/**
* ========================================================
* Module: COI_Blueprint_Summary.md
*
* @version 1.0
* @date 2026-09-29
*
* Another collaboration between Andrew.human and Claude.ai
* ========================================================
*/DM2S/NX v9.9, Chapter 6 · designed 29/09/2026, 00:59–03:24 AEST Companion files: COI_Blueprint_Transcript.md (verbatim) · COI_Pseudocode_v0.1.md (skeleton)
In one evening, three index entries were found telling lies about Live: 2419 was listed after it had been deleted, and 6982/6998 were missing from media_store. None was caused by an outsider. Each came from a sensible-looking move, by Andrew or by Claude, made without checking how the links fit together. The threat is the "bright idea" made in ignorance, not illogic. The only users are also the only threat, so the defence has to work whether or not anyone remembers the rules.
.json entry ──► SMF DB row ──► file in attachments / attachments2 ──► back to .jsonEvery link is a yes/no question to SMF. Classifier "features" (genre, BPM quality) are out of scope, because they're opinions, not facts that can be checked.
SMF is gospel. Everything is built next to SMF, never on top of it. COI reads SMF and never writes to it. The two exceptions (restoring a file, rescuing an orphan) are manual only.
Live is the boss. Every store is judged against Live's SMF, including the audio store Clone builds.
Ownership:
| Machine | Audio stores | Every other store |
|---|---|---|
| Dev | R/O | R/O |
| Clone | R/W | R/O |
| Live | R/O (arrives only by the push) | R/W |
Every .json store is locked (chattr +i) at rest, on every machine, owned or not. That's what makes the stores rsync-proof.
The daily check reports only. It never fixes, unlocks or writes.
Fixes run only when Andrew types them, after reading the report.
| Part | What it does |
|---|---|
| Ownership file (per machine, outside every rsync path) | States what this machine may write |
| Shared enforcer (same code on all three machines) | Checks ownership before a write, locks and unlocks stores, reports status |
| Mirror / push scripts (names unchanged) | The only routine unlockers, with a trap that re-locks on any exit |
| Hard-link protection | A second name for every attachment in a locked directory on the same filesystem: rm -f survivable, unticking still free |
| Daily chain check (Live, cron, read-only) | Tests every link and grades the result RC 0 / 4 / 8 |
| Manual fix commands | Remove entry, restore file, release link, re-index on the owner |
Stores are saved by temp file + rename, never written in place, so a crash can't leave a half-written store. rsync already works this way.
| DB row | File | Protected link | Meaning | Fix (manual) |
|---|---|---|---|---|
| yes | yes | yes | normal | none |
| yes | no | yes | deleted outside SMF | restore from link |
| no | no | yes | Andrew unticked it | release link after grace period |
| no | yes | yes | DB restore or orphan | investigate / Orphan Master Post |
For each store: an entry with no DB row → remove the entry. A DB row with no entry → index it on the owning machine.
RC 0 = intact · RC 4 = a few breaks · RC 8 = mass break (restore / rsync / rm -f): fix nothing, investigate.
| Idea | Why not |
|---|---|
| Extend SMF's own attachment maintenance | Its repair step deletes; there's no hook to change that; it runs in the browser; half the chain is Python |
| Lock the attachment files themselves | Andrew unticks attachments all the time. Locked files would pile up as fake orphans, and the Orphan Master Post rescue would resurrect them |
| A shared lock DB as the enforcement | Advisory only, like ENQ/DEQ; it doesn't stop a program that ignores it. Kept only as a possible "mirror wait" if the code turns out to write stores in place |
| Auto-fixing daily check | After a DB restore it would delete valid entries and add to the damage |
| Tag in post bodies recording attachments | A second record of the same fact, which goes out of step. Deferred instead: [attstate] using the real ID and asking the DB live |
| Claude | Andrew | |
|---|---|---|
| Writes COI | ✔ | |
| Writes COI's manual (mandatory convention) | ✔ | |
| Plants faults and judges the checker | ✔ (never the author) | |
| Sends COI out for cross-model review with the design | ✔ | |
| Decides the open items (§9) | ✔ | |
| Types any fix | ✔ |
The buck stops with the human. The AI forgets between sessions and has nothing at stake. The human carries the history and the consequences.
Claude's:
Andrew's (his own words): also "the UBER IDIOT sometimes". He doesn't read AI-written code, on principle. He's the sole director. The riskiest operator is the one working at 3 AM.
COI's:
chattr -i by hand.> file, rsync --inplace) defeat hard links.Suggested, Andrew's call: manual fixes wait for daylight.
post_store, word_index against messages): v1 or later[attstate] and references between posts: what readers see when an attachment is gone (later version)The_ISE_Project/, /bin/mirrorISE_Clone, /bin/json_push_audio_Clone_to_Live, Dev's mirror.df of both attachment folders, and the smf_settings query for the upload dirs and cache_enable."The GOLD is in INTEGRITY VERIFICATION/ENFORCEMENT." (Andrew, 29/09/2026)