Status: RESEARCH NOTE (pre-plan). Not a sprint. No code. Per docs/PROCESS.md §1.1, exploratory analysis lives in docs/research/ until committed to a sprint. Date: 2026-08-04 Origin: a vocabulary cleanup that turned out to be a design argument. Removing "keylogger" from a crate description forced the question of what the capability is, and the answer reframed the program: it is instrumentation, not security tooling. Intended output: a paper. This note is the pre-plan, not the paper.
---
Thesis
A host sensor that records observations and attributes cause afterward is a better instrument than one that classifies threats at detection time — and the discipline that makes it so is the scientific method, embedded in process policy rather than applied by judgment.
The naming follows from the design rather than decorating it: an instrument that records observables cannot honestly be named for a conclusion it does not draw.
---
What is novel (as opposed to restating the method)
1. Naming as an engineering control. Feature flags, symbol names, audit-event strings and crate descriptions are durable artifacts, read later, out of context, by readers who may be adversarial. Naming a capability for the accusation supplies the accusation. The sharp corollary: a euphemism wrapped around a covert capability is worse than the blunt word, because it reads as a cover story — so a rename is valid only when a build constraint makes it true. Naming becomes checkable, and therefore an engineering control rather than presentation.
The morphological mechanism. This is not a claim about taste. "Keylogger" is an agentive nominalization — key + log + -er. The -er suffix posits a doer, and a doer implies purpose; the intent is inside the word form before any sentence is built around it. "Raw input" is a bare noun phrase: data, no agent, no telos. The substitution therefore changes grammatical category, not register — which is why it does real work and a softer synonym would not.
The same structure governs surveillance versus observation: sur- + veiller is watching from above, so the power asymmetry sits in the morpheme rather than the connotation; observare is watching toward, keeping. The choice does not select a register, it selects who stands over whom.
The obvious objection, and the refinement it forces. "Input flight recorder" is also agentive — it carries the same -er. The distinction is the object of the agency: the recorder's object is the system it is part of. Agentive form is legitimate precisely when the agent and the recorded party coincide, which is claim 3's inversion restated at the level of word formation. This is what keeps the analysis falsifiable: it does not simply prefer the words we chose.
Why it matters operationally. The defensible form of the Whorf hypothesis is the weak one — language does not determine thought, but under low attention the morphology is the entire reading. A reader with no context, no time, and no stake runs on word-shape alone. That reader is exactly the adversarial reader the control is built for.
The etymological argument for the standard itself. Logos means both word and account / reason; naming and giving an account share one root. That is this note's standard restated: a term naming a checkable mechanism is an account, and a term naming an accusation is a verdict wearing a noun. "Can an account be given of this name" and "is this a name at all" turn out to be one test.
2. Anomaly attribution without presumed cause. A cat on the keyboard, an injected-input attack, a loose cable, a stuck key and an elbow produce the same observation: input whose cause is not yet attributed. The cat is a confounder in the precise sense — anomalous input correlates with attack and does not cause it. An instrument reporting "attack detected" when a cat crossed the keys is not cautious, it is wrong, and each such report costs credibility on the reports that matter. The claim to be tested: leaving cause open until evidence closes it yields measurably fewer false reports than threat-detection framing.
3. The inversion table as a definition. First-party recording differs from covert interception on four axes simultaneously — whose input, who benefits, consent of the recorded party, whether concealment is required. All four invert. A device allowlist that refuses unlisted devices makes the definition checkable rather than asserted, which is what distinguishes it from a claim of good intent.
4. Convergent evolution. The method's components were built here one at a time, for local reasons, before anything was called a method:
| Scientific method | Existing mechanism | |---|---| | Pre-registration | action_intent committed and hashed before the action; outcomes judged against a pre-commitment | | Falsifiability | Mutation-proof (HARVEST-PLAYBOOK §13.3) — delete the mechanism, a test must go red, or it is not built | | Observation before inference | cause: unexpected_physical_input — a slot attributed from evidence, not a label applied at detection | | Independent instruments | Three oracles (DOM, screenshot, input provenance); disagreement is flagged, not resolved by fiat | | Null result is a result | UNVERIFIED is first-class; the commit-msg hook stamps it rather than rounding to pass | | Chain of custody | WORM append-only; action_realized versions divergence instead of overwriting | | Direct observation over authority | The WORM bypass was proved by running it in a rollback transaction and observing — not by reading the SQL |
That convergence is itself the evidence for the thesis: the components were adopted because each solved a real failure, not because a method prescribed them.
---
What is missing
This note is currently an argument, not a result. It becomes a paper when:
1. The differential test produces numbers. Recall and precision of the masked detector measured against ground truth from the instrumented build (ADR 0028). Without this, the note asserts exactly what it says one should not assert. 2. Invariant 8 has a mechanism. The build check that fails when a distributable target resolves raw-capture, mutation-proven. Until then the central guarantee is a convention. 3. Claim 2 is tested rather than argued. False-report rate under observation-first framing versus threat-detection framing, on the same input corpus.
Writing it before these exist would be the failure the note is about.
---
Source material (dated, committed)
| Commit | Contribution | |---|---| | 28620750 | Vocabulary: mechanism over posture; drops stealth/evasion | | 436c56d8 | Route exposure matrix — exposure as a measured surface | | ccefd408 | ADR 0028 — input flight recorder, two-build contract, inversion table | | 7902a0e5 | The naming defect in published crate metadata, and the fix | | b4e8b8dd | "Raw input" as the platform vendors' interface name (Win32, XInput2, evdev) | | 40476d3b | Instrumentation, not intrusion detection — the cat argument |
Design context: docs/architecture/adr/0028-input-flight-recorder-and-the-two-build-contract.md, docs/proposals/desktop-actuation/spec.md, docs/research/red-lab.md.
---
Open questions
- Is claim 2 measurable without a labelled anomaly corpus? Building one may be the first task.
- Does the inversion table generalize past input recording — to screen, audio, camera?
- Where does the argument stop applying? A capability with no first-party framing available
presumably cannot be renamed into legitimacy, which is the boundary that makes claim 1 falsifiable.