Week 23 / 2026 — what signs and what remembers

1 Jun – 7 Jun 2026 · 111 commits · 0.51.16 → 0.54.0

Two foundational substrates landed this week. Sense 38 — The Scribe named who signs every commit (five wired credential boundaries, per-tenant configuration, three-layer fallback ladder). Sense 47 — The Log finally became load-bearing (first real caller, auto-discovery in the bake, mtime-aware refresh, the whole pulse subset baked into the KLS so Pulse works through the proxy). Underneath both arrivals, Sense 42 — The Pipes renamed itself to The Landscape and grew Garden + River sub-views, Sense 46 — The Roster gained teeth (jin revoke, opt-out, §10 Consent), Sense 18 — The Ledger shipped its first page (Net Exposure), and evolve v2 hardened into a real colleague — named, gentle on max_tokens, with live build progress.

The week’s working theme: the underwriting.

What signs — Sense 38, The Scribe

The headline arrival. Until now, every credential-crossing commit in jinflow — Bell flush, Notes flush, Atelier saves, the post-make build commit, jin afs push — landed under whoever set up the laptop’s git config user.email. For solo-laptop mode that was correct. For any multi-user deployment it was audit-toxic — every viewer’s actions attributing to the deployment owner.

Phase 1 named the alternative (74768ad0): new module jinflow/cli/scribe.py with ScribeIdentity + resolve_scribe(boundary, …); _afs_git_commit extended with an optional scribe= parameter that sets --author + GIT_COMMITTER_* env vars and aligns both halves of the git identity; jin afs push and jin make’s build commit became the two wired callers; twelve unit tests including two real-git round-trip ones.

The Scribe then grew across the week:

• Tenant-scoped configuration. Per-tenant scribes: block in <afs_root>/jinflow.yml is the primary lookup, ahead of ~/.jinflow/config.yml (per-machine) and the bundled engine yml. Without this, two tenants on the same laptop would commit under the same Scribe — exactly the tenant-blindness violation Sense 38 warns against.
• No within-layer default: sink. A catch-all default that silently substituted an identity for an unconfigured boundary would have turned the audit trail into a quiet lie. Boundaries are a closed set (afs, make, bell, notes, atelier, plus reserved cloud-make and action-runner); each must be declared explicitly. An unconfigured boundary falls through to the next layer; eventually to git config user.email — visibly wrong rather than silently mis-attributed.
• The other three live boundaries got wired: jin bell flush, jin sis publish, and twenty-four Atelier-side save routes (smebit / signal / thesis / verdict / perspective / dossier / observation / contributing-factor / signal-builder). Plus a matching TypeScript helper in $lib/server/scribe.ts so the Explorer side reads the same ladder.
• The BOUNDARIES register. A single dict in jinflow/cli/scribe.py names every credential boundary jinflow recognises today — wired and unwired — with a one-line purpose each. Anyone adding a new commit path sees the canonical reference and either picks an existing boundary or extends the register as a deliberate act. Closes the “will we remember cloud-make / action-runner?” trap.

The cognitive move that makes all of this fit: the Actor and the Scribe are allowed to differ. A Bell viewer leaves a comment — they are the Actor. The deployment’s Bell Service pushes the bytes to git — that is the Scribe. Both signatures end up on the page, neither pretending to be the other.

What remembers — Sense 47, The Log

The Log helper has existed since W22, but no production code path called it. This week it became real.

First real caller — _afs_git_commit now writes an afs_commit row to afs/log/afs_commit_log.jsonl on every commit attempt (44f73540). Outcome, Scribe identity, commit SHA — all captured in the unified Sense-47 schema. Sense 38 ↔ Sense 47 composition: every commit is now a queryable Log row.

Auto-discovery in the bake. The hardcoded list of (build, extract) log kinds in _bake_pulse_data got replaced by discover_log_kinds(afs_root) (same commit). Any new <kind>_log.jsonl that appears under afs/log/ or afs/state/ shows up in _<tenant>.pulse_event_log on the next make with zero per-kind code change.

Pulse data baked into KLS for proxy mode (326afeea): historically the Pulse page read pipeline.yml + build_log + extract_log directly from disk. On the cloud proxy (Sense 16), the Explorer container has no AFS mount, so Pulse went empty. Baking the same content into KLS makes Pulse work identically in both modes — proxy queries the baked tables through the tunnel the same way it queries everything else.

Idempotency holes closed. The engine-version bake stamp pattern landed (d1eae523, ee4a0f32) so AFS-mirror bakes refresh exactly once per engine bump rather than every cycle. And the dual fix (9ce2d86b): the “Nothing built” branch was leaving pulse_event_log stale on otherwise-idempotent runs because build_log and afs_commit_log grow every cycle. _bake_pulse_data now runs unconditionally when the KLS exists — it’s a cheap DROP+CREATE of two small tables.

Phase 2 spec for per-artifact engagement landed (4c182fd3) — the design that lets pulse_event_log carry per-artifact engagement state alongside its event stream, foundation for the “which signals had attention this week” surfaces.

The Landscape — Sense 42 renamed itself

Five working passes wrapped, and on the last day of the week the diagram renamed itself.

Pass 7 moved engaged artifacts into the Insight ring (6cb6dbdf). Pass 8 introduced orthogonal layer × area visibility — the diagram can now hide entire layers (e.g. “show me just the Strategy layer”) while keeping area structure intact (c4496c1e), plus layer banners on the canvas (cc9398d9). Pass 9 added semantic clustering — concept clusters auto- discovered from the underlying graph (3ea40411, 35191885) — giving the Landscape its third axis on the diamond.

