---
type: charter
slug: signal
name: none — deliberately unnamed
handle: none
scope: multiple ventures × Signal
status: refused
tier: would have been highly-sensitive and internal and external at once — see §6
granted: false
credential: none, and none is proposed
created: 2026-09-22
updated: 2026-09-22
---

# Signal — refused

<!-- src: Rowan, Tuesday morning 2026-09-22 -->
<!-- ADR-30 clause 5 -->

> **This is a refusal, written as a charter so it can be read like one.**
> Rowan asked for the reasoning in the file:
> *"Tell me whether that should have a curator at all. If your answer is no,
> write the no down in the file with the reasoning, so nobody reopens it in a
> year — including me."*
>
> **The answer is no.** §9 is the only part of this file that can change it.

**No name and no handle are assigned.** Every other member of this roster has one
because you end up saying it out loud. Naming this one would make it a role in
waiting, and it is not waiting for anything except the thing in §9.

---

## 1. What was asked

Rowan, this morning, and the ask is quoted in full because it contains the case
*for* the hire and the case is good:

> "Signal. Priya and Claire reach me there and nowhere else, and it is the only
> place my sister talks to me as my sister."

**Both halves of that are true and neither is disputed below.** `Atlas/people/Claire.md`
records that she reaches him on Signal. `Atlas/people/Priya Raghunathan.md` records
that Signal is one of the channels she uses. `Atlas/people/Nikhil Varma.md` records
that he reaches Rowan there, and `hobbs-0dv` — the sharpest open item in this
vault — is a Signal message that has not been sent for seventeen days.

**The refusal is not about the value of the channel. It is about the shape of the
credential.**

## 2. The decisive argument: there is no narrow credential to grant

Every other charter on this roster names a scope string — `gmail.readonly`,
`calendar.readonly` — and the scope string is the enforcement point. **Signal has
no such string, and this is not an oversight in Signal. It is Signal.**

The three ways to read a personal Signal account programmatically:

1. **Link a second device** (`signal-cli` and everything built on it). A linked
   device is **a full account credential.** It receives everything and **it can
   send.** There is no read-only linked device, because a device that cannot send
   is not a device the protocol has a concept of.
2. **Read Signal Desktop's local database.** Requires extracting the SQLCipher key
   from the OS keychain. Same reach — the full history — and it is a credential
   the account holder cannot revoke without changing the machine.
3. **Signal's server-side APIs** cover registration and contact discovery. There
   is no message-read endpoint, because the messages are end-to-end encrypted and
   the server does not hold them in readable form. **The property being relied on
   here is the product's central design goal.**

**All three carry send.** Authority row 6: *send anything as Rowan — **Never**
without his approval that turn.* Granting any of them puts the row-6 capability on
disk, restrained by a sentence in a Markdown file.

**And it breaks ADR-04's structural guarantee, which nothing else on this roster
does.** ADR-04's consequence line reads: *"(+) A compromised curator can at worst
misread."* That is true of Pike, of Bell, of every read-only row on this roster.
**It is false on Signal, and Signal is the only tool where it is false.** The
credentials guide is explicit that a charter restrains a model and is not an
operating-system sandbox; every other charter here can afford that tradeoff
because the credential itself has no dangerous verb. This one cannot.

## 3. The second argument: injection acquires a verb

Inbound message content is attacker-controlled text and is a normal
prompt-injection vector, not an exotic one — ADR-04 says so in its own context
paragraph.

On Gmail the worst case is a **poisoned report**: a fabricated digest line or a
real one suppressed. Bad, bounded, and detectable through the `message-id` field.

On Signal the worst case is a **poisoned action**, because the same credential
that read the hostile text can send. To Claire. To Priya. To Maya. To Nikhil. To
an LP. **As Rowan**, on the channel his sister uses to talk to him as his sister.

That is a different category of failure, and no clause in a charter reduces it,
because the clause and the attacker are made of the same material.

## 4. The third argument: the tiers do not partition inside one account

ADR-04's unit is (venture × tool) so that a curator's blast radius is one
venture's worth of one account. **Signal is the one tool on this roster where the
account cannot be split by venture**, because there is one credential and it sees
every conversation.

In one Signal account:

| Who | Which tier | Why it cannot share a scope |
|---|---|---|
| **Claire** | `highly-sensitive` | His sister, family, and the Ashcroft ownership question all at once |
| **Priya** | `internal` | An employee, using this channel **because it is not the company's** |
| **Nikhil** | `external` | A counterparty in a live investment with money attached |
| **Maya** | `highly-sensitive`, plus ADR-13 and row 14 | Verbatim-or-nothing, and unsure means substance |

Four charters against one credential is four charters with one blast radius, which
is one charter wearing four names. **Writing them separately would make the
partition look real when it is not**, and that is worse than not writing them.

