memoryd.toml gains an optional [honcho] section, [[honcho.read]] and the
Honcho keys in [secrets.<name>], checked at start into
memoryd::honcho::config::HonchoConfig (13 reasons, runbook entry
honcho-config-invalid given as a fragment), and [sockets] state for
brokerd's state.sock. Keys are checked, never read; no [honcho] leaves
memoryd as it was. memoryd enables bxcore's feature secrets.
Checks: a reference at ref 05 + this task passes make gate with 1188
tests (1171 + 17); /tmp unchanged around the gate; the given tests fail
before as the task says (two targets do not compile, 4 start tests
fail); 49 one-line mutations of the reference, all caught (one gap, a
URL with a user and no password, found and closed); the new tests 40
times under CPU load, no failure; a replay from the task text on a fresh
ref-05 worktree with its own target is byte-identical and passes the
gate, and every before block was found once; given files pass fmt and
the 500-line limit; no chat-template tag in any file.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
brokerd serves a third socket, [sockets] state (default
<home>/run/memory-broker/state.sock), bound by the same listen (dir 0700,
stale socket removed, socket 0600), one thread per connection, one
question per connection. The answer is StateStore::read: the stored taint
and flag, the store's default (private, trusted) for a session with no
file. A damaged state is an internal error with the store's text, never an
answer; other kinds are forbidden; malformed frames get read_request's
error. A new tests/serve.rs waits for an answer before reading the
startup notices (a race that failed about one run in ten under load,
before this task too).
Checks: every before block found once at ref 04 (20 edits); the new file
in the task is byte-identical to the reference; the given tests fail
before as the task says (config and state_socket do not compile;
serve_state 5 of 5 fail); gate ok with 1171 tests on the reference and on
a replay from the task text in a fresh ref-04 worktree with its own build
dir (byte-identical to the reference; removed); /tmp unchanged around the
gate; 25 mutations, 24 caught, the one missed (state bound last) changes
no tested behaviour; the socket tests 25 runs under load, 0 failures;
no task-text line over 100 characters outside tables and code.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The speaker goes on every turn of the chat: interactive, --say and --say's retry. Without the
flag it is None. A name that is empty or holds whitespace or a control character (Unicode), or a
second --speaker, is a usage error: the usage text on stderr and exit status 2. The usage text
gains the flag and one line explaining it. Given: chat_speaker.rs (new) and new versions of
chat.rs, chat_approvals.rs and cli.rs. Task 01 now copies chat.rs-task01, the older chat.rs.
Checks: every before block found once at ref 03; replayed from the task text on a fresh ref-03
worktree with its own build directory, byte-identical to the reference, gate ok with 1158 tests
(1148 + 10); /tmp unchanged around the reference's and the replay's gate runs; 20 of 20
mutations caught; the new tests passed 40 of 40 runs under CPU load; given files pass fmt and
the 500-line check; no chat-template tag in the plan or the given files.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A batch carries the Mattermost user id of each message; the turn's speaker
is the username of the one user who wrote all of it (Client::username,
kept in a map on the event loop), and None for two or more people or a
failed lookup. The turn's text is unchanged.
Checks: reference replayed from the task text on a fresh ref-02 worktree
with its own build dir, byte-identical; make gate ok with 1148 tests
(1138 + 10); /tmp unchanged around both gate runs; 21 mutations, all
caught; new tests stressed 40 times under load, no failure; every before
block found once at ref 02; no chat-template tags.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The owner's hosts (titan, talos) run 1.98.1; nixos-26.05's Rust is
1.95.0, so builds and lints differed by host. The flake gains a second
input, oxalica's rust-overlay (following our nixpkgs, so host configs
can still follow theirs), and both the package build and the dev shell
use its stable 1.98.1 with clippy and rustfmt. The workspace's
rust-version rises to 1.98 to match; AGENTS.md, docs/dependencies.md
and the M5c-1 plan follow.
