Writes from sessions that have read untrusted content go to the
archive, labelled untrusted, and never reach the prompt. Every write is
checked, announced in its thread, journalled and can be undone.
Session-scoped approvals for other tools become an open decision.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The owner's review of 2026-09-24. P17: the memory tool gains
consolidate, which moves entries out of memory.md into
memory/archive.md, and from M5b into Honcho, instead of losing them.
P18: memoryd owns memory/ and the SQLite index, so every memory tool
runs in one place.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The owner's direction of 2026-09-24:
- Memory is three local files, as Hermes has them: a soul written by
the owner, and memory and user files the agent edits.
- Honcho is the fleet's memory. Each Boxmaker writes only to its own
workspace, and can read other workspaces at a trust level the owner
sets.
- A new role, memoryd, does the syncing, because brokerd never holds
conversation history and loopd has no network.
- M5 splits into M5a (files and local search), M5b (memoryd and
Honcho) and M5c (the scheduler).
The brief is not changed until the owner approves P17 to P20.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The two posts caught up at restart are two top-level posts, so two
sessions, and their turns run on their own threads. gatewayd starts
them in order, but which one reaches loopd first is up to the
scheduler. Under load the test failed about 1 run in 60; task 18's
session hit it once. mm_json.rs already checks the order of catch-up
(reversing the sort fails there), so this test now compares the two
turns as a set. It passed 100 of 100 runs under load.
The M4a plan's copy is left as it was handed over.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The review of tasks 01 to 15 goes in the implementer log, with the
device check against the owner's Mattermost. Three follow-ups:
- 16: the refusal without a runner says why.
- 17: the texts that say who asked.
- 18: approvals from non-approvers in direct or group messages go to
an approver.
Task 14's given serve_approvals.rs becomes serve_approvals.rs-task14,
since task 18 hands over a new version. Tip T31 is added.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task 15's session found the defect in serve/approvals.rs, a file it did not list, and stopped.
The comment in task 14 used one name for two values; task 14's tests could not reach it. Lesson T30.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Skeletons for new files only; existing files change by exact edits, so no task overwrites an
earlier one's work. Each task's tests were run against a reference built in order from master,
with the gate at each step and mutations checked; each skeleton compiles and fails its tests, and
every todo!() comment was read beside its signature. The reference is kept off this machine.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
approval_reply and GatewayOutcome (proto already has an ApprovalAnswer); the bot's edit permission
confirmed on the owner's server; a restart replaces a dead post's text; the reason escaped as
inline code; the part size bound; the reply for an approval too long to show.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The owner's decisions of 2026-09-24: commands only, no reactions; an approvers list that falls
back to allow.users; approvals in the asking thread; on a gatewayd restart, old posts are marked
dead and brokerd's courier posts pending approvals again.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Sixteen tasks by Ornith through the plan driver, the review's fixes, and task 16 for its one low
finding. Checked end to end against the owner's Mattermost.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The test swaps the file between the check and the open through a `between` hook. A reference fix
passed it and the gate (769 tests) in the working tree, caught two mutations, and was removed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A status line splits on single spaces only, and every chunk line must end in CRLF. The bounded
`as` casts in http.rs, handshake.rs and proto's sha1.rs become try_from and from.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A script that rewrote the skeleton's comments put `now_ms`'s text on `post`. Task 14's second
session saw the contradiction and deliberated until cut off. Both comments are fixed, each
todo!() comment in tasks 14 and 15 was read beside its signature, and both tasks now say to stop
and quote a comment that does not fit. Lesson T29.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task 14's session read the crate to learn the APIs and planned `connect` in prose until it was
cut off. `connect`, `Gateway::new` and `catch_up` are now written; the task lists every call with
its signature and makes the copy and the failing test the first actions. Task 15's comment is
rewritten one step per item. Both checked to fail, then pass when filled from their comments.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task 08's `header` was one todo!() with a dozen branches; Ornith planned it in its head until the
turn ran out (tip T25). `next_message` and `header` are now written as glue over seven small
helpers, and task 09's `poll` over four, each checked to pass when filled from its comments.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Each task's tests were run against a reference at its end state; the end states were replayed
from master in order with the gate at each step (650 to 762 tests); each skeleton compiles
against its tests and fails them. The reference is kept off this machine. Lessons T27 (every
wait in a test has a limit) and T28 (mutate the reference before hand-over) come from this work.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Which channels are caught up (direct channels with allowed users, allowed channels; a new one
starts from now), what posts?since returns at v11.11.0 (changed posts, only those in `order`,
at most 1,000), that a post is recorded before it is acted on, that a failed state write stops
gatewayd, and that "interrupted" is posted on the first connection after a start only.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A secret read from a file warns at startup. In allowed channels and group
messages, Boxmaker answers only posts that name it, or replies in its own
threads that name nobody else; one Boxmaker per machine, each its own bot.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
M4 is split into M4a and M4b. The M4a spec rests on facts checked against
the owner's server and Mattermost's source at v11.11.0: the REST and
WebSocket shapes, and that clients will not post a message starting with
'/'. Records the design decisions, proposes P15 (secrets from a systemd
credential, the environment or an owner-only file), and adds the run-time
rows egress.md was missing since M2a and M3b.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Tasks 01 to 17 by Ornith, the review, and the design model's fixes to the
plan. Tool containers run from a Nix-built image named by digest; checked on
straylight.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
14 moves the pipe handling out of container.rs (a pure move, replayed on its
own); 15 starts threads with Builder and bounds output collection with a 2 s
grace period; 16 escapes container errors in the log and fixes two texts; 17
fixes toolkit's thread start, casts and the egress-proxy form. Each checked
against a reference, which is not kept. Tips T24 to T26 from this run.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Review findings 1 and 2, both plan defects. curl gains --globoff and a
leading --disable; both podman runs gain --pull=never. The given fetch.rs and
the six golden files change with them. Checked on straylight with a rebuilt
image: a glob URL is one request, a missing image fails at once.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
On straylight, with real containers from deploy/tools-image.nix, every claim
held: no network without a grant, the limits, the file tools, http_fetch's
host checks including a redirect and a tailnet name, and no leftovers. Two
plan defects found there (curl globbing, podman pulling a missing image),
five lower findings.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The third attempt filled five functions, then ran out of room planning all of
run in one turn. run and run_container are now given; spawn, Io::start,
Io::finish and answer are small todo!()s. Checked fillable: 11 of 11 passed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Two sessions ended with nothing written, each out of room while planning the
whole file in one turn. The skeleton has the signatures, the constants and
the steps as comments; the task says to fill one function at a time.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Without it the field was never read in task 11, clippy's dead_code failed the
gate, and #[allow] is forbidden; the implementer stopped on the dilemma.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The first attempt at task 08 did both and stopped without a commit. Also asks
the implementer to debug inside the repository, since OpenCode refuses /tmp.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task 04 added dependencies to toolkit and its git add line left out the lock
file, so the driver stopped on an unclean tree. The lock change is folded into
task 04's commit.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
kyleandClaude Opus 5.5