The signature trick: five characters that end session blur

The blur problem

Parallel sessions are anonymous by default.

The harness hands each one an ID at boot, and then nothing surfaces it anywhere you actually look. Every terminal pane shows the same shape.

Every file that lands on disk carries no mark of which session made it.

Anonymous sessions make anonymous artifacts, and once an artifact leaves the session, its provenance is gossip.

You either remember which pane produced it, or you dig.

The count, from my own week:

twelve sessions ran in parallel last week.

Builds, audits, research legs, a render pipeline.

Today I can tell zero of them apart by looking at their output.

Three days after the fact, a handoff doc asked the only question that mattered, which session wrote this, and answering it cost an hour of archaeology through git logs and file timestamps.

That hour is the tax, and it recurs every time you add a session.

-----------------------------------------------------------------------------------------------------------------------------------------------------------

The signature trick

The fix starts from a fact that is easy to miss: every session already has a unique ID. A UUID, a slug, a key the harness assigned at boot.

You do not need to invent identity. You need to surface it.

The method:

1. Take the session key, append a fixed salt, and run it through SHA-256.

2. Read the digest in Crockford base32, an alphabet that drops I, L, O, and U so no character misreads as another and no code accidentally spells a word.

3. Keep five characters. Twenty-five bits, about 33 million codes. Collision odds across one hundred live sessions: roughly 0.015 percent.

The result is a code like `tm:31T2J`. Deterministic. Same session key, same five characters, on any machine, forever.

Before: two terminal panes, both titled "session", both indistinguishable. After: pane one reads `tm:31T2J`, pane two reads `tm:K7QX2`. The question "which one is doing the render" stops being memory work and becomes a glance.

-----------------------------------------------------------------------------------------------------------------------------------------------------------

The peripheral channel

Five characters is still text, and text costs attention.

Reading a code is foveal work: you stop, fixate, parse.

So the same digest drives a second rendering, an 8 by 8 dot grid where the hash places between 12 and 18 dots. Different session, different constellation.

Same session, identical constellation, every time.

The reason for the grid is that pattern recognition is peripheral work.

Your visual system flags same-or-different before you have decided to look.

Twelve panes on a screen and your eye catches the odd grid out without a single act of reading.

The code is what you type into a search box.

The grid is what your eye catches first. Both come from the same digest, so they never disagree.

-----------------------------------------------------------------------------------------------------------------------------------------------------------

The stamping contract

A sigil only works if every artifact wears it.

Here is the part that matters more than the software: the contract is behavioral, not technical.

No daemon watches your sessions. Nothing intercepts your saves.

Three rules, kept by the operator and the agent together:

1. Mint on start. Every session gets its mark at boot, before the first artifact exists. A session that mints late has already shipped anonymous work.

2. Stamp artifacts. Anything meant to outlive the session carries the mark. Specs, handoffs, plans, publishable drafts. Ephemeral scrollback can stay anonymous; deliverables cannot.

3. Scrub before publish. Public output gets checked. The mark is for your trail, not for leaking your session graph to strangers.

The tool is one command per rule: mint, stamp, verify, scrub-check.

A pipeline gate is a single exit code.

The protocol is the product; the script just makes keeping it cheaper than breaking it.

-----------------------------------------------------------------------------------------------------------------------------------------------------------

The packaging discipline

The order of operations is the lesson here.

The distribution zip was hardened before a single word of content was written.

Then the install was dogfooded on my own machine. Only then did the writing start.

The hardening had two layers, and the gap between them is the teachable part.

A token grep catches strings: paths, names, key patterns. It cannot catch a semantic fingerprint, text that names no secret yet describes something identifiable to anyone who knows the private context. The adversarial scrub, run with that context in hand, caught internal lineage vocabulary sitting in the public build, worker-lineage terms that every regex had called clean.

The build now strips them at build time, mechanically, every time. Both layers ship in the box.

Only one of them would have been enough, and it is not the one most people reach for.

That is the discipline worth copying even if you never touch the tool: harden the artifact first, prove it on your own machine second, talk about it third.

Mark the session. Stamp the artifact. Trust the trail.

The deep dive, with the mechanism and the download, is here: https://aris-space.com/documents/workflows/touchmark

//A<3

1 comment

The signature trick: five characters that end session blur