Checked on straylight: nix build gives all seven binaries; the dev
shell has rustc, cargo and clippy 1.98.1, rustfmt 1.9.0, cargo-deny
0.19.6; make gate in it passes with 1122 tests, as on titan.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
loopd copies the Turn's speaker onto the User record it logs, as it
came (not checked, not neutralised), and never into a request; after a
finished turn it sends SessionUpdated with the turn's number, the count
of User records in the session's log (Session::turns), so the first
turn is 1, a failed turn that was logged counts, and the count goes on
after a reopen or a restart. Failed turns are still not told.
Given: speaker_turn.rs (8 tests) and new versions of loopd's memory.rs,
turn_broker.rs, end_to_end.rs and support/turn.rs (run_turn gains
speaker, MemorySource::updated gains turn). Task 01 now copies
memory.rs-task01, its own version.
Checks: the reference passes make gate with 1138 tests (1130 + 8); the
task replayed from its text on a fresh ref-01 worktree with its own
target is byte-identical to the reference and passes the gate; /tmp
unchanged around both gate runs; 15 one-line mutations (speaker not
logged or dropped by the channel or neutralised, speaker in the request
at log time or at replay, turn 0-based or +1, counting Assistant
records, all records or only speakers' turns, a global or per-process
counter, told before logging or on failure, MemoryPort sending 0) all
caught; speaker_turn run 60 times under load, no failure; no
chat-template tag in the plan or given files; task lines within 100
characters but tables.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task 01 changes bxcore's wire and log types for M5c-1: Turn.speaker and
LogRecord::User.speaker (optional, skipped when None, so old frames and logs
keep their bytes), SessionUpdated.turn (required, refused when missing), and
the new SessionState / SessionStateReply messages. The other crates only
construct the new fields (speaker: None, turn: 0) and brokerd's kind() names
the two new kinds; later tasks give them values. 20 given files.
Checks, against a reference at 7b40686 with its own build directory:
- every "before" block found exactly once at 7b40686 (and at master, which
changed no crate since);
- step 2's failures as the task names them: two strict tests, fifteen test
targets with E0559/E0560/E0432/E0599 only;
- make gate: gate: ok, 1130 tests (1122 + 8); /tmp unchanged around it;
- replay from the task text in a fresh worktree of 7b40686 with its own
target/: crates/ byte-identical to the reference, gate ok, 1130; removed;
- 23 mutations: 21 caught; the two that drop `default` from an Option
field cannot change behaviour (serde reads a missing Option as None);
- no chat-template tag whole in the task or the given files; lines over
100 characters only in tables, fixtures and verbatim strings.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
29 request/response pairs, each request exactly as roncho 1.0.0's
blocking client sends it, recorded in a throwaway workspace
(boxmaker-plan-probe) created for it and deleted afterwards; no other
workspace was touched. For the fake Honcho server of task 10. Found:
creation is get-or-create (201, then 200); adding messages to a missing
session creates it; a 422 echoes the whole input; a deleted conclusion
answers 204 with an empty body, and 404 the second time.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The task table follows the files (03 tags, 04 refuse, 05 flag) and
gives each task's gate count and mutations; the interfaces are the ones
the tasks built (task 02's role argument and SecretSpec, Refusal.at,
Flag, TurnDone.untrusted required, disarm, LockError::line); the review
focus names the tasks that pin each item; which task adds each runbook
entry, and the -taskNN convention for replaced given copies.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The last runbook entry, the rule-change procedure of spec 6.5; the
entries memory-write-refused and memory-write-flagged now send the
reader to it instead of to the spec. Tasks 06, 08 and 12 added the
other five, because the gate needs an entry for every pointer.
Checks: the edits, applied from the task's text to ref 13, give a
runbook byte-identical to the reference; each before block found once;
the gate passes on the reference with 1118 tests; /private/tmp unchanged.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Each locks <home>/run/<role>.lock in main (gatewayd after its secret,
so nothing is made before the secret is read). brokerd's old
second-instance test in serve.rs expected the audit lock's message,
so serve.rs has a new version; task 01 now copies serve.rs-task01.
