decisions: the local-model trailer, and adopting the combined Ornith guidance

Owner's decisions, 2026-09-26. The second row lists what was adopted,
which driver guards are trials for M5b's run, and what was left out.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/decisions.md

@@ -6,6 +6,8 @@ Newest first. A decision that changes `docs/design.md` lands in the same commit
 
 | Date | Decision | Reason |
 |---|---|---|
+| 2026-09-26 | Every commit holding work by Ornith or another local model ends with `Co-Authored-By: <model> <agent@wntrmute.dev>`, the model named as in `OPENCODE_MODEL` after the provider (for example `ornith-1.5-35b-a3b`). `tools/run-plan.sh` puts the exact line in the session prompt and stops a run whose commit lacks it; the log's Model column is filled the same way. When the design model commits a local model's work, it adds that line beside its own. It replaces the `Implemented-By` trailer. | Owner's rule, for tracking which model wrote what across the owner's repositories. The implementer often cannot know its own model, so the driver supplies the name. `f98ec2a`. |
+| 2026-09-26 | Boxmaker adopts the combined Ornith guidance (`~/projects/ornith/GUIDANCE.md`, from this repository's `ASSESSMENT.md` and two others'): in `AGENTS.md`, experiments under `.state/scratch/`, a refused tool call does not end a turn, one `todo!()` at a time, the gate's 600000 ms timeout, commit messages by `git commit -F` (`0356c87`); a project `opencode.json` with an `implement` agent whose permissions deny reads outside the repository, edits to the plans and design documents, subagents, web access and destructive git commands (`31fe078`); in the driver, a 90-minute session limit and a message for a `stopped` row (`411d9e0`); a pre-handover checklist, `docs/plans/CHECKLIST.md` (`224617e`); and in task files, environment facts and pasted contracts. Two driver guards are trials, switched on for M5b's run and judged at its review: `RESUME=1` (one resume when a session leaves work uncommitted) and `SLOTS_URL` (stop a session when no llama slot has been busy for 10 minutes). Not adopted yet: a verdict classifier, the spec-extraction pipeline (for M5c's Honcho contract, if needed), smaller `tool_output` limits and a custom agent prompt. | Owner's decision. Each adopted item answers a recorded failure in one of the three projects; the trials and the omissions are the guide's own untested items, taken one at a time so their effect can be seen. OpenCode settings were checked against its 1.18.30 schema and permission docs. |
 | 2026-09-25 | P24, Milestones: M5b splits. M5b is hardening (the sanitizer, tag neutralisation in `loopd`, image links escaped in `gatewayd`, the invalid-arguments reason, and the secret store made available to every role, which the Honcho keys of M5c will need), which needs neither `roncho` nor Honcho and closes a gap open since M3. Honcho becomes M5c, planned once `roncho` has a tagged release. The scheduler and compaction move from M5c to M5d. Documents and decision rows written before this date use the old numbers. | Owner's decision, 2026-09-25. The hardening can be specified and run now; the Honcho half waits on `roncho` (`docs/specs/2026-09-25-roncho-requirements.md`). |
 | 2026-09-25 | `memoryd` reaches Honcho through the owner's `roncho`, not a client of its own. `roncho` first gains a blocking client with a small dependency graph (no async runtime), no default server, no hidden environment settings or redirects, and request shapes checked against rift; the requirements are `docs/specs/2026-09-25-roncho-requirements.md`, handed to `roncho`'s developer. Boxmaker will allow that one git source in `deny.toml`, pinned by tag. | Owner's decision (M5b design). One client for the fleet. As it stands `roncho` is async only (tokio, reqwest), defaults to `api.honcho.dev`, and differs from rift in its search shapes, so it cannot be used unchanged. |
 | 2026-09-24 | M5a's check on memory writes stays short and fixed: control characters, invisible characters, chat-template markup, six phrases. A research thread on prompt-injection defences feeds a sanitizer module for memory writes (and possibly other persisted text), built as hardening in M5b. Memory writes are not posted to the chat; `bxctl memory log` lists them. | Owner. The archive routing of untrusted sessions' writes is the main defence; a pattern list is defence in depth and should rest on research, not guesses. |