kyle/boxmaker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

M5c-1 plan: README, tasks 07 to 15, the owner's decisions, the known flaky test; M5b finding 8 closed

Browse Source 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kyle
2026-09-28 10:00:59 -07:00
co-authored by Claude Opus 5.5
parent d8952ca77d
commit 027146f359
2 changed files with 60 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/implementer-log.md
+1 -1
View File
@@ -852,7 +852,7 @@ pinned false positive.
| 5 | nit | Ornith (task 14), plan | The log row was named `M5b/14-runbook-sanitizer-rules`, from the task's heading, so `run-plan.sh` stopped on a finished task. | Row corrected; tip T47 |
| 6 | nit | Ornith (task 10) | The row gives one gate run and a first pass; its notes say the first run failed on six clippy warnings. | Noted here |
| 7 | medium | the run, not the code | Task 10 ran past the 90-minute limit, and `RESUME` resumes only a session that ended by itself, so the run stopped; the owner resumed it by hand. Global OpenCode plugins loaded into every session: one rewrote the system prompt every fourth request, forcing full re-reads (tasks 01 to 10: prompt reads of 10,000 tokens or more took 76 of 111 minutes of prompt processing). | Plugins removed (owner, 2026-09-27); tip T48; `run-plan.sh` to pass `--pure` and resume after the limit |
| 8 | low | tests (M4b) | `brokerd`'s `a_torn_tail_is_recovered_and_it_serves` failed once under full load (task 07's first gate) and passed alone. | Open |
| 8 | low | tests (M4b) | `brokerd`'s `a_torn_tail_is_recovered_and_it_serves` failed once under full load (task 07's first gate) and passed alone. | Closed by M5c-1 task 05 (`05-brokerd-state-socket.md`, "Why a new `tests/serve.rs`"): the test waited for the sockets to accept, before `brokerd` had printed the notices it looks for; it now also waits for the admin socket's answer, which comes after them. 0 failures in 20 runs under full load on talos, 2026-09-28. |
| 10 | high (for the device) | plan (task 08; the reference too) | The self-test asked `/tokenize` about each tag and each neutralised form, 66 requests, one connection each, and `inferproxy` allows a burst of ten (M2a spec): on straylight the ninth tag request was refused and `loopd` would not start. Every given test talks to a fake server directly, with no `inferproxy`. | Review: two requests, all the tags at once, then all the forms (spec 8, runbook, `selftest_tags.rs`); tip T49 |
| 9 | low | tests (M2b) | `loopd`'s `serve_refuses_to_start_when_the_self_test_fails` and `a_failed_self_test_names_its_entry` wait on the process with no deadline; a `serve` that skipped the self-test would hang the gate (found while writing task 08). | Open |
docs/plans/M5c1/README.md
+59 -20
View File
@@ -14,7 +14,7 @@ the question on a new socket; `memoryd` gains a `honcho` module (configuration,
`roncho` clients, a sync worker, mirrored memory writes) and `bxctl memory sync` shows its state.
**Tech stack:** Rust 1.98, edition 2024; `roncho` 1.0.0 (`default-features = false, features =
["blocking"]`), added by the design model in task 00; no other new crate.
["tls"]`, which brings `blocking`), added by the design model in task 00; no other new crate.
**Spec:** `docs/specs/2026-09-27-m5c-honcho.md` (approved 2026-09-27), sections 3 to 7 and 10 to
13. The read path (`recall` over the fleet, `ask_memory`) is M5c-2, a later plan.
@@ -34,27 +34,35 @@ the question on a new socket; `memoryd` gains a `honcho` module (configuration,
lesson from M5b: the gate needs the entry with the pointer).
- Commit trailer from the driver; gate with a 600000 ms timeout.
