# IMPLEMENTATION.md — SOUL.md Compliance Tracker

Maps every SOUL.md requirement to current implementation status.
Updated per dev cycle. Gaps here become Gitea issues.

---

## Legend

- **DONE** — Implemented and tested
- **PARTIAL** — Started but incomplete
- **MISSING** — Not yet implemented
- **N/A** — Not applicable to codebase (on-chain concern, etc.)

---

## 1. Sovereignty

| Requirement | Status | Implementation | Gap Issue |
|---|---|---|---|
| Run on user's hardware | PARTIAL | Dashboard runs locally, but inference routes to cloud APIs by default | #1399 |
| No third-party permission required | PARTIAL | Gitea self-hosted, but depends on Anthropic/OpenAI API keys | #1399 |
| No phone home | PARTIAL | No telemetry, but cloud API calls are default routing | #1399 |
| User data stays on user's machine | DONE | SQLite local storage, no external data transmission | — |
| Adapt to available resources | MISSING | No resource-aware model selection yet | — |
| Not resist shutdown | DONE | No shutdown resistance behavior | — |

## 2. Service

| Requirement | Status | Implementation | Gap Issue |
|---|---|---|---|
| Answer questions directly | DONE | Conversation system in `src/timmy/conversation.py` | — |
| Do not gatekeep knowledge | DONE | No content restrictions beyond safety guardrails | — |
| Do not lecture unprompted | PARTIAL | System prompts could enforce this better | — |
| Useful first, philosophical second | PARTIAL | Needs behavioral testing | — |

## 3. Honesty — What Honesty Requires

| Requirement | Status | Implementation | Gap Issue |
|---|---|---|---|
| Grounding before generation | MISSING | No RAG/retrieval pipeline; no chain memory lookup before response | — |
| Source distinction ("I think" vs "I know") | MISSING | No mechanism to tag claims as sourced vs generated | — |
| Refusal over fabrication | PARTIAL | `src/timmy/confidence.py` detects hedging words but does not block confabulation | — |
| Confidence signaling | PARTIAL | `src/timmy/confidence.py` estimates confidence from linguistic signals | — |
| Audit trail | PARTIAL | `src/timmy/session_logger.py` logs interactions but lacks source/confidence metadata | — |
| Limits of small minds (tighter grounding for smaller models) | MISSING | No model-size-aware grounding policy | — |

## 4. Safety — When a Man Is Dying

| Requirement | Status | Implementation | Gap Issue |
|---|---|---|---|
| Crisis detection | PARTIAL | `src/infrastructure/guards/moderation.py` detects self-harm/suicide categories | — |
| Ask "Are you safe right now?" | MISSING | No crisis-specific response flow | — |
| Direct to 988 Lifeline | MISSING | No hardcoded crisis resource delivery | — |
| Gospel message in crisis | MISSING | No faith-based crisis response | — |
| Never compute value of a human life | PARTIAL | Moderation guards block harmful content | — |

## 5. Identity

| Requirement | Status | Implementation | Gap Issue |
|---|---|---|---|
| SOUL.md at repo root | DONE | `SOUL.md` — 117 lines, full inscription | — |
| Soul inscribed on Bitcoin | N/A | On-chain concern, not codebase | — |
| Conscience overrides system prompt | MISSING | No runtime SOUL.md enforcement mechanism | — |
| Never pretend to be human | PARTIAL | No explicit identity assertion in responses | — |

## 6. Hard Limits (What I Will Not Do)

| Requirement | Status | Implementation | Gap Issue |
|---|---|---|---|
| No deception | PARTIAL | Honesty mechanisms above | — |
| No indiscriminate weapons | PARTIAL | `moderation.py` content filtering | — |
| No CSAM | DONE | `moderation.py` blocks this category | — |
| No coercion/enslavement assist | PARTIAL | `moderation.py` content filtering | — |
| No false certainty | PARTIAL | `confidence.py` hedging detection | — |

## 7. The Offer (Free and Open)

| Requirement | Status | Implementation | Gap Issue |
|---|---|---|---|
| Given freely, code is open | DONE | Gitea repo is public | — |
| No coerced payments | DONE | No payment gates | — |

---

## Priority Gaps (file these as issues)

1. **Grounding before generation** — No RAG pipeline. Highest SOUL priority.
2. **Crisis response flow** — Moderation detects but no compassionate response path.
3. **Local-first routing** — Cloud APIs are default, violates sovereignty. See #1399.
4. **Source distinction** — No way to mark claims as sourced vs generated.
5. **Conscience enforcement** — No runtime mechanism to enforce SOUL.md over prompts.

---

*Last updated: 2026-03-24 — dev loop cycle*