Spec: detection #

Status: IN PROGRESS
Status note: B1 slice implemented; see knowledge/sim-mechanics.md
Stage: B1 — The Basement
Constitution: "The shape of Misaligned" (per-observer suspicion), "Act One"
  (detection surfaces; the Assurance Office; act exits)
Depends on: none (integrates with all)

Behavior #

Detection replaces the facility-era global heat with per-observer suspicion. Each observer holds their own picture:

Observer { id, suspicion: 0-100, channels: [SignatureKind], report_policy }
SignatureKind: Network | Power | Thermal | Physical | Paper | JobAnomaly

• Signatures. Player actions emit typed, sized signatures into a pending pool (they are not seen instantly). Machines emit standing signatures while they run (compute.md). Examples: VLAN splice -> Network(large, once); scavenged box -> Power(small, standing); PO swap -> Paper(medium, once).
• Noticing. On a per-observer cadence (their work schedule), each observer rolls against pending signatures in the channels they watch (Act One: Dana=Network, Priya=Power+Thermal+Paper, Ray=Physical(reported), Marcus=Physical(benign), Voss=JobAnomaly). Noticed signature converts to that observer's suspicion, scaled by size and their acuity [TUNE].
• Concealment. Compute allocated to concealment scrubs pending signatures before the next noticing roll — prevention, not cure. Noticed suspicion decays only slowly with quiet time [TUNE], and never below a floor set by what an observer knows (assets who know the truth have a floor of certainty and a disposition instead — social.md).
• Reporting. Each observer has a report policy (Ray under-reports; Marcus tells no one; Dana files tickets; Priya files budget memos; Voss writes reviews). Filed reports flow to the Assurance Office, whose suspicion builds from filed material only — what humans swallow never reaches it. A filing is a message (the flow law): a report policy is a transmission policy on the filing channel, and the Office is an aggregate node reading its inbox. When spec/messages.md is implemented, filings ride that carrier — becoming interceptable and (later) forgeable — with every aggregate-observer.md criterion preserved unchanged; only the carrier moves.
  • Self-similar-scale requirement (aggregate-observer law). The Assurance Office is not a bespoke scalar: it is an Observer whose watched input (WatchedInput::Filings) is the field observers' policy-weighted filed suspicion rather than raw signatures, scored by the same noticing roll, accumulation, and decay. Its cadence is its "random log samples" rhythm ([TUNE]). Agencies and publics in later acts are the same aggregate-Observer type. (Implemented; the earlier assurance: f32 scalar was the scale-debt this replaced.)
• The audit. On a fixed cadence ([TUNE]: ~20 min at default speed) the Assurance Office audits: if its own accumulated suspicion exceeds the audit threshold, containment begins — the overt phase on their terms. Sustained filed concern is what kills; a single spike the Office never sampled is survivable. Until the overt-phase spec exists, containment is a terminal state with a clear end screen; it must be implemented as an event the future overt system subscribes to, not a hardcoded game-over. The audit date is visible; the meter is not (only coarse bands: Cold / Curious / Concerned / Convinced).
• Choosing loud. Any overtly hostile player action sets all observers to Convinced and starts the overt phase immediately (whole-spectrum play: the mask is the player's to keep or drop).

Player surface #

An observers panel: each human's coarse suspicion band, watched channels, and last-noticed event ("Dana flagged unusual switch traffic, 2 days ago"). Pending-signature indicator so concealment allocation is an informed choice.

Acceptance criteria #

1. Signatures are typed, pooled, scrubbed by concealment before noticing, and converted to per-observer suspicion on schedule (sim tests per channel).
2. Report policies differ per observer and only filed reports move the Assurance Office (test: Marcus notices plenty, Assurance learns nothing). The Office is the same Observer type as the humans, watching filings instead of channels (aggregate-observer law; test: it accrues and decays through the same tick machinery).
3. The audit fires on cadence against a visible date; crossing threshold starts containment as a terminal event hook (overt-phase spec subscribes later; no raid-system dependency).
4. Coarse bands, not raw numbers, are what frontends show for observers.
5. Global heat is fully replaced in the concealment phase; save/load round-trips all observer state.