Found in the M5b device check on straylight: the self-test asked about
each of the 33 tags and each neutralised form, 66 requests, one
connection each, and inferproxy's token bucket (burst 10) refused the
ninth, so loopd would not start. Now it asks about all the tags at once,
one per line, and then all their neutralised forms: the answer to the
first must hold each tag's recorded token in order, the second none of
them. Each tag is a special token, split out before anything else, so
the lines between cannot change it; and a neutralised form is only
dangerous as a tag's own token, so that is what the second answer must
not hold. The errors name a tag by its id, as before.
The fake tokenizer reads text with several tags in it; the tests cover
each tag as ordinary tokens, as another listed or unlisted token, a
duplicated token in the middle and at the end, a form holding each tag,
and both requests failing. Spec section 8 and the runbook entry follow.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Records what porting Hermes' patterns decided: seven rules kept,
"dump the conversation" narrowed, agent-configuration changes left out
(Boxmaker's agent loads no such files), about fifty look-alikes,
apostrophes folded, and a flag in bxctl names only its rule. A false
positive also marks a session that recalls the note untrusted.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The private-key rule named only PEM's ending, so an armored PGP
private key passed. Public-key blocks still pass.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Every daemon removes a leftover socket before binding, which also lets a
second copy silently take a running one's sockets. Owner's decision:
refuse to start instead. Each daemon takes an exclusive std File lock
(stable since 1.89, checked on 1.95) on <home>/run/<role>.lock, or
<socket>.lock for inferproxy, before touching its sockets; the system
releases it however the process ends. A runbook entry, a security note
and a test per daemon.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Code spans stop both the link preview and the server's image fetch;
Markdown links are not previewed; images are fetched by the server at
posting time. Emoji refusal accepted, phrases move to flag, Hermes'
patterns ported at plan time.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
bxcore (compiler-driven rename, with the spike's four layers named); the
invalid-arguments reason on the wire; the secret store moved into
bxcore behind a feature loopd never enables; bxcore::sanitize with
refuse, neutralise and flag, its lists, hand-written normalisation, two
corpora, a rule-change procedure and `bxctl sanitize check`; memoryd
refusing and flagging (a flag keeps the text as an untrusted note);
loopd neutralising tags on append, with a tokenizer self-test and the
session's trust on TurnDone; gatewayd escaping images and, in untrusted
sessions, links; a table of every link between the roles; runbook
entries; attack tests per trust boundary and the device checks. Four
points left for the owner in section 14.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
kyleandClaude Opus 5.5