## Tasks (outline, for the owner's review)
## Tasks
| # | Delivers | Crates |
|---|---|---|
| 00 | (the design model, before the run) `roncho` added: workspace dependency, `docs/dependencies.md`, `docs/egress.md` (rift), `cargo deny`, the Nix build on straylight; saved Honcho responses for the fake server (below) | all |
| 01 | Wire: `Turn.speaker`, `LogRecord::User.speaker` (optional, absent in old logs), `SessionUpdated.turn`, `SessionState` → `SessionStateReply`; fixtures | bxcore |
| 02 | `loopd` logs the speaker on the `User` record and sends the turn number in `SessionUpdated` | loopd |
| 03 | `gatewayd` sets the speaker: the Mattermost username when every post of the burst is from one person, else none | gatewayd |
| 04 | `bxctl chat --speaker NAME`, opt-in, no default | bxctl |
| 05 | `brokerd` serves `run/memory-broker/state.sock` from its state store; `brokerd-listener-lost` and `socket-forbidden` name it | brokerd |
| 06 | `memoryd`'s `[honcho]` section and its keys, checked at start; runbook `honcho-config-invalid` | memoryd |
| 07 | The ledger, `memory/honcho.jsonl`: its records, append, read-through, and the outbox | memoryd |
| 08 | The decision for a turn (a pure function: state, labels, speaker, text) | memoryd |
| 09 | On `SessionUpdated`, after `loopd` has its answer: ask `brokerd`, read the log, decide, record; undecided turns retried at the next report of any session; the ledger read through at start; runbook `broker-state-unavailable` | memoryd |
| 10 | `roncho` clients per workspace, and creating workspaces, peers and sessions (names, the agent unobserved, the fleet with reasoning, summaries and dreaming off, the `-2` sessions); the fake Honcho server | memoryd |
| 11 | The sync worker for turns: messages in parts of 25,000, neutralised; backoff; outage logged once; refused sends and keys; runbooks `honcho-unreachable`, `honcho-send-refused`, `honcho-key-refused` | memoryd |
| 12 | Memory writes mirrored: each journalled edit decided by spec 4's table (conclusions, fleet messages, retractions, undo) | memoryd |
| 13 | The sync worker for memory writes: conclusions created and deleted, fleet messages | memoryd |
| 14 | `bxctl memory sync`: decided, sent, waiting, failed | memoryd, bxctl |
The gate count is `make gate`'s tests after the task. Mutations are one-line breaks of the
reference, each run against the task's given tests (checklist, T28); those not caught cannot change
behaviour, or are checked by the task's own greps instead, as the task says.
After task 14, the design model runs the M5c-1 device check (spec 13) on straylight, rift and the
| # | Delivers | Crates | Gate | Mutations |
|---|---|---|---|---|
| 00 | (the design model, before the run) `roncho` added: workspace dependency, `docs/dependencies.md`, `docs/egress.md` (rift), `cargo deny`, the Nix build on straylight; saved Honcho responses for the fake server (below) | all | | |
| 01 | Wire: `Turn.speaker`, `LogRecord::User.speaker` (optional, absent in old logs), `SessionUpdated.turn`, `SessionState` → `SessionStateReply`; fixtures | bxcore | 1130 | |
| 02 | `loopd` logs the speaker on the `User` record and sends the turn number in `SessionUpdated` | loopd | 1138 | |
| 03 | `gatewayd` sets the speaker: the Mattermost username when every post of the burst is from one person, else none | gatewayd | 1148 | |
| 04 | `bxctl chat --speaker NAME`, opt-in, no default | bxctl | 1158 | |
| 05 | `brokerd` serves `run/memory-broker/state.sock` from its state store; `brokerd-listener-lost` and `socket-forbidden` name it | brokerd | 1171 | |
| 06 | `memoryd`'s `[honcho]` section and its keys, checked at start; runbook `honcho-config-invalid` | memoryd | 1188 | |
| 07 | The ledger, `memory/honcho.jsonl`: its records, append, read-through, and the outbox; runbook `honcho-ledger-damaged` | memoryd | 1212 | 45: 41 caught; 3 (no sync, two writes) checked by the task's greps; 1 cannot change behaviour |
