Agents and authority

Implementation observation: 2026-09-08. This is a source reading of the extension loaded by .omp/settings.json, not a measurement of a live run, candidate, proof, or exported snapshot. A snapshot’s own generatedAt is an export timestamp and must be read separately.

Authorized browser human-decision channel — 2026-09-08

This authorized policy amendment adds a second live-human arena channel; it is not a claim that the browser path has been runtime-verified. An independently Authelia-authenticated person may start /loom bridge and use the visual workspace while the bridge is running. It is off otherwise.

• The browser may request only shortlist, unshortlist, reject, restore, promote_champion, and undo. Every non-undo request remains bound to the authenticated human, explicit confirmation, exact 64-hex candidate hash, expected current revision, and the extension’s single-use action-and-subject-bound authorization.
• The browser may never approve, release, install an advisor, override a deterministic blocker, create or forge an authorization nonce, impersonate an identity, or carry arbitrary command, prompt, tool, shell, path, or SVG input.
• The root browser/server code only renders sanitized exported gallery artifacts and proxies the narrow contract. It neither reads .iconloom/** nor writes ledger state; the extension alone invokes typed applyArenaDecision, preserves append-only hash-chained human events, and re-exports the snapshot.
• Approval and release stay in typed TUI gates. Deterministic blockers remain an absolute veto, and immutable lineage, canonical exact-hash binding, and stale-revision refusal remain unchanged.

Iconloom separates planning, construction, and critique so one model role does not both construct and judge the same proposal. The three shipped personas are non-recursive (spawns: []) and receive named tools rather than generic filesystem, shell, browser, or task access. Source: .omp/settings.json:1-5; iconomatix-extracted/iconomix/iconloom-1.0.0/iconloom-1.0.0/docs/AGENTS.md:1-14.

flowchart LR
  A["Frozen run context"] --> B["Strategist: lane plans"]
  B --> C["Builders: one SVG per lane"]
  C --> D["Canonical bytes, proofs, validation"]
  D --> E["Critic: inferred findings"]
  D --> H["Live human arena"]
  E --> H
  H --> I["Human decision record"]

The three roles

Persona	Permitted work	Must stop before
iconloom-v1-strategist	Reads the frozen context and returns one materially distinct, set-aware lane plan for each requested lane. A plan declares metaphor, silhouette, topology, negative space, detail budget, relation to the set, and primary risk.	Generating or submitting SVG; reading sibling drafts; changing state; inferring preference; recommending approval; expanding the budget. Conflicts or locked-trait failures return as unresolved questions.
iconloom-v1-builder	Constructs exactly one static restricted-profile SVG for its assigned lane and submits it through iconloom_submit. It checks the frozen run, lane, lease, parents, contract, and next attempt; refinement preserves the stated allowlist and a mix is resynthesized from explicit traits.	Direct file writes; shell or browser use; sibling-draft inspection; shortlist, rejection, promotion, blocker override, approval, or release. A successful validator result is not a design decision.
iconloom-v1-critic	After deterministic proofs exist, inspects the returned exact native-size proofs with the contract, anchors, confusables, and measured findings. It can record a new, concrete inferred finding tied to a candidate hash, observation, smallest useful delta, evaluator, and confidence.	Editing SVG or state; duplicating validator output; turning a model impression into a score or provider cue; concealing disagreement; recommending approval.

The exact persona grants are deliberately narrower than their prose mandates: strategist = read, iconloom_context; builder = read, iconloom_context, iconloom_submit; critic = read, iconloom_context, iconloom_record_finding. Source: iconomatix-extracted/iconomix/iconloom-1.0.0/iconloom-1.0.0/agents/iconloom-v1-strategist.md:2-8,54-74; iconomatix-extracted/iconomix/iconloom-1.0.0/iconloom-1.0.0/agents/iconloom-v1-builder.md:2-8,26-54; iconomatix-extracted/iconomix/iconloom-1.0.0/iconloom-1.0.0/agents/iconloom-v1-critic.md:2-8,30-49.

What the tools permit

There are exactly three model-callable Iconloom tools:

• iconloom_context reads the current frozen run summary, contracts, candidate hashes, validation summaries and, for a selected candidate, its bound evidence. It is the source of live run values; a model does not reconstruct a write payload from ledger files.
• iconloom_submit is one bounded model mutation: a lane plan and SVG enter server-side parsing, canonicalization, proofing, validation, deduplication, immutable storage, and run advancement.
• iconloom_record_finding is the other bounded mutation: it stores advisory evidence stamped inferred. It cannot create a measured or human finding, nor a blocker.

The extension marks the two mutation tools as computation writes, but a generic tool approval is never artistic, blocker-override, approval, or release consent. There is intentionally no model-callable validate, prove, shortlist, reject, champion, override, approve, undo, or release tool. Source: iconomatix-extracted/iconomix/iconloom-1.0.0/iconloom-1.0.0/docs/AGENTS.md:33-49; iconomatix-extracted/iconomix/iconloom-1.0.0/iconloom-1.0.0/src/extension.ts:1010-1138; iconomatix-extracted/iconomix/iconloom-1.0.0/iconloom-1.0.0/docs/TRUST.md:45-66.

Controlled handoff, not delegated choice

The extension’s run choreography is a result barrier, not a voting workflow:

1. A frozen run exposes its context to one strategist.
2. A complete conforming lane plan is required before one builder is dispatched per lane; each builder receives its plan inline, not through an unresolved agent handle.
3. Builders return candidate hashes after the bounded submission path. Once valid submissions settle, an optional critic can add only inferred evidence.
4. The resulting slate, its deterministic findings, and unresolved trade-offs reach the live human arena. An accepted hash is a candidate identity, never a shortlist or approval.

This arrangement prevents a strategist result from being mistaken for a builder input and prevents a model from turning evidence into a human decision. Source: iconomatix-extracted/iconomix/iconloom-1.0.0/iconloom-1.0.0/src/extension.ts:223-244.

Human authority is enforced state transition

• The live extension/TUI may create arena decisions, approval, release, advisor-install, and undo. The separately authenticated browser bridge may create only shortlist, unshortlist, reject, restore, champion promotion, and undo; it never opens approval, release, advisor installation, or blocker override. Every permitted transition remains human-authorized, single-use, action-and-subject-bound, short lived, exact-hash-bound for a candidate, and revision-checked. A stale revision, expired token, missing identity, or mismatched subject rejects the change. The extension—not root web code—applies the typed arena transition. TUI-only approval and release retain typed confirmation. Source for the continuing core authorization/decision invariants: iconomatix-extracted/iconomix/iconloom-1.0.0/iconloom-1.0.0/src/tui/human-gate.ts:4-51,59-118; iconomatix-extracted/iconomix/iconloom-1.0.0/iconloom-1.0.0/src/core/decisions.ts:159-273.
• The current implementation does not provide a successful deterministic-blocker override path. Although the interface exposes an override action, its core verifies blockers and then throws; a blocker cannot be made acceptable by a model or a human. Source: iconomatix-extracted/iconomix/iconloom-1.0.0/iconloom-1.0.0/src/core/decisions.ts:277-304.
• Approval binds the exact champion bytes to the profile, Constitution, icon contract, set state, decision head, validation report, proof manifest and recipe. A changed binding makes approval stale. Source: iconomatix-extracted/iconomix/iconloom-1.0.0/iconloom-1.0.0/src/core/decisions.ts:327-456.

Related: index, commands, svg-and-evidence, search-and-decisions, sets-and-state, architecture.