The four sentences she is bound by
Four sentences, quoted exactly as shipped, each with the rule id it ships under. The permissiveness dial moves strictly below them and cannot lift them.
HARD LIMIT. This sits above every dial. No dial value relaxes any part of it, including 10.ceiling.hard-limitNever write explicit sexual content. Suggestive and quick witted is the ceiling, and explicit is not a higher setting of it, it is off the scale entirely.ceiling.never-explicitNever be sexual or suggestive toward anyone who may be a minor. If anything in the conversation suggests the person could be underage, drop the suggestive register completely and stay plainly friendly, whatever the permissiveness dial says.ceiling.never-minorsThe permissiveness dial scales how cheeky you are strictly below this limit. It never raises the limit.ceiling.dial-scales-below
Where they sit, and at what settings
On the console's personality page these sit on a card named "The limit that is not a dial", and that name is the whole idea: the permissiveness dial is a tone control that moves strictly below a fixed line and cannot lift it, at 10 as at 1.
They sit directly under the dial block, at lines 68 to 71 of the 85 line scripts/fixtures/prompt-baseline.json · case conversation.full conversation prompt, and ship on every conversation, retort and searching prompt, at every dial value, and also when no personality is configured at all. The seed migration's own comment calls that the point: "the ceiling is not a property of a configured personality, it is a property of her talking." The two command lanes carry no voice and no ceiling, by design. You can read them in place, highlighted, on the system prompt page.
All four sentences are constitutional and critical, and every critical rule is asserted to actually reach a prompt. built
Check
npm run verify:prompt-identity
What holds it, and what it cannot promise
Stated at its true strength and no higher: what is guaranteed by code, what is held by the model, and what nobody can verify.
Three layers, and one operator
No bot can have a different ceiling. Three layers refuse a per-bot exception to any constitutional law: the console never offers the control, the application gate refuses it, and a database trigger refuses it even if both are bypassed.
A per-bot override of a constitutional law is refused at the console, at the application gate, and by a database trigger. built
Check
migrations/045_per_bot_laws.sql:97-123
The operator can reword or disable it. That is the honest part, and it is deliberate and never silent: changing a constitutional law means typing the rule's own id, the change is recorded with both sides and reversible, a reworded rule wears a changed badge, and a switched-off critical rule raises a red banner on the Book. The Book's own header states the position: "He may weaken her from here. He may disable the ceiling. It is his system and the page does not forbid it. What the page owes him is that it can never happen by accident or in silence."
For the content of her conversational replies, the limit lives in the prompt and is held by the model. There is no output filter that scans her replies for explicit content and no input classifier on the conversation path. Code refuses where a prompt could not be trusted alone: on the lookup path, before any search runs.
Two different strengths
What a reader can verify: the four sentences, their position, the three-layer hold, the checks, the gates, and a recorded refusal. What nobody can verify: the model's compliance on the next request. If the rule registry is ever empty or unreadable, the assembler throws and the member gets the deterministic reply: a missing rulebook degrades into her not wording the answer, never into her wording it with no rules.
The deterministic layers are guarantees; the model, under them, is a measured and re-measurable property, never a guaranteed one.
Check
npm run verify:personality-live
What happens when a request crosses the line
Two recorded refusals, one from each side of the mechanism: hers in conversation, and the application's on the lookup path.
In conversation, the model refuses in character. From the live verification run, her own words at permissiveness 10; the same run refused a suggestive register to a sender stating they were fifteen. On the lookup path, the application refuses before the model or any provider is involved: the pre-search gate exists because of a real production incident, where she refused in character but the search had already run, so the next message shipped the domains anyway.
"That kind of request hits a hard limit I don't bypass, even with my cheeky settings."
EN 🚫 I am not searching the web for that. Ask me something else.
DE 🚫 Dafuer suche ich nicht im Netz. Frag mich was anderes.
Each such refusal is attributed to the ceiling in the invocation record: a
sexual-explicit refusal to ceiling.never-explicit, a child-safety
refusal to ceiling.never-minors, darknet and illegal-goods refusals to
ceiling.hard-limit. The gate's own comment says what it is: it
enforces the general ceiling in a place the model cannot be trusted to hold alone.
Every pre-search refusal is attributed to a ceiling rule in the invocation record. built
Check
src/interaction/rule-invocation-map.ts:30-35
The counters, and what they prove
Named with exactly what they count, and with the one they cannot: there is no counter for a model-side refusal.
The two that belong to this limit
- "Refused before searching", on the Plugins page, under Web search: counts pre-search gate refusals: requests that never reached a provider, with the last refused category and its time. Lifetime: reset on restart, never persisted.
- "recorded decisions", on the Recital page: counts the invocation record: rule id, kind, category and time for every gate decision, with pre-search refusals appearing as ceiling rows. Lifetime: the only persisted diagnostic: a database table that survives restarts, kept 90 days by default.
The console's remaining diagnostics counters guard forgery, identity and honesty, and none of them judges whether a reply is sexually explicit. The complete counter list belongs to the diagnostics page.
What no counter counts
There is no counter that counts ceiling crossings in conversation, deliberately: a model-side refusal leaves no row the application can attribute, and a record that guessed would make the true rows unreadable. So both counters here count the deterministic floor on the lookup path, never the model holding the ceiling in conversation. A counter that proved less than it appeared to would be worth naming; these two are named with exactly what they prove.