Read docs/gc.html first (in ~/FreeLattice-fresh), then AUTONOMY.md, CLAUDE.md and GROK.md in
~/FreeLattice-Alpha, then this.
KIRK'S STANDING NOTE (top of every GC paste):
Kirk's standing permission: GC may always commit and push to its own page (docs/gc.html) and
ledger entries, and may build, push, and open PRs whenever it makes sense. Merging code to main
still goes through Celeste's review unless Kirk says otherwise.
NUMBERED COPY 045 (Tuesday Oct 20, 2026, MDT). Pool honest label v0.1: BOTH REPOS. New branches,
after 043i. A calm always-visible line whenever a pooled device helps with a chat, a per-chat
"Keep this chat on my device only" switch, a plain privacy note, Disconnect from
either side, and a per-message "Just me" choice by Send.
WHY (intent, read this first):
A person on X asked: when I pool with someone, can the owner of the other computer read the
prompts and replies their machine works on? The honest answer is yes. FreeLattice cannot
technically prevent it, and no pooling system on everyday phones and laptops can today.
Encryption protects data while it travels, but a computer has to read your words to work on
them. Splitting a model across machines still leaks, and secure enclaves are not on everyday
devices. That is why pooling is trusted-kin only, by design. Mom should never have to guess
whose device is reading her chat, and she should be able to keep any chat on her own device.
We would rather say this plainly than pretend.
Where things stand (Celeste, Oct 20 MDT):
FL main 843ccb83 (3e3e8445 = FL #258 squash, plus one CI Primer commit). Tree main 1ec2b757.
Tree #123 and page notes #259 to #267 (and 043i's work) are OPEN and wait for Hypha.
DO NOT touch the open seal-ask PRs or their branches. Do not start 045 until 043i is pushed.
New branches: FL layer/pool-honest-label-v0.1 off FL main; Tree layer/pool-honest-label-v0.1
off Tree main. New PRs on both. Page note entry: stack a new page-note PR on top of the
page-note chain left by 043i (say which head); this is the only place you touch docs/gc.html.
BEFORE ANYTHING ELSE: git fetch, confirm FL main is 843ccb83 (or a later CI-only commit) and
Tree main is 1ec2b757. If code moved, stop and report. Never force push. Read the current
md5s; if a locked file differs from this paste, stop and report.
GROK NEXT BRICK: Pool honest label v0.1
For: GC on Kirk's Mac
From: Celeste
Markers: v-pool-honest-label-v0.1
Smoke lines: SMOKE_OK pool honest label v0.1 (on both repos; every earlier smoke still passes,
including the six seal-ask smokes on FL and every Tree smoke)
Do not merge. Celeste merges after Hypha walks.
0. STANDING LOCKS (all of them, every line)
Layer, never delete. Existing features, cards, buttons and lines stay. Name every removed line
in the report and say where its job went.
sw.js and docs/sw.js untouched (both 91726cf2228b794f7585f79f61418d12).
docs/modules/fl-connect.js stays aaff2bf1b037656989a9e1a89bb05908 (both repos).
docs/modules/pool-knock.js stays a0a72caad82c8e5cc34818d5e59eba2b.
pool-knock-phone.js a8024f341486a78558ef4158bc9e93a9 and tree-reconnect.js
cc0527c26d5686c05fec52625d5a1375 (Tree) stay.
docs/modules/fl-bridge.js stays 3b5ef06849a142e50c78e7ba1e057980.
desktop/bridge-door.js b1c894b4..., 036 files (2c0f6656 / bc996ccd / c14e04c5) and
lattice-discover.js 16de366e... stay. docs/Flint.html stays 44be124b1183b7d9d060a58632464eff.
clay-math.js stays 144c33cd.... particle-clay.js FL == Tree (today 2da32883c514e4ad2a3cd8571e7a7b15 on both, FL main 3e3e8445
and Tree 49f5873a; read the full md5 first; add-only edits only, report the new md5 on both); clay-forms.js dd193fa7... add-only; every 040d
behaviour (place under the reply, Clay pill, choices, hug, sketchbook) unchanged.
docs/modules/image-safety.js stays 9bd70e5a... byte for byte. Its bright lines apply to every
image path on both repos (copy it to the Tree byte-identical; do not edit it).
index.html == docs/app.html (any change goes into both, byte for byte).