| 08 | The decision for a turn (a pure function: state, labels, speaker, text) | memoryd | 1230 | 36: all caught |
| 09 | On `SessionUpdated`, after `loopd` has its answer: ask `brokerd`, read the log, decide, record; undecided turns retried at the next report of any session; the ledger read through at start; runbook `broker-state-unavailable` | memoryd | 1257 | 42: all caught |
| 10 | `roncho` clients per workspace, and making sure of workspaces, peers and sessions (the agent unobserved, the fleet with reasoning, summaries and dreaming off, the `-2` sessions); the fake Honcho server | memoryd | 1278 | 44: 43 caught, 1 cannot change behaviour |
| 11 | The worker for turns: messages in parts of 25,000, neutralised, one batch; backoff; outage logged once; refused sends and keys; runbooks `honcho-unreachable`, `honcho-send-refused`, `honcho-key-refused` | memoryd | 1300 | 36: 35 caught, 1 cannot change behaviour |
| 12 | Memory writes decided as they are journalled, by spec 4's table (conclusions, their deletion, fleet messages, undo); the ledger's own lock | memoryd | 1314 | 21: 17 caught, 4 cannot change behaviour |
| 13 | The worker for memory writes: conclusions made in `<id>_memory` and deleted, fleet messages | memoryd | 1324 | 23: all caught |
| 14 | `bxctl memory sync`: the ledger's counts and its failed items | memoryd, bxctl, bxcore | 1332 | 14: all caught |
| 15 | Sync begins when Honcho is turned on (`began`, and a skip for older turns); conclusions matched by peer | memoryd | 1345 | 15: all caught |
A later task that changes a given file gives the earlier task its own copy, `<name>-taskNN` (T19),
and that task's copy command names it.
After task 15, the design model runs the M5c-1 device check (spec 13) on straylight, rift and the
owner's Mattermost.
## The owner's answers (2026-09-27)
@@ -67,6 +75,37 @@ owner's Mattermost.
It touches no other workspace on rift, in any way (not even a read): rift has no keys yet, so
the rule is ours to keep.
## The owner's decisions (2026-09-28)
1. **Sync starts when Honcho is turned on.** The ledger's first line records when sync began, and
a turn from before it is skipped: turning on `[honcho]` never sends earlier conversations. Task
15. The first report of a session that ran before then decides a skip for each of its earlier
turns; `bxctl memory sync` counts them.
2. **Conclusions go to `<id>_memory`**, the Boxmaker session's own Honcho session, holding the
agent's and the owner's peers, made on first use whether or not a turn of the session is
synced. An undo's conclusions carry the undone edit's session. Tasks 12, 13.
3. **No retraction.** A note cannot be undone (notes are append-only), so nothing is retracted,
and the row went from spec section 4. `Action::Retract` stays in the ledger's schema, unused;
the worker leaves one waiting. Tasks 12, 13.
4. **Sends are at least once.** The worker records `sent` after Honcho answers: a crash between the
two, or an owner removing a `sent` line, sends the item again (Honcho cannot delete a message).
Tasks 07, 11.
## Changes to the outline
- The runbook entry `broker-state-unavailable` moved from task 05, which did not add it, to task
09, which adds the pointer (the rule: the entry comes with the task that writes its pointer).
- Task 12 decides only; task 13 sends. Task 15 was added for the owner's decision 1 and for the
matching of conclusions by peer found while writing task 13.
## Known issue
`gatewayd`'s `gateway_sock` test `brokerd_closing_first_ends_it_as_no_longer_pending` fails now and
then on a loaded machine (2 of 10 runs without any M5c-1 change, at a load average near 10, on
talos): after `Ended` arrives, the handler can still hold the answer's receiver for a moment. It is
a timing race in the test, not in `memoryd`. Tasks 13 to 15 tell the implementer: if it is the one
test that fails, run the gate once more. To be fixed after M5c-1.
## Before hand-over
Every task is worked through `docs/plans/CHECKLIST.md` with a reference in a scratch worktree