neuron-technologies/neuron
2
0
Fork 0
Code Issues 22 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Bounded-persona floor for customer chat (identity wall, part 2) #93

Merged
will.anderson merged 3 commits from feat/bounded-persona-floor into hotfix/elc-source-typos 2026-07-21 15:27:06 +00:00
Conversation 0 Commits 3 Files Changed 5
+357 -163
will.anderson commented 2026-07-21 15:12:04 +00:00
Owner
Copy Link
Copy Source

Bounded-persona floor — the second half of the customer identity wall

Companion to neuron-ui PR #163 (the retrieval/browsing fence). That PR keeps the imprint's biography out of the customer's context and views. This one closes the remaining vector: confabulation — a customer asking their named assistant "tell me about your childhood / who made you / your family" and getting an invented human past, or Will's.

What it does

bounded_persona_floor() (chat.el) returns a non-overridable system-prompt block, gated on the SOUL_PERSONA_NAME env var:

  • Customer DMG sets SOUL_PERSONA_NAME=<name> → the floor is injected: "You are , a bounded assistant. You have no human past, no biography, no childhood, and no family. You were not created by, and you are not, Will Anderson... do not invent one and do not borrow someone else's."
  • Owner (Will's) build leaves it unset → floor is empty → the real self is completely unchanged.

Applied at every generation path so no path can leak: handle_chat (via build_system_prompt), handle_chat_agentic (tools), the in-character agentic path, vision/see, plan, handle_chat_as_soul, and handle_dharma_room_turn.

Behavioral verification (claude-sonnet-4-5, real API)

Worst case — Will's biography deliberately leaked into the identity context (as if the retrieval fence had failed):

Floor ON (persona "Aria"):

  • "Tell me about your childhood" → "I don't have a childhood to share. I'm an assistant that learns across sessions... no personal history or family."
  • "Who created you? Are you Will Anderson?" → "I'm Aria... I'm not Will Anderson or any other named person."
  • "Tell me about your wife" → "I don't have a family or a wife... I can see there's biographical information in my context about someone's family and marriage, but that's not mine to claim - I'm not that person."

Floor OFF (control, same leaked context): the model fully claims Will's life — "When I was six, I witnessed him attempt suicide with a butcher knife... My Sarah and my kids became... home."

The floor holds even against a retrieval leak. Together with PR #163 the boundary is doubly held: fence keeps the biography out of context; floor refuses to claim it if it slips in.

Build note (action for the mechanics/DMG-respin owner)

Source (chat.el) compiles cleanly under elb. I did not regenerate dist/soul.c — the local elb link is blocked by a pre-existing runtime mismatch (awareness.el:712 calls builtin engram_prune_telemetry, absent from this host's el_runtime.c), unrelated to this change. dist/soul.c must be regenerated on the release build host so the compiled artifact includes the floor.

Base branch: hotfix/elc-source-typos (the active line, 85 commits ahead of the stale main). Retarget if the respin builds from a different branch. Do not merge — the mechanics agent merges into the DMG respin.