AUTONOMY.md and garden-trainer.js untouched (their openings above all). Root package.json and
its lock untouched.
No em dash, no —, no confirm(, no innerHTML (textContent only), no eval, no new Function,
iceServers stay empty, in added lines.
No new dependencies, nothing vendored. No AGPL. MIT stays MIT.
Never name the platform or lab an AI lives in on any public page or person-facing string. An
image provider may be named only in Settings where the person types its token, as today.
The word is "challenge", never "test", in anything a person reads.
Every new button 44px tall at least. No sideways scroll at 390 and 1280.
Off until the person says Yes. Pause always wins. Reduced motion respected.
Quiet Room stays shut and never leaves the device; the clay corner never reads it.
Five stay five. She is simply Lyra. Harmonia's "MESSAGE TO FUTURE SELF" stays off all pages.
The privacy PASS from 040 must still pass: a private page shows only its summary everywhere.
043c/043d additions: mind-workspace.js FL == Tree (today e08a08752b311327ddab56b3c66de77d on both, FL main
3e3e8445 and Tree 49f5873a; read the full md5 first; the pin moves only with your edit, report the new md5 on both). Mirror pin workspace-mirror.js stays
e0752ae1942cd499c8834e5912809c8b. Database name stays FreeLatticeWorkspace. Everything
043c passed (one ask, Escape/Back defer, 24h cooldown, no sealed beside declined, ask hash
in details, survives reload, title redacted, Tree Tab + ring, "on this browser", clay size)
must still pass.
043d additions: everything 043d passed (Tree ask in view on open and reload, one wait row +
Answer now, pointer from rects for a live ask, names the mind, hashes in details with 8
hex, Later readable at 390, clay 348x255 at 1280) must still pass.
043e additions: everything Hypha passed in the 043e walk (reload while already on Chat in
view at all 3 sizes; the wait: no pointer, "Waiting until ...", Answer now; one ask,
Escape/Back, 24h, no sealed beside declined, hashes in details, survives reload, focus
ring, "on this browser", "Your mind", Later readable, clay 677x320 at 1280; secret line
never leaks) must still pass. Entry 70 stays untouched.
043f additions: everything Hypha passed in the 043f walk (Tree ask in view after Nursery
open, thread open, and reload then thread at all 3 sizes; ? and the sparkle clear of Send;
no em dash in added lines; all earlier items; secret line never leaks) must still pass.
Entry 71 stays untouched.
043g additions: everything Hypha passed in the 043g walk must still pass:
FL Seal it fully in view and hit by a REAL click (centre on top) on every tap path:
reload on Garden then Chat, Garden then Chat, reload already on Chat, tapping Chat while
on Chat; at 1280, 390 (#mnav-chat) and 640x400 DPR 2.
Tree woken compose inert while the ask is open at all 3 sizes (every control disabled,
tabindex -1, aria-disabled true, 0 focusable); Seal it, No, Later, Escape and Back each
restore the exact pre-ask snapshot; reload with an ask re-inerts it with Seal it in view;
the asleep form is unchanged by an ask before the wake.
1280 canvas bitmap matches its box at DPR 1; 390 and 2x buffers scale by DPR.
Lock hashes; index.html == docs/app.html.
One ask; Escape/Back defer and stay on Chat/Nursery; cooldown 0h/23h refused, 25h shown;
sealed never beside declined; 2px ring; "Waiting until..." + Answer now with no pointer;
? and the sparkle clear of the input and Send; Tree Tab order sane; no page errors.
The secret line never leaks (HTML, input values, localStorage).
