docs: milestones: M5c as the approved spec has it

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/milestones.md

@@ -15,7 +15,7 @@ One session per milestone. The design brief is `docs/design.md`.
 | M4b | Approvals over Mattermost | `gateway.sock`, approval posts, answers by `!approve`/`!deny` in the thread, approvers list, long approvals in parts | An `ask` call approved and refused from Mattermost; the audit log names the post |
 | M5a | Local memory | `memoryd` without a network: the three memory files served to `loopd` once per epoch, the `memory` tool (`note`, and add, replace, remove, `consolidate` for identity) without questions and its check, `memory/notes.md`, the journal and `bxctl memory log`/`undo`, FTS5 `recall` over session logs and notes with source tags, `recall` hit counts, `bxctl reindex` | A fact from one session is recalled in another; an entry moved by `consolidate` is found by `recall`; a write from a session that read untrusted content becomes an untrusted note, never identity; a memory edit changes the prompt only in the next session (next epoch once M5c adds epochs); the baseline with the owner's files stays under 3,000 tokens |
 | M5b | Hardening | The sanitizer for memory writes, from the prompt-injection research of 2026-09-24: refuse only bytes that are never legitimate (invisible and format characters, bidirectional overrides, tag characters, private use, noncharacters, controls other than newline and tab) and known-prefix secrets; flag attack-shaped text (an identity write becomes a note, the reason journalled); chat-template tags neutralised to a visible look-alike wherever text enters the model's context or memory, the list checked against the tokenizer by the self-test; image links escaped in what `gatewayd` posts; a reason in invalid-arguments refusals; the secret store (systemd credential, environment, owner-only file) out of `gatewayd`, so every role can load its secrets at startup, failing closed | A tag in a fetched page reaches the model escaped; a write holding an invisible character or a key is refused; an identity write shaped like an attack becomes a note; a memory about code (a hash, a path, a fence, a command) is written unchanged; an image link in a reply is posted as text; a role whose secret is missing or readable by others does not start, and says which |
-| M5c | Honcho | `memoryd` syncs finished turns through `roncho` to two workspaces of its own (P23): the owner's message and the agent's final reply, to the trusted workspace while the session is clean at the turn's end (asked of `brokerd` over a socket), otherwise to the untrusted one; moved entries and trusted notes as conclusions; `recall` over the local index and every readable workspace at once; `ask_memory` over named workspaces in parallel; other agents' workspaces read with the owner's trust labels; keys from the secret store | A turn from a tainted session never reaches the trusted workspace; a result from an untrusted workspace taints the session; Honcho's contents are rebuilt from the logs; `recall` still answers from the local index when Honcho is down |
+| M5c | Honcho | `memoryd` syncs finished turns through `roncho` to two workspaces of its own: the speaker's message and the agent's final reply, to the trusted workspace while the session is clean and at most `private` at the turn's end (asked of `brokerd` over a socket), to the untrusted one otherwise, never for a `secret` session; every trusted memory write mirrored as a conclusion at once; untrusted notes to the fleet workspace, as messages; `recall` over the local index, other agents' trusted workspaces and the fleet; `ask_memory` over named workspaces in parallel; keys from the secret store. Planned and run in two halves: the write path, then the read path (spec `docs/specs/2026-09-27-m5c-honcho.md`) | A turn from a tainted session never reaches the trusted workspace, and a `secret` session's reaches none; a result from an untrusted workspace taints the session; `recall` still answers from the local index when Honcho is down; a memory write is in Honcho at once, and undoing it removes it |
 | M5d | Scheduler and compaction | Heartbeat and cron on their own slot in isolated sessions; compaction at idle, starting a new epoch from the baseline and a summary; summaries of tool output for the tools that opt in (a web fetch, say), indexed with the output's label; the tiering job, which decides what stays at which tier | A scheduled run leaves the main slot's cache intact; a fact from epoch 1 is recalled in epoch 2, and a memory edit reaches the next epoch; the tiering job promotes only trusted notes into identity, and its writes are journalled like any other |
 | M6 | Subagents + cloud consult | Subagents on their slot returning summaries; consult tool gated by data-class grants with full payload log | A tainted session is refused; payload log matches what was sent |
 | M7 | Split deployment | Each role in its own rootless container; `loopd` with no network; socket volume permissions; egress proxy for tools; host ACL policy in `deploy/` | From inside the `loopd` container, requests to the internet, the tailnet and the host all fail; a tool container without a host grant cannot reach the tailnet |