kyle/boxmaker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: M5c spec: conclusions go to <id>_memory; no retraction, notes cannot be undone

Browse Source 
A memory write is made during a turn, before that turn's Honcho session exists, and a session
whose turns are never synced has none, so each Boxmaker session's conclusions go to its own
<id>_memory session, holding the agent's peer and the owner's. `bxctl memory undo` refuses notes
(they are append-only), so the undo-of-a-fleet-note row and its retraction go. Owner, 2026-09-28.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kyle
2026-09-28 08:53:56 -07:00
co-authored by Claude Opus 5.5
parent 67ddda514b
commit 5a0cee42ec
1 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/specs/2026-09-27-m5c-honcho.md
+11 -8
View File
@@ -99,11 +99,13 @@ spotting the phrase:
| an untrusted note | a message in the fleet workspace, from the agent's peer | | an untrusted note | a message in the fleet workspace, from the agent's peer |
| a flagged note (a sanitizer flag rule matched) | nothing: it stays local (owner) | | a flagged note (a sanitizer flag rule matched) | nothing: it stays local (owner) |
| `bxctl memory undo` of an edit whose conclusions were written | those conclusions deleted; any it had deleted, written again | | `bxctl memory undo` of an edit whose conclusions were written | those conclusions deleted; any it had deleted, written again |
| `bxctl memory undo` of an untrusted note already in the fleet | a retraction message beside it, `retracted: <the note>`, from the agent's peer; the original stays, since Honcho cannot delete a message (owner) |
A conclusion's observer and observed are the same peer, which is Honcho's own picture of that A conclusion's observer and observed are the same peer, which is Honcho's own picture of that
peer: a `user.md` entry is the owner's (it is about the owner); a `memory.md` entry or a note is peer: a `user.md` entry is the owner's (it is about the owner); a `memory.md` entry or a note is
the agent's. Each carries the Honcho session of the Boxmaker session in which the write was made the agent's. Each goes into its Boxmaker session's memory session in Honcho, `<id>_memory`, which
holds the agent's peer and the owner's and is created on first use, whether or not any turn of the
session is synced (a write is made during a turn, before that turn's session exists; owner,
2026-09-28). An undo's conclusions carry the undone edit's session. Every conclusion has a session
(Honcho leaves session-less conclusions out of session-filtered queries, and its automatic (Honcho leaves session-less conclusions out of session-filtered queries, and its automatic
dreaming skips a peer whose newest conclusion has none). `memoryd` never deletes a Honcho session: dreaming skips a peer whose newest conclusion has none). `memoryd` never deletes a Honcho session:
that would delete the conclusions stamped with it. that would delete the conclusions stamped with it.
@@ -128,7 +130,7 @@ rebuilt from them.
5. **Send.** One worker thread in `memoryd` sends what is decided and not yet sent, oldest first: 5. **Send.** One worker thread in `memoryd` sends what is decided and not yet sent, oldest first:
for a turn it creates the Honcho workspace, peers and session on first use (section 6), then for a turn it creates the Honcho workspace, peers and session on first use (section 6), then
adds the two messages as one batch; for a memory write it creates or deletes the conclusion, adds the two messages as one batch; for a memory write it creates or deletes the conclusion,
or, for an untrusted note, adds the message to the fleet workspace (or its retraction). or, for an untrusted note, adds the message to the fleet workspace.
Each send is recorded in the ledger with Honcho's ids. Each send is recorded in the ledger with Honcho's ids.
6. **Honcho down** (a connection error, a timeout, a 5xx): the worker waits and tries again, 6. **Honcho down** (a connection error, a timeout, a 5xx): the worker waits and tries again,
doubling the wait from 5 s to 10 minutes. It logs the outage once, when it starts, and once doubling the wait from 5 s to 10 minutes. It logs the outage once, when it starts, and once
@@ -205,8 +207,7 @@ Honcho's search endpoints find messages only, and the mirrored memory writes in
trusted workspace are conclusions: so for those `recall` also queries conclusions trusted workspace are conclusions: so for those `recall` also queries conclusions
(`POST /conclusions/query`, which needs the observer and the observed; for a conclusion `memoryd` (`POST /conclusions/query`, which needs the observer and the observed; for a conclusion `memoryd`
wrote, both are the same peer). The fleet workspace holds messages, so one search finds the notes wrote, both are the same peer). The fleet workspace holds messages, so one search finds the notes
of every peer in it, including agents this one was never told about (owner); a retracted note is of every peer in it, including agents this one was never told about (owner).
found beside its retraction.
## 9. `ask_memory` ## 9. `ask_memory`
@@ -302,8 +303,8 @@ that records requests and answers from fixtures taken from rift's OpenAPI docume
- **Keys**: a configured key is sent as a bearer token to its workspace only, and appears in no - **Keys**: a configured key is sent as a bearer token to its workspace only, and appears in no
log line or error; without a key, no `Authorization` header; a 401 stops that workspace's sends log line or error; without a key, no `Authorization` header; a 401 stops that workspace's sends
only, once logged. only, once logged.
- **The fleet**: an untrusted note is a message from the agent's peer; its undo is a retraction - **The fleet**: an untrusted note is a message from the agent's peer; the fleet workspace is
message; the fleet workspace is created with reasoning, summaries and dreaming off; a note created with reasoning, summaries and dreaming off; a note
from a peer this agent's configuration does not name is found by `recall`. from a peer this agent's configuration does not name is found by `recall`.
- **`recall`**: the fleet sources with their tags and classes; a source that times out is one - **`recall`**: the fleet sources with their tags and classes; a source that times out is one
`unavailable` line and the rest still answer; the agent's own workspaces are not searched. `unavailable` line and the rest still answer; the agent's own workspaces are not searched.
@@ -339,7 +340,9 @@ With this spec, as their own commits:
(sections 4 and 11). (sections 4 and 11).
2. **The fleet**: every peer in the fleet workspace is a member of the fleet. Fleet notes are 2. **The fleet**: every peer in the fleet workspace is a member of the fleet. Fleet notes are
therefore messages, which one search finds whoever wrote them; an undone note gets a therefore messages, which one search finds whoever wrote them; an undone note gets a
retraction message, since Honcho cannot delete a message (sections 3, 4, 8). retraction message, since Honcho cannot delete a message (sections 3, 4, 8). (2026-09-28:
`bxctl memory undo` cannot undo a note, since notes are append-only, so no retraction is ever
sent and the row went from section 4; owner.)
3. **For `roncho`'s agent**, accepted (found 2026-09-27, none blocking): make the config file 3. **For `roncho`'s agent**, accepted (found 2026-09-27, none blocking): make the config file
opt-in (it supplies an `api_key` today; the README's "reads no environment variables" is opt-in (it supplies an `api_key` today; the README's "reads no environment variables" is
wrong); evidence decoding requires `observer_id` and `observed_id`, which rift's schema lacks; wrong); evidence decoding requires `observer_id` and `observed_id`, which rift's schema lacks;