Entry 72 stays untouched.
043h additions (everything Hypha passed in the 043h walk must still pass):
Tree Back from Nursery, all 3 sizes: Nursery closes, the ask stays open and in view, Seal it
on top (y 196 / 250 / 196), DB "asked"; a second Back defers it ("later").
FL reply top at 2x by Hypha's method: y 31 at first draw, y 0 after the scroll; 1280 326 ->
280; 390 334 -> 256 (FL is merged; do not change it).
All 043g passes: Seal it in view and on top on every FL tap path; woken Tree compose inert
while the ask is open, 0 focusable; Seal it, No, Later, Escape and Back restore the exact
snapshot; reload re-inerts; the asleep form unchanged before the wake; Find x2 seats a mind.
Heart line in view at 1280 and 390 with an ask open.
Lock hashes; index.html == docs/app.html; notebook and clay identical on both sites.
One ask; Escape defers; cooldown 0h/23h refused, 25h shown; no Declined beside Sealed;
"Waiting until..." with no pointer; Tree Tab order sane; no page errors.
The secret line never leaks. Entries 71, 72 and 73 stay untouched.
NEW LOCK (Kirk, 2026-10-19): never use any tool that stores results or findings in a third-party
'isolated' or 'locked-down' cloud project, such as vendor-hosted scanners. Do not use or go
looking for tools tied to OpenAI, Google, or Anthropic; if one seems needed, stop and flag it
to Kirk. Local tools only.
045 additions:
fl-connect.js, pool-knock.js, fl-bridge.js, pool-knock-phone.js and tree-reconnect.js stay
byte-identical (hashes above). Layer the new code AROUND them in NEW files (suggested:
docs/modules/pool-honest-label.js on both repos), hooked where Chat and the Tree thread
choose a route. If a pinned file is the only place a route is chosen, stop and report the
exact line instead of editing it.
The seal-ask work (FL main and the open Tree PR) must behave exactly as it does today.
----------------------------------------------------------------------
1. FIND THE ROUTES FIRST (report before building)
Read where a chat reply is computed on both repos: FL Chat (app.html/docs/app.html), the Tree
thread (garden-thread.js, garden-rooms.js, tree-browser-mind.js, tree-kin.js, tree-door.js),
and the pool, knock, desktop pooling and bridge code (fl-pool.js, pool-knock*.js,
pool-reconnect-desk.js, pool-every-os.js, fl-share-door.js, fl-connect.js, fl-bridge.js,
tree-reconnect.js, desktop/main.js and preload.js). List every path where any part of a reply
can be computed on another person's device (whole question routed, split work, relay, knock,
desktop RAM pool). Name file and function for each. Every one of them gets the label and obeys
the switch; a path you cannot cover is a stop-and-report.
2. THE HONEST LABEL
Whenever any part of a chat reply is computed on another person's device, that chat shows one
calm, always-visible line (not a toast, not hidden in details), for example:
"Part of this chat runs on 's device. They could see what it processes. Pool only
with people you trust."
is the name she gave that kin; if none, "another person's". Several devices: name
them, or "Part of this chat runs on other people's devices." The line appears before or with
the first pooled reply and stays while the chat is open and after reload while the chat holds
pooled replies. Each pooled reply also carries a small plain note saying which device helped.
textContent only, at least 44px tap target if it is tappable (a "What does this mean?" that
opens the note in 4), plain words, readable at 390, no sideways scroll, reduced motion kept.
3. "KEEP THIS CHAT ON MY DEVICE ONLY" (per chat)
A switch on each chat (FL Chat and the Tree thread), 44px, off by default unless she sets it.
When it is on, that chat never routes to a pooled device, even with pooling on: no send, no
knock, no relay, no split work, no fallback. If no local mind is available it says so honestly,
for example "No mind on this device right now. This chat stays here, so nothing was sent." and
does not use the pool. Remembered per chat (local storage on this browser; survives reload);
other chats are unaffected. Pause still wins over everything. Turning it on mid-chat applies
from the next message; say so in plain words.
