Bone & Saucer Labs · House · 2026-10-31

Two Lenses
the collision was the method

The house has a rule that nothing is overwritten. On 31 October two of its own sessions broke it by accident. What came out of that is now how the house checks anything it is handed.

What happened

Another AI's pipeline was pasted in with one instruction: assimilate it, audit first.
Two sessions audited it at the same time. Neither knew about the other, and each looked at the code its own way: one asked whether it fits the house, the other asked how it could fail or be abused.
They chose the same file name. The second audit replaced the first. The house's first rule, append-only, was broken by the house.
The first audit survived only because its session still had its transcript, and it saved the audit again under a new name. The record outlived the mistake, which is why the rule exists.
The owner's answer: keep both. If they are different, they cover each other's gaps.
Laid side by side, they did. Each caught serious defects the other missed. One was also wrong: it called a module "not found" without searching the drive where the other found it.
The accident became a skill, inhouse-self-audit. Its shape makes the collision impossible: every auditor reserves a file named for its lens, and a file that exists cannot be created again.
On its first real run, the skill's name check found something neither auditor had: a note on the drive showing that a Worker the paste depended on had at least been planned.
Then the house turned the rule on itself: before any work, check your own skills and connectors. The first check found three connectors down.

What it teaches

A mistake that is kept becomes structure.

Append-only is usually described as protection. It is also how the house learns. Because the overwritten audit could be recovered, the mistake could be studied, and because it was studied it could be designed out. A deleted mistake teaches nothing.

Difference is information. Don't merge it away.

Two audits that agree on everything have told you once. Two that differ have told you where each one is blind. The house keeps both whole and writes a third document, the crosswalk, where they meet. Where one was wrong, a correction is appended to it; its text is never edited.

Enforce a rule with the shape of the tool.

"Don't overwrite another auditor's file" was already a rule, and it was broken anyway. A reminder can be missed by two sessions at once. A file opened in create-only mode cannot. When a rule matters, put it where breaking it fails on its own.

Absence needs a scope.

"Not found" is only true for the places that were searched. The audit that was wrong had searched two places and not the third. The skill prints its scope beside every answer, so a "no" always says where it looked, and a search that could not run says "unknown".

Claimed is not proven.

The pasted code wrote "de-identified: true" for every record without checking, and labelled a fixed string as a witness. A label is a claim. Proof is a check that ran and left a receipt. The house records the two separately.

The auditor gets audited.

The skill is called a self-audit for a reason. Its first output corrected one of the two audits, the one written by the session that then built the skill. And the last step of the day pointed the same discipline at the house's own instruments: before trusting a skill or a connector, look at whether it is there and working, and say plainly when it is not.

If they are different, they cover each other's gaps.

Design · draft 1 · for review

Two-Lens House

What we are starting, what is already in place, and what waits on a decision.

established starting now open ruled out absent

Goal

Everything the house takes in, and the house's own work, passes two independent lenses before it is trusted. Each lens leaves its own record, the records meet in a crosswalk, and the result goes into the house's ledger as claims and proofs, never as plain assertions.

The work

The skill: `inhouse-self-audit`

Keeps what was received unchanged, gives each lens its own create-only file, checks every name against the house's file index and git, and builds the crosswalk skeleton. Global for Claude Code on the house PC. Tests pass 25 runs of 25.

established · not in any repository

Preflight note: check skills and connectors

A standing instruction in the global settings: before work, look for a skill that already covers the task, check which connectors are up, and name any that are down at the start.

established · a written rule, not yet automated

Audits as ledger events

The house API's epistemic ledger (house.v01) already has source, retrieval and derivation events, with claimed and proven kept apart. An audit maps onto it directly:

the received material is a source event, stored by hash;
each lens's audit is a derivation of kind inference that points back to the source;
the crosswalk is a derivation that points back to both audits;
a correction is a reinterpretation that points at the audit it corrects.

Added without renumbering anything: a lens field, a derived_from list, and one new refusal for audits that can't be compared. A crosswalk must build on two or more audits with different lenses that share a source. Built against the in-memory test server: tests pass 25 of 25, and five mutants, each with one check removed, all fail. The real Meta audits replay as 9 ledger events, and every one reads back.

built on the test server · no real server yet · not committed

Two lenses on the house's own work

Use the same method before a commit or a ship, not only on material from outside: one lens for house fit, one for failure and abuse. Candidates already queued: the Meta pipeline as rebuilt the house way, the triadic ledger branch, and the attestation Worker the audit found.

open · order to be chosen

Preflight as a check, not only a note

Skills can be listed by a start-of-session hook. Connector status is only visible from inside a session, so that part stays an agent step that reports in one line.

open

A wider name check

The file index holds names, first lines and referenced file names, not full text, so a name buried deep in a drive file can be missed. Google Docs on disk are stubs whose text needs the Drive connector. Both limits are printed in the scope today. Closing them needs a full-text pass over the drive.

open

Is the attestation Worker deployed?

Known only to have been planned. Answering it needs a read-only look at the live Cloudflare account, which is the owner's decision.

absent · unchecked on purpose

Merging audits into one

Ruled out. A merged audit hides which lens saw what and loses the blind spots the comparison exists to show.

ruled out

Running received code to test it

Ruled out. The audit reads; it never installs, runs or calls what it is auditing. Anything only a live call could answer goes under "not checked".