docs: M5c spec: queries from any session, two workspaces per ask_memory, tools per session

Owner, 2026-09-28: recall and ask_memory query Honcho from a session of any class, since Honcho
stores no query and rift's models and telemetry stay on the owner's hosts; the assumption is
written down, with what changes if rift's configuration does. A query holding a known-prefix
secret is refused. ask_memory names at most two workspaces, both asked at once inside brokerd's
wait. A session keeps the tools array it started with, so M5c-2 needs no new epoch.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/egress.md

@@ -11,7 +11,7 @@ allowed.
 | Run time (M2a) | `inferproxy` | the `llama-server` router on the host (`straylight:11434`) | Every inference request `loopd` makes, forwarded byte for byte |
 | Run time (M3b) | `brokerd`'s egress proxy container, for one `http_fetch` call | only the hosts the call's grant names, on port 443, at public addresses | The tool's HTTPS request, end to end; the proxy sees only the host name |
 | Run time (M4a) | `gatewayd` | the owner's Mattermost at `https://straylight.scylla-hammerhead.ts.net` (tailnet) | REST calls and one WebSocket: the owner's messages in, Boxmaker's answers out. Mattermost stores messages unencrypted in its database; the server is the owner's |
-| Run time (M5c) | `memoryd`, through `roncho` | the owner's Honcho at `[honcho] url` (rift: `http://rift.scylla-hammerhead.ts.net:8000`, tailnet) | Finished turns (the speaker's message and the final reply), conclusions mirroring trusted memory writes and untrusted notes, deletions of those conclusions; from M5c-2, searches and dialectic questions. Nothing from a `secret` session or above `private`. Honcho runs its own models on the owner's hosts to derive conclusions (none on the fleet workspace); its server counts telemetry events but sends none (`telemetry_events_emitted_total`, 0 on 2026-09-27) |
+| Run time (M5c) | `memoryd`, through `roncho` | the owner's Honcho at `[honcho] url` (rift: `http://rift.scylla-hammerhead.ts.net:8000`, tailnet) | Finished turns (the speaker's message and the final reply), conclusions mirroring trusted memory writes and untrusted notes, deletions of those conclusions; from M5c-2, searches and dialectic questions, from a session of any class (queries are not stored; see the M5c spec, section 8). Nothing written to it from a `secret` session or above `private`. Honcho runs its own models on the owner's hosts to derive conclusions (none on the fleet workspace); its server counts telemetry events but sends none (`telemetry_events_emitted_total`, 0 on 2026-09-27) |
 | Development (M5c) | the design model, planning M5c-1 | rift's Honcho | Recording real responses for the tests' fake server, in the throwaway workspace `boxmaker-plan-probe` only, deleted afterwards |
 
 The two run-time rows for M2a and M3b were missing until 2026-09-23; they were added with the M4a

docs/specs/2026-09-27-m5c-honcho.md

@@ -209,17 +209,26 @@ trusted workspace are conclusions: so for those `recall` also queries conclusion
 wrote, both are the same peer). The fleet workspace holds messages, so one search finds the notes
 of every peer in it, including agents this one was never told about (owner).
 
+**Queries from any session** (owner, 2026-09-28). `recall` searches Honcho, and `ask_memory` asks
+it, from a session of any class, `secret` included: a query is not written to Honcho, which stores
+neither searches nor dialectic questions, and on rift it reaches only the owner's own hosts (its
+models run on dixie; its server sends no telemetry, `docs/egress.md`). This is an assumption about
+rift's configuration, not a property of the code: if rift ever uses a hosted model or exports
+telemetry, a `secret` session's queries must stop going to Honcho without the owner's approval
+(the option set aside on 2026-09-28). A query or question that holds a known-prefix secret
+(`sanitize::refuse`'s secret rules) is refused before anything is sent, in every session.
+
 ## 9. `ask_memory`
 
 A new core tool, `ask_memory { question, workspaces?, reasoning? }`:
 
-- `workspaces`: names from `[honcho]`: `own` (default), `untrusted`, `fleet`, or another agent's
+- `workspaces`: at most two names from `[honcho]`: `own` (default), `untrusted`, `fleet`, or
-  name from `[[honcho.read]]`;
+  another agent's name from `[[honcho.read]]` (owner, 2026-09-28: two, so that both chats run at
+  once inside `brokerd`'s wait; the model asks again for more);
 - `reasoning`: `minimal` (default: one search, then the answer) or `low`;
 - `question`: at most 2,000 characters.
 
-One workspace chat (`POST /workspaces/{w}/chat`) per named workspace, in parallel, at most two at a
+One workspace chat (`POST /workspaces/{w}/chat`) per named workspace, both at once; workspace chat searches every conclusion and message of the workspace without the model
-time; workspace chat searches every conclusion and message of the workspace without the model
 choosing a peer (it averaged 13 s on rift, over only three calls; peer chat, 32 s over 318). Each
 has 150 s. The answer lists each workspace's reply, neutralised and capped, tagged like a `recall`
 hit (`memory` for the agent's own trusted workspace and for others the owner labelled trusted,
@@ -227,8 +236,10 @@ hit (`memory` for the agent's own trusted workspace and for others the owner lab
 do. `brokerd`'s wait for this tool is 170 s and `loopd`'s wait on `brokerd` for it 180 s (section
 11).
 
-Adding a tool changes the `tools` array: a new epoch for every session when M5c-2 is deployed,
+Adding a tool changes the `tools` array, and the baseline is measured again against the
-and the baseline is measured again against the 3,000-token budget.
+3,000-token budget. A session keeps the tools array it was created with (its baseline is saved at
+its start and sent on every request), so sessions started before M5c-2 is deployed keep their
+cache and never see `ask_memory`; sessions started after it have it.
 
 ## 10. Configuration and secrets
 
@@ -308,7 +319,10 @@ that records requests and answers from fixtures taken from rift's OpenAPI docume
   from a peer this agent's configuration does not name is found by `recall`.
 - **`recall`**: the fleet sources with their tags and classes; a source that times out is one
   `unavailable` line and the rest still answer; the agent's own workspaces are not searched.
-- **`ask_memory`**: two at a time; the per-workspace limit; labels; unknown workspace names.
+- **`ask_memory`**: at most two workspaces, both at once; the per-workspace limit; labels;
+  unknown workspace names.
+- **Queries**: a query or question holding a known-prefix secret is refused and nothing is sent;
+  a `secret` session's query is sent.
 - **No `[honcho]` section**: M5b's behaviour, every M5b test unchanged.
 - **Attack tests (T37)**: a turn from a session that fetched a page never reaches the trusted
   workspace, even when `brokerd` answers late; a fleet hit taints the reading session.