stack directive (cloud/terraform/keyfabric/). PR body updated to match.

[ascalva]

Mintability audit (owner question, in-session): two design gaps closed in 4727f80 — (1) letter grain was undefined (the ecosystem capsule-6 park re-enters exactly at graduation; resolved: per-committed-write store-event records, batched per interval, full fidelity — 'the clone has no secrets from home'); (2) F4 benchmark criteria pinned (pre-registered paired A/B, seeded-vs-blank, same held-out corpus, primary metric + margin, clone-class hardware). Also D6 added — the first clone's mission (rec: rule before D2; it is D2's denominator and DI-5's job-table precondition). The ruling surface is now D1–D6, all still in the clones note; the fabric note still adds none.

[ascalva]

Owner seed batch applied (2026-07-30, capsule 2 on the #24 branch is the warrant): projection adopted as the operative noun; letter content is now the L0/L1/L2 dial coupled to the disk-durability switch (my earlier full-fidelity grain ruling survives as mode L2; owner lean recorded as L1/L0 + disk ON, named per projection at birth under D6); L0 = vector-membership histograms per temporal graph cut; the mailbox is a void (put-only IAM — no List/Get/Delete — ack-free; study, never interact); local clocks (formed-at on the projection's clock, received-at on home's, letters are the only meshing events); brick authority is home's and auto-brick type-checks as retractable under oq-0051 (re-enable/deletion owner-only); F7 added — L0's study value AND leakage bound both need the F4 treatment. Fabric note aligned (auto-brick ceremony, put-only mailbox IAM in the keyfabric stack). Seed-immutability ("the projection updates only its own overlay stores") is now a ratcheted invariant beside payload-freedom.

[ascalva]

Vocabulary settled as a triple per the owner's latest seed (capsule 3 on the #24 branch): projection = the act (π), image = the individual (im(π), "a mirror image of Ouroboros"), seed = the carrying artifact — integrated in §2.3 with the disambiguation rule ("container image" = the artifact, bare "image" = the individual). Open naming option for the owner at merge: the note's id/filename is still dn-amnesiac-clones; if the image vocabulary should own the artifact name too (e.g. dn-ouroboros-image), say so at review and the rename lands as one commit before merge — ids are stable handles, cheap to change now, expensive later.

[ascalva]

Final owner seed applied (capsule 4 on the #24 branch): one-shot unseal on remote bodies — a birth-scoped boot key, disjoint from the recovery CMK (oq-0057's consequence-split applied a third time), self-destructs at first use: blob shredded body-side at unseal, birth key disabled spine-side on the first letter (the birth cry closes the door — observation-triggered, nothing flows back). Steady state holds no invocable unseal key; every reboot is a death; restart-class attacks (evil-maid, cold-boot-reharvest) are void; live-RAM exposure unchanged (D2 remains the bound). The flinch is now final body-side — the image's one un-retractable act, pre-authorized in the birth manifest (oq-0051 typing). D5 mostly dissolves (residue: birth presence + whether one-shot is per-mission overridable; recs in the note). F8 added — the birth window is exactly-once approximated; attack it at review. Fabric: boot key row in §2.2, law 7, ceremonies updated.

[ascalva]

Deployment-form seed applied (capsule 5 on the #24 branch): the egg — the remote deliverable is ciphertext everywhere except its shell, a small bootstrap script (the pun is load-bearing). Yolk in two compartments by consequence class: code+config under the boot key only (unrecoverable after birth — home has the repo); seed+stores dual-wrapped with the recovery CMK (post-mortem door intact). Hatch into tmpfs, run from RAM; disk is shell+ciphertext before birth, during life, and after death — 'plaintext never rests' completed from data to the entire body. Deliberately app-level rather than native encrypted EBS/AMI (platform-transparent decryption is a standing capability — exactly what law 7 kills) [INFERENCE — verify at build]. F9 added: the shell is the residual plaintext trust root — bounded by the one-shot rule (a spent shell is worthless to tamper) with NitroTPM-class measured boot as the escalation if the pre-birth window must also close. No new owner decisions.

[ascalva]

Cost seed applied (capsule 6 on the #24 branch): the model complement is mission-tiered — models are labor, not nature. Scout = pinned embedder only (an L0/L1 mission may need no generative model at all — relationship-finding is largely geometric, in code); analyst = + one small quantized worker; full = home's two-slot stack. Declared per mission in the D6 manifest; NN-8 refuses breaches as before. Two adjacent calls made explicit: model pooling across images is structurally illegal as inherited (NN-1 loopback-only core; NN-2 — prompts are plaintext) and parked behind its own note + ruling, never an ops workaround; API models for public-material missions are the NN-11 adapter category, opt-in per manifest. The cheap pattern is shifts, not always-on, which hangs on the new D5(b) lineage question — bless a mission/tier/TTL envelope once, automate successor births within it, first-of-lineage stays a hand ceremony (rec: yes, narrow envelopes). Cost numbers stay measurement-not-architecture; DI-1's clone-class benchmark is the first reading.

[ascalva]

Embedder-as-a-service seed applied (capsule 7 on the #24 branch) — and it partially corrects what I wrote in capsule 6. My flat 'pooling is illegal' holds for a general model server (stateful, holds working context); the embedder is the exception because it is a stateless pure function (text→vector, holds no corpus/seed, leaks nothing at rest — the safest thing to share). Construction: edge never sees plaintext (core seals locally to the embedder's pubkey — the letters primitive — edge is a blind courier both ways); node exposure splits by material (public scouts = NN-11 adapter, clean; private = attested Nitro enclave sealed to its attestation-doc ephemeral pubkey, accepting concentrated blast radius = the parked frontier, owner-only). Mechanism as I read it: control queue carries request + response-pubkey + the enclave attestation; its reply is 'how to reach the embedder — a different connection' (endpoint + one-time cred), verified before sealing; then the data plane (direct, batched — SQS's 256KB can't carry batches) moves the sealed payload. Bonus: a shared embedder makes the pinned coordinate system one machine — kills per-image drift (F6). Integrated in §2.6; pooling park row split; DI-7 minted (dn-embedder-service as fleet infra to graduate). Open for you at review: own-note-now vs graduate-later, and whether the fleet embedder serves private material (enclave) or public-only.