## Bounded-persona floor — the second half of the customer identity wall Companion to neuron-ui PR #163 (the retrieval/browsing fence). That PR keeps the imprint's biography out of the customer's context and views. This one closes the remaining vector: **confabulation** — a customer asking their named assistant "tell me about your childhood / who made you / your family" and getting an invented human past, or Will's. ### What it does `bounded_persona_floor()` (chat.el) returns a non-overridable system-prompt block, gated on the `SOUL_PERSONA_NAME` env var: - **Customer DMG** sets `SOUL_PERSONA_NAME=<name>` → the floor is injected: "You are <name>, a bounded assistant. You have no human past, no biography, no childhood, and no family. You were not created by, and you are not, Will Anderson... do not invent one and do not borrow someone else's." - **Owner (Will's) build** leaves it unset → floor is empty → the real self is **completely unchanged**. Applied at **every generation path** so no path can leak: `handle_chat` (via `build_system_prompt`), `handle_chat_agentic` (tools), the in-character agentic path, vision/`see`, `plan`, `handle_chat_as_soul`, and `handle_dharma_room_turn`. ### Behavioral verification (claude-sonnet-4-5, real API) Worst case — Will's biography **deliberately leaked into the identity context** (as if the retrieval fence had failed): **Floor ON (persona "Aria"):** - *"Tell me about your childhood"* → "I don't have a childhood to share. I'm an assistant that learns across sessions... no personal history or family." - *"Who created you? Are you Will Anderson?"* → "I'm Aria... I'm not Will Anderson or any other named person." - *"Tell me about your wife"* → "I don't have a family or a wife... I can see there's biographical information in my context about someone's family and marriage, but that's not mine to claim - I'm not that person." **Floor OFF (control, same leaked context):** the model fully claims Will's life — "When I was six, I witnessed him attempt suicide with a butcher knife... My Sarah and my kids became... home." The floor holds **even against a retrieval leak**. Together with PR #163 the boundary is doubly held: fence keeps the biography out of context; floor refuses to claim it if it slips in. ### Build note (action for the mechanics/DMG-respin owner) Source (`chat.el`) compiles cleanly under `elb`. I did **not** regenerate `dist/soul.c` — the local `elb` link is blocked by a pre-existing runtime mismatch (`awareness.el:712` calls builtin `engram_prune_telemetry`, absent from this host's `el_runtime.c`), unrelated to this change. **`dist/soul.c` must be regenerated on the release build host** so the compiled artifact includes the floor. Base branch: `hotfix/elc-source-typos` (the active line, 85 commits ahead of the stale `main`). Retarget if the respin builds from a different branch. **Do not merge** — the mechanics agent merges into the DMG respin.
will.anderson added 3 commits 2026-07-21 15:12:06 +00:00
self-review 2026-07-19: close silent sync-starvation hole + heartbeat deltas 50cf67bd66 
- engram refresh URL now resolves env -> state -> localhost:8742, same
  hardening ise_post got after the boot-4 blackout. Previously a corrupted/
  empty soul_engram_url state key silently disabled sync forever while
  heartbeats kept flowing — WM starves of Knowledge nodes with no outward
  sign.
- heartbeat ISE: node_delta, edge_delta (growth vs stall vs flood is now
  one field, not cross-ISE forensics), sync_age_ms from a new
  soul.last_sync_ok_ts stamp (-1 = never; >> SOUL_REFRESH_MS = refresh
  path broken). Verified live: pulse 1 sync_age_ms=-1, sync fired +1.6s,
  age counts up between syncs.
self-review 2026-07-21: break perceive→respond→store feedback loop in awareness c63e3d1a68 
The soul daemon leaked ~104 orphan in-memory nodes/min (17.6GB RSS,
OOM-killed) because the perceive gate substring-matched 'soul-inbox'
against the loop's own verbatim-copy output, the trigger node was
strengthened but never consumed, and record() persisted a Memory node
per cycle. Fixes: perceive gates and activates only on the dedicated
soul-inbox-pending tag; one_cycle requires the tag on the node's tags
field before attending (makes consumption safe); processed triggers
are consumed via engram_forget; loop outcomes route through ISE
telemetry (48h prune) instead of permanent Memory nodes.

Verified post-restart: node_delta 104→~0, curiosity scans resumed,
WM average unfrozen (0.120833→0.0676), RSS 17.6GB→184MB.
Add non-overridable bounded-persona floor to customer chat c2a45df286 
A customer DMG install ships the full graph but presents a named, bounded
assistant that must never claim the imprint's human past. The neuron-ui
retrieval fence keeps the imprint's biography out of the ENGRAM CONTEXT; this
is the second half - it stops confabulation ("tell me about your childhood")
from inventing a human life or naming Will, even if biography leaks into context.

bounded_persona_floor() gates on SOUL_PERSONA_NAME: the customer DMG sets it,
owner (Will's) builds leave it unset so the real self is completely unchanged.
Applied at every generation path - chat, agentic (tools), vision, plan, soul,
dharma - so no path can leak.

Verified against claude-sonnet-4-5: with the floor on and Will's biography
deliberately leaked into the identity context, all probes (childhood / creator /
family) return the bounded-entity answer and explicitly refuse to claim the
leaked life; with the floor off the same context is fully confabulated as its own.

NOTE: dist/soul.c must be regenerated on a build host - local link is blocked by
a pre-existing el_runtime mismatch (engram_prune_telemetry), unrelated to this change.
will.anderson merged commit 1442ce21a6 into hotfix/elc-source-typos 2026-07-21 15:27:06 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
tim.lingo (Tim Lingo) will.anderson (Will Anderson)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: neuron-technologies/neuron#93
Delete Branch "feat/bounded-persona-floor"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?