Found on the device (2026-09-25): the ledger raised a session's state by
the grant's label, so a clean session that recalled a memory-tainted note
stayed trusted and could add it to memory.md. The spec's "as today" was
wrong; section 8 now says the state is raised by the stricter of the
grant's label and the result's, and the recall section says the session
becomes untrusted. The note answers (section 3) name notes.md and, for an
untrusted add, the file that was not changed: the model read the old ones
as success. Tasks 21 and 22.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The M5a review found that a note's text could hold a line shaped like a
notes.md header. Read back, the line started an entry of its own: an
untrusted session could plant a 'moved from memory.md' header, and recall
showed what followed it as identity, not untrusted. Entries and notes now
refuse any line that starts with the separator, and a header must match one
of its three forms exactly.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task 04's session read the given test and the check.rs skeleton, both
holding the tags the check refuses, and Ornith took them for its own
template. It lost track of the file and made no change. The tags are
now built with concat! and format! in check.rs and in the four given
tests that held them, and the spec describes them in words. The
rewritten tests pass against the reference, are rustfmt-clean, and
still catch the case-folding mutation.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The memory socket in brokerd.toml is optional, and bxctl's flag is
--memory-socket. A note's header carries its class. Built-in grants are
kept apart from the owner's, and builtin- ids are reserved. The session
state is carried through Decision and RunSpec, labels through
run_labelled. loopd's assemble_with and MemorySource. Baseline
measured at 881 and 2,432 tokens.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The research feeds M5b's sanitizer. One finding is a bug in the M5a
draft: category Cf misses variation selectors, the combining grapheme
joiner, and the Hangul and Braille fillers.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Writes from sessions that have read untrusted content go to the
archive, labelled untrusted, and never reach the prompt. Every write is
checked, announced in its thread, journalled and can be undone.
Session-scoped approvals for other tools become an open decision.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
kyleandClaude Opus 5.5