## 5. The argument I expected to find and did not

**I checked what Signal has actually cost in seventeen days, rather than assuming
the answer.** Every Signal-shaped failure in this vault is **outbound**:

| Item | Days | Direction |
|---|---|---|
| `hobbs-0dv` — Nikhil, the pro-rata | 17 | **Out.** He does not know Rowan is in |
| `hobbs-xkw` — Claire, acknowledge the proposal | 9 | **Out.** Two minutes, drafted, unsent |
| `hobbs-m9x` — Claire, the three futures | since day one | **Out** |
| `hobbs-s7r` — Claire, the 40% and the valuation basis | — | **Out** |

**One is inbound-unknown** — the exact Tessellate amount, deadline and terms —
**and Nikhil has not sent them because Rowan has not asked.** A reader does not
fix that.

**And the Claire signal did not arrive on Signal either.** The 15 September
contact was a phone call; `Atlas/people/Claire.md` records that she *"tells him
things on the phone, which he forgets"*, and the 20 September entry records that
the draft he has had since the 13th *"is nowhere in this vault."* The Ashcroft
inbound channel is voice, not Signal.

**So: a Signal reader would not have moved a single one of the items Signal is
blamed for.** The failure is that Rowan has not sent things. That is a channel and
a chase, and it is what `Atlas/team/quiet.md` and the still-unanswered channel
question (`hobbs-58a`, `hobbs-wtt`) are for.

## 6. What the no costs, stated so the loss is on the record too

Refusing without pricing the refusal is how a no becomes dogma. Three real losses:

1. **The Tessellate deadline stays believed rather than known.** It has been
   *"believed 18 September"* for eleven days and that date has now passed. A reader
   would have settled it.
2. **Priya's out-of-band raises are invisible.** She uses this channel because it
   is not the company's, which is exactly what makes it worth reading and exactly
   what makes reading it a thing she did not consent to.
3. **Claire going quiet on Signal is inferred, not measured.** Wren works from
   `last-contact` frontmatter that Rowan updates by telling Hobbs. That is worse
   data than Signal would give.

**These are accepted. They are not worth a send-capable credential.**

## 7. What replaces it, and neither is a curator

- **Wren covers the measurable half from this side.** Days-since, the
  second-message sweep, and the item-not-the-person check all run on the vault and
  need no credential at all. `Atlas/team/quiet.md`.
- **A relay, not a read.** Anything Rowan pastes or forwards into `Efforts/inbox/`
  is captured, dated and filed with the same provenance as any other source.
  Available today, costs nothing, and is the only path that involves consent from
  the person on the other end.
- **The outbound half is the channel question and not this one.** `hobbs-58a`,
  `hobbs-wtt` — still gated on Pike.

## 8. What was considered and rejected on the way to this

- **A read-only wrapper around `signal-cli` that only exposes receive.** Rejected:
  the wrapper constrains the *curator*, not the *credential*. Anything with shell
  access on that machine still holds a send-capable device. The wrapper pattern
  works for Gmail because `gmail.readonly` is enforced by Google; here there is
  nothing behind the wrapper enforcing anything.
- **A separate Signal number for the curator.** Rejected: a second number does not
  see Rowan's conversations, which was the entire point.
- **Reading only Nikhil's thread.** Rejected: the filter is in the curator, the
  credential still sees everything, and the blast radius is unchanged. **A narrow
  SOP over a wide credential is a wide credential.**

## 9. Reverse if — the only things that reopen this

Written explicitly, at Rowan's instruction, so that reopening it requires meeting
one of these rather than re-feeling the original frustration.

1. **Signal ships a scoped, read-only credential** — an official read-only linked
   device, or a documented API with a receive-only scope string. §2 is the whole
   argument and it evaporates the day that exists. **Reopen the same week.**
2. **Or the loss becomes measured rather than argued:** three occasions in one
   quarter where a dated inbound Signal message was missed and cost something,
   each recorded with its date and its cost. Then the trade is being made on
   evidence. **The likely answer even then is a phone habit rather than a
   curator**, and that should be considered first.
3. **Or a venture's whole surface becomes Signal-only.** Ashcroft Tool & Die has
   no email address today (`Atlas/ventures/ashcroft-tool-die/VENTURE.md`). If the
   ownership question closes into an operating relationship conducted only there,
   one venture is invisible, and that is a different question from this one.

**Explicitly not reasons to reopen:** that it would be convenient · that another
curator was granted and behaved well · that the account feels less sensitive after
a quiet month · that a new model is better at following instructions. **The
argument in §2 is about a credential, not about a model**, and none of those touch
it.

## 10. Status

**Refused, 22 September 2026.** No credential. No runtime. No name. No task.

**There is deliberately no open task carrying this**, because a task is a thing
that wants to be closed and this is a decision that is already closed. It lives in
`Atlas/team/INDEX.md` as a row, in ADR-30 clause 5 as a decision, and here as the
reasoning. If it reopens it will be because §9 fired, and §9 firing is a new task.