From 5a0cee42ec291dd2896445550f747dac5ba494ab Mon Sep 17 00:00:00 2001 From: "K. Isom" Date: Mon, 28 Sep 2026 08:53:56 -0700 Subject: [PATCH] docs: M5c spec: conclusions go to _memory; no retraction, notes cannot be undone A memory write is made during a turn, before that turn's Honcho session exists, and a session whose turns are never synced has none, so each Boxmaker session's conclusions go to its own _memory session, holding the agent's peer and the owner's. `bxctl memory undo` refuses notes (they are append-only), so the undo-of-a-fleet-note row and its retraction go. Owner, 2026-09-28. Co-Authored-By: Claude Opus 5.5 (1M context) --- docs/specs/2026-09-27-m5c-honcho.md | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/docs/specs/2026-09-27-m5c-honcho.md b/docs/specs/2026-09-27-m5c-honcho.md index 5cecbe0..19bf4ca 100644 --- a/docs/specs/2026-09-27-m5c-honcho.md +++ b/docs/specs/2026-09-27-m5c-honcho.md @@ -99,11 +99,13 @@ spotting the phrase: | an untrusted note | a message in the fleet workspace, from the agent's peer | | a flagged note (a sanitizer flag rule matched) | nothing: it stays local (owner) | | `bxctl memory undo` of an edit whose conclusions were written | those conclusions deleted; any it had deleted, written again | -| `bxctl memory undo` of an untrusted note already in the fleet | a retraction message beside it, `retracted: `, from the agent's peer; the original stays, since Honcho cannot delete a message (owner) | A conclusion's observer and observed are the same peer, which is Honcho's own picture of that peer: a `user.md` entry is the owner's (it is about the owner); a `memory.md` entry or a note is -the agent's. Each carries the Honcho session of the Boxmaker session in which the write was made +the agent's. Each goes into its Boxmaker session's memory session in Honcho, `_memory`, which +holds the agent's peer and the owner's and is created on first use, whether or not any turn of the +session is synced (a write is made during a turn, before that turn's session exists; owner, +2026-09-28). An undo's conclusions carry the undone edit's session. Every conclusion has a session (Honcho leaves session-less conclusions out of session-filtered queries, and its automatic dreaming skips a peer whose newest conclusion has none). `memoryd` never deletes a Honcho session: that would delete the conclusions stamped with it. @@ -128,7 +130,7 @@ rebuilt from them. 5. **Send.** One worker thread in `memoryd` sends what is decided and not yet sent, oldest first: for a turn it creates the Honcho workspace, peers and session on first use (section 6), then adds the two messages as one batch; for a memory write it creates or deletes the conclusion, - or, for an untrusted note, adds the message to the fleet workspace (or its retraction). + or, for an untrusted note, adds the message to the fleet workspace. Each send is recorded in the ledger with Honcho's ids. 6. **Honcho down** (a connection error, a timeout, a 5xx): the worker waits and tries again, doubling the wait from 5 s to 10 minutes. It logs the outage once, when it starts, and once @@ -205,8 +207,7 @@ Honcho's search endpoints find messages only, and the mirrored memory writes in trusted workspace are conclusions: so for those `recall` also queries conclusions (`POST /conclusions/query`, which needs the observer and the observed; for a conclusion `memoryd` wrote, both are the same peer). The fleet workspace holds messages, so one search finds the notes -of every peer in it, including agents this one was never told about (owner); a retracted note is -found beside its retraction. +of every peer in it, including agents this one was never told about (owner). ## 9. `ask_memory` @@ -302,8 +303,8 @@ that records requests and answers from fixtures taken from rift's OpenAPI docume - **Keys**: a configured key is sent as a bearer token to its workspace only, and appears in no log line or error; without a key, no `Authorization` header; a 401 stops that workspace's sends only, once logged. -- **The fleet**: an untrusted note is a message from the agent's peer; its undo is a retraction - message; the fleet workspace is created with reasoning, summaries and dreaming off; a note +- **The fleet**: an untrusted note is a message from the agent's peer; the fleet workspace is + created with reasoning, summaries and dreaming off; a note from a peer this agent's configuration does not name is found by `recall`. - **`recall`**: the fleet sources with their tags and classes; a source that times out is one `unavailable` line and the rest still answer; the agent's own workspaces are not searched. @@ -339,7 +340,9 @@ With this spec, as their own commits: (sections 4 and 11). 2. **The fleet**: every peer in the fleet workspace is a member of the fleet. Fleet notes are therefore messages, which one search finds whoever wrote them; an undone note gets a - retraction message, since Honcho cannot delete a message (sections 3, 4, 8). + retraction message, since Honcho cannot delete a message (sections 3, 4, 8). (2026-09-28: + `bxctl memory undo` cannot undo a note, since notes are append-only, so no retraction is ever + sent and the row went from section 4; owner.) 3. **For `roncho`'s agent**, accepted (found 2026-09-27, none blocking): make the config file opt-in (it supplies an `api_key` today; the README's "reads no environment variables" is wrong); evidence decoding requires `observer_id` and `observed_id`, which rift's schema lacks;