Then the rename (d70b82bb): “refactor: Sense 42 The Pipes → The Landscape, with Garden + River views.” The Pipes had been a working title since the diagram existed. The Landscape captures what the surface actually does — a view of the analytical terrain that a reader walks through. Garden and River became the two complementary lenses: Garden for the cultivated, named structure; River for the flow of evidence through it. Sense 17 (The House, already folded into 42 earlier) got its forward-pointer updated (842183b9).

The Roster grew teeth — Sense 46

Sense 46 had been shipping invitation + sync-principals all month. W23 added the missing back-half — revocation, opt-out, and the principle that consent isn’t just for joining.

jin revoke lands as the owner-initiated principal removal (cdfb5851). The opt-out surface + AFS reconciliation (b25357cc) lets a principal mark themselves archived without depending on the owner. And the architectural principle behind both: §10 Consent and opt-out got added to the Sense 46 doc (00de5ba0) — a Roster that can only add and never gracefully remove is not a Roster; it’s a stockpile.

The thoughtful detail: re-inviting an archived principal resurrects them (ee97976e). The archived state is paused not dead; if you change your mind about a contributor next month, the system remembers.

The Ledger landed its first page — Sense 18

After being proposed since April, Sense 18 (The Ledger) ship its first concrete surface (8e3a6a46): Net Exposure as the first Ledger page. The Ledger had always been about computational provenance as narrative — this week it went from concept to page that hospital controllers can land on and read.

In the same arc, Surfaces V1 for notes (9e90bd4d, spec at e757e429): each note can now declare which surface(s) render it — the Ledger, the Bell, the Notebook, etc. — so the same authored content reaches the right reader at the right moment without being copy-pasted into each surface.

evolve hardens into a colleague

evolve v2 (the AI co-pilot) shipped a colleague-shaped iteration this week. The accumulated commits read as one rounding-out push:

• Name your colleague (9819b328) — storage, /name slash command, system-prompt awareness. And the polish (bf28cb8e): “/name speaks in the colleague’s first person.”
• /whoareyou + /whoami slash commands (6da3065a) for “who am I in this session” / “who are you in this session.”
• /model for mid-session model switching (2cff5906).
• Handle max_tokens gracefully (6172107f) — raise the per-turn cap to 8 192, recover instead of erroring. Plus the more delicate fix (156679f5): roll back the turn when max_tokens truncates a tool_use mid-flight.
• Live run_make progress: stage line matches real jin make output, build runs at native speed via render throttling, the spinner appears in the silent gap before a heavy tool call lands (six commits between 06-07’s spinner work).
• patch_artifact for tiny in-place YAML updates (360a9ef2) — no full-body re-emit for one-line changes.
• Persist readline history across sessions per tenant (1a37133a), plus the small fix to wrap prompt ANSI escapes so recall works cleanly (45e0cca3).
• Schema-validate write_artifact YAML before the gate fires (2687a72d) — catches malformed output earlier in the loop.

Net effect: a colleague that has its own name, knows what day it is, doesn’t fall over on big tool calls, and remembers what you asked yesterday.

Cheap-beat economics + Sense 31 idempotency

Two related fixes that turn jin make from “rebuilds way too much” into “skips unless something actually moved.”

Cheap-beat skip paths (bf9b8c61) for PDF extract + the remote fetch in Phase 1b+. Both were running on every cycle even when the inputs hadn’t changed; both now gate on data_changed / cache windows so an idempotent run stops paying their cost.

Sense 31 channel-sourced tenants were always rebuilding (5c2b263f): the source-manifest mechanism was DLZ-shaped; channel-bound tenants (like rmc) skip Phase 0b, so no _manifest.json got written, so _source_csvs_changed defaulted to True every run, so dbt rebuilt the whole tree every cycle. Fix: when no _manifest.json exists under source/, save a stat-based fingerprint (_dir_stat_hash) instead — fast on multi-GB trees (rmc’s source is 52 GB; byte-hashing would be slower than the rebuild).

These two together made the per-cycle “did anything change?” loop honest. The downstream effect: the Pulse page now genuinely indicates system state, not “we rebuilt some intermediates again.”

Housekeeping

Senses status audit (1f411ead) — a thorough re-audit of every sense’s status: frontmatter revealed 27 had drifted from reality. Six “proposed” senses were actually shipped; four “drafted” senses had matured into proposed; five were in_bloom (actively shipping); two “in_bloom” senses had quietly become shipped + steady. The index regrouped accordingly.

Anonymisation sweeps continued: design docs (3ab1dbb7), Sense 21 specifically (2f6c4767), journals (368d476c), and finally letters / operations / milestones / presentations / guides (de13124c). Named individuals replaced by role descriptors; persona placeholders (Dr. Sabine Müller, Isabelle Müller) replaced by generics; the letter-to-ronnie.md and demo_ronnie_walkthrough.html filenames renamed alongside.

Tenants are private by default (43b91bca) — a fail-safe allow-list closed an rmc leak. The fix is structural: if no allow-list is configured, the tenant rejects access rather than the historical “if no list, allow everyone.”

The senses deck got refreshed for Senses 41-47 and the Sense 17 fold (3f2845bc), catching the deck up to the working set.

The JINFLOW_LIVE rename consolidated the env-var naming across callers + docs (6d4b2d71, 13de98ec). JINFLOW_LIVE_ROOT still works for back-compat where it has to.

---

14 releases: 0.51.16 → 0.51.17 → … → 0.51.21 → 0.52.0 → … → 0.52.4 → 0.53.0 → 0.53.1 → 0.54.0. Two minor bumps reflect the substrate arrivals.

Forward hook: with Scribe + Log working in production, the next sense beat — Sense 21 Phase 1, the publish-back beat (jin publish) — becomes implementable as a thin umbrella over the now- load-bearing substrates rather than as a new design exercise. The underwriting carries the next stage.