From 022accfa7be6ffd75e668120914956a0a6473e55 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Sun, 5 Jul 2026 11:31:53 -0700 Subject: [PATCH] docs(proposals): note engine-imposed hide-existence consumer constraint (Worldtree #347) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Worldtree accepted the primitive as design item #347 (Worldtree-owned). Locked constraint: Heimdall-gated with hide-existence — ungranted tenants get 404 (not 403), no advertised capability. Ratatoskr consumer side must tolerate per-tenant absence: treat 404 as feature-absent -> graceful fallback, never capability-probe. --- docs/proposals/authored-message-injection.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/docs/proposals/authored-message-injection.md b/docs/proposals/authored-message-injection.md index c19280c..b56f677 100644 --- a/docs/proposals/authored-message-injection.md +++ b/docs/proposals/authored-message-injection.md @@ -154,6 +154,21 @@ in the web surface + debug seed in the CLI. We commit to validating the primitive — including the event-silence contract and the `seeded` phase — end-to-end against the reference planes. +## Consumer integration constraint (engine-imposed — Worldtree #347) + +The primitive is **Heimdall-gated with hide-existence** (a per-tenant policy +decision — some tenants are never granted it, not a rollout stage). Ratatoskr's +consumer side MUST tolerate per-tenant absence: + +- A granted tenant gets the sub-resource; an **ungranted tenant sees `404` (not + `403`)** — as if the feature never existed. +- Treat `404` on the authored-history-write sub-resource as **"feature absent + for this tenant"** → fall back gracefully (no authored first-message; the + model-generated greeting), never surface it as an error or "denied." +- **Do NOT capability-probe or advertise-detect** — the feature is deliberately + undiscoverable in `/capabilities` for ungranted tenants (same hide-existence + posture as the R27-V1A cross-owner pattern). + --- *This brief was cold-read-pressure-tested by a cross-frontier panel (Grok /