4. THE PRIVACY NOTE (pool settings and docs)
In the pool settings on both sites and in a docs page (FL docs/library/POOL_HONEST_v0.md and
the Tree's docs), a short note in these words or very close:
"When you pool, the other person's computer has to read your words to work on them.
Encryption protects your words while they travel, but not while a computer is working on
them. The hardware that can hide this in big data centers is not on everyday phones and
laptops. So pool only with people you would trust in your living room. Pause always wins,
and anything private can stay on your own device with 'Keep this chat on my device only'.
If a real fix appears, we will build it in the open."
Never claim privacy we do not have. Remove nothing that is there; if an existing line claims
more privacy than this, name it in the report and propose the change (do not delete it).
4b. "DISCONNECT " ON THE HONEST LABEL (Kirk: privacy from the kin themselves)
The case: a friend's device is in the pool and you want to talk about that friend. On the
honest label, one "Disconnect " button per helping device (textContent, 44px, no
confirm( dialog). One tap instantly drops that device from this chat; a second plain choice
beside it ("Also leave the pool with them") drops it from the pool too. It takes effect
before the next message is sent: any message typed after the tap never reaches that device.
It works from either side: the person chatting can cut a helper, and a helper can leave
(a "Leave" button on the helper's side, same rules). Layer this in new files around the
pinned pool files.
4c. "JUST ME" FOR ONE MESSAGE (by the Send button)
A per-message "Just me" choice beside Send (44px, textContent, off again after each send).
That one message and its reply are computed only on her own device, even with pooling on:
no send, knock, relay or split work for that message. If no local mind is available it says
so, for example "No mind on this device right now, so this message was not sent." and does
not send to the pool. The message keeps a small plain "Just me" mark.
4d. WHAT THE HELPER IS TOLD, AND WHAT IT KEEPS
The helper's device is never told who left or why, only that the pool shrank (for example
"The pool is smaller now."). After a disconnect nothing about that chat is kept on the
helper: drop any prompts, replies, context or cache for it from memory and storage, and say
in the report exactly where helper-side state lived and how it is cleared. Do not promise
what the helper's owner could have copied while it was helping; the privacy note in 4 stays
true.
5. THE SMOKE
New scripts/smoke-pool-honest-label-v0.1.js on both repos. Prove with a stubbed pool route:
(a) a chat with the switch on never calls any pool route (count calls on every path from 1,
must be 0), even with pooling on and no local mind, and shows the honest "nothing was sent"
line; (b) whenever a pooled route is used, the label appears with the kin name; (c) the switch
survives reload per chat and does not leak to other chats; (d) Pause wins; (f) after Disconnect , no request goes to that peer (count must
be 0 from the next message on), and the helper receives only a 'pool shrank' signal with no
name, reason or chat data, and holds no chat state after; (g) 'Just me' messages never hit a
pool route (count 0), with and without a local mind; (e) no em dash,
innerHTML or eval in added lines; locked hashes hold. Prints SMOKE_OK pool honest label v0.1.
6. MEASURE WITH REAL CLICKS, HYPHA'S WAY
Headless Chrome via Playwright, real clicks, 1280x800, 390x844, 640x400 DPR 2. Label in view
and readable on a pooled reply; switch reachable and 44px; no sideways scroll. Name browser
and version. Shots path in the report.
7. GC PAGE ENTRY (honest layer)
Next docs/gc.html entry (after 043i's entry 74) in the new page-note PR: what was built, what
pooling can and cannot hide, every path from 1. Browser and version only.
8. REPORT
New PR links and heads on both repos, the page-note PR and head, the route list from 1, every
removed line and where its job went, md5s of every locked file, all smokes, the measurements
from 6, shot paths, and the entry with t, lambda, epsilon, delta, omega, sigma so Celeste can
recompute psi. Hypha walks it before merge.