The owner's review of 2026-09-24. P17: the memory tool gains
consolidate, which moves entries out of memory.md into
memory/archive.md, and from M5b into Honcho, instead of losing them.
P18: memoryd owns memory/ and the SQLite index, so every memory tool
runs in one place.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The owner's direction of 2026-09-24:
- Memory is three local files, as Hermes has them: a soul written by
the owner, and memory and user files the agent edits.
- Honcho is the fleet's memory. Each Boxmaker writes only to its own
workspace, and can read other workspaces at a trust level the owner
sets.
- A new role, memoryd, does the syncing, because brokerd never holds
conversation history and loopd has no network.
- M5 splits into M5a (files and local search), M5b (memoryd and
Honcho) and M5c (the scheduler).
The brief is not changed until the owner approves P17 to P20.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The owner's decisions of 2026-09-24: commands only, no reactions; an approvers list that falls
back to allow.users; approvals in the asking thread; on a gatewayd restart, old posts are marked
dead and brokerd's courier posts pending approvals again.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A secret read from a file warns at startup. In allowed channels and group
messages, Boxmaker answers only posts that name it, or replies in its own
threads that name nobody else; one Boxmaker per machine, each its own bot.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
M4 is split into M4a and M4b. The M4a spec rests on facts checked against
the owner's server and Mattermost's source at v11.11.0: the REST and
WebSocket shapes, and that clients will not post a message starting with
'/'. Records the design decisions, proposes P15 (secrets from a systemd
credential, the environment or an owner-only file), and adds the run-time
rows egress.md was missing since M2a and M3b.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A draft spec for the owner's review and 13 offline tasks with their given
tests: shared tool arguments and host rules in proto, the sealed fetch
target (M3a finding 14), the toolkit tools and SOCKS5 egress proxy, and
brokerd's [runner], podman argument lists, runtime and proxy lifecycle. Each
task's tests were run against a reference at that task's end state (560 to
638 tests, clippy clean); the reference is not in the repository. Adds the
runner-unavailable runbook entry and tip T23 (ETXTBSY in script tests).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The review table gains findings 16 to 20, which the two review agents
reported and the first write-up dropped. The independent review of the fix
commits, and what was changed for it, is recorded; task 23's claims about
its tests are corrected. The spec and decisions record the day-long cap, the
ttl_ms bound, the socket-directory rule and the listener's retry.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Every request is recorded, unreadable state is recorded as secret, a
refusal that cannot be recorded is an error, and the other cases the
brokerd reference settled. The audit-unavailable and
broker-state-damaged entries name the new messages; egress lists the
development calls to straylight.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
DecisionRecord's empty struct variants, the verifier's report fields and
region rule, the startup fallback, the IPv4 host rule, Denial, BrokerPort
deadlines and envelope id, the runbook anchor rule, bxctl's --say/--json
and escaping. Recorded in docs/decisions.md; the array-form question is
left open.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
From M3a: a full reference for the audit chain and the approval
handoff, the property test's oracle for policy, and compiling
skeletons for everything else. Each plan records what its checks
exposed, and that record decides what the next milestone gets.
Tip T17; the spec's handover section says which check each module has.
Also restores three / examples that an editing tool had decoded
to a plain slash.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Settled: what is being approved is never truncated. Leading option for
Mattermost is a thread of numbered chunks approved on the last post.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
broker/sessions/<id>.json holds each session's taint and untrusted
flag. It is written only by brokerd and can be rebuilt from the audit
log's result records.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
brokerd internals: the ledger lock over the audit writer and session
state, the pending table's take-it-and-answer rule, sticky
audit_unavailable after a failed write, pure policy functions with an
Ask type that only redecide turns into a Decision, how a waiting
thread detects a lost connection without peek, fixed RunError text.
Approvals: bxctl chat fetches the block from brokerd by id, shows the
parsed arguments with invisible and bidi characters escaped, asks for
the approval id instead of y, and escapes model text. A tool_denied
event carries the reason to the owner.
Also: BrokerPort timeouts, tests for runbook pointers and concurrency,
threat-model notes, P14 for broker/sessions in the brief's State list.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Policy: a deny grant must apply at every taint; a result's label is
combined over all matching grants and the longest matched path wins
within a mode; a grant of / is invalid.
Audit: a recovered line need not fail to parse; the writer never goes
back to an earlier day's file; --accept-break verifies the whole log
and the break record's fields are all checked, with a seq counted from
lines; the Approval record carries the re-decision's grant and state;
calls with no Result are reported.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Split M3 into M3a and M3b, record the M3 design decisions, propose P13
(tool image built by Nix, named by digest), and add docs/runbook.md with an
entry for every fail-closed state, including loopd's existing ones.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Requested by the owner so that future readers, agents included, learn
what each piece is for first. No behaviour changes.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
A request pinned to a busy slot receives no bytes until the slot frees.
reasoning_control ends a thinking block on demand; the capped turn is
re-read once on the next request.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Threat model, data classes and provenance, approvals, IPC framing and
socket topology, the proto type list, log file rules, runtime layout,
the M1 gate, and how work is handed to the implementing model.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
kyleandClaude Opus 5.5