Checks: given tests fail at ref 12 as the task says (2 each in
brokerd, memoryd, gatewayd; serve.rs passes); the task's quoted edits
applied to ref 12 reproduce ref 13's tree exactly; replay gate ok with
1118 tests (1113 - 1 + 6), /tmp unchanged; 14 mutations, all caught;
the six instance test files stressed 25 runs under 16 busy loops and
20 under 32, no failure.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
bxcore::instance::lock (File::try_lock, file 0600, missing directory
0700), LockError::line for the two lines the daemons print, and the
already-running runbook fragment; loopd locks <home>/run/loopd.lock
before its socket and self-test, inferproxy <socket>.lock.
Checks: given tests fail at ref 11 as the task says (bxcore E0432;
loopd 3 and inferproxy 3 fail); the task's quoted edits applied to
ref 11 reproduce ref 12 byte for byte; replay gate ok with 1113 tests
(1099 + 14), /tmp unchanged; 25 mutations, 24 caught (the uncaught
one maps TryLockError::Error to Held, not reachable from a test);
given files rustfmt-clean, under 500 lines; no chat-template tags.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The task file, the skeleton crates/bxctl/src/sanitize.rs (five todo!()
bodies: parse_sanitize, code_point, token, prefix, tag_count) and two
given tests: sanitize_check.rs (8, runs the binary) and
sanitize_report.rs (10, the library).
Decisions: the one argument after `check` is the text, whatever it
looks like; none means standard input. Output: refuse line (first rule
only; a character as U+XXXX, a tag as its token id, a secret as its
prefix and an ellipsis), flag line (rule only), neutralise line (every
occurrence of every tag). Exit 0 nothing fires, 1 something fires, 2
usage error or unreadable text. Nothing of the text is printed.
Checks: every given test fails before the task as the task says (the
report file does not compile: one E0432, two E0599; the binary tests
exit 2); the skeleton state gives 10 and 8 not-yet-implemented
failures; the reference passes make gate with 1099 tests (1081 + 18);
the task's edits applied to a fresh ref-10 copy with its own build
directory give a tree byte-identical to the reference; 21 mutations,
each caught; 40 runs under load, no failure; /private/tmp unchanged
around a gate run; rustfmt and the line limit on the given files; no
tag or key-shaped string in the plan or given files.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task 10 (spec 9, the owner's option C): a new module gatewayd::links with
disarm(text, untrusted) -> Disarmed { text, links }, given as a skeleton
with 16 small todo!() helpers, and deliver posting each answer through
answer_posts: disarm, split_answer, disarm each part again, NOTICE once
at the end of the last post when a link was put in a code span.
Checks, against a reference kept off master:
- Replayed from ref 09 in a scratch worktree with its own target/: the
task's edits (applied from the task text) plus the given files plus the
reference bodies are byte-identical to the reference. make gate on
rustc/clippy 1.98.1: gate: ok, 1081 tests (1058 + 7 + 7 + 9). /tmp
holds nothing new after the gate.
- Step 2 (E0432 only) and step 3 (6/1, 7, 9 failing, all "not yet
implemented"; warnings as the task lists) seen in the replay.
- 71 one-line breaks of the reference, each caught by the given tests.
- Differential fuzz of generated Markdown through Mattermost's marked
fork (mattermost/marked c211e4c, the webapp's options) and CommonMark:
on the final code, 600k replies in each mode, half with inline LaTeX
on, render no image and (untrusted) no link.
- disarm(disarm(x)) == disarm(x) on 200k generated replies, both modes.
- Given files pass rustfmt; skeleton comments read beside their
signatures; no chat-template tag in the plan or given files;
deliver_links 40 runs under CPU load, no failure.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
bxcore's TurnDone gains untrusted: bool, always written and required
when read (no serde default: a missing field would read as a clean
session, the wrong way to fail). loopd's new Session::untrusted is true
once any ToolResult in the log is labelled untrusted, and channel::handle
puts it in the TurnDone; the log is the one source, so it holds across
resumes and restarts. gatewayd, bxctl and brokerd sources are unchanged;
their tests that build a TurnDone get new versions. Task 01's broker.rs
is kept as broker.rs-task01, and task 01 now copies it.
Checks: the given tests fail at ref 08 as the task says (strict's
turn_done.json, and 13 test targets with E0560/E0609 only); the task's
edits applied from its text to a fresh ref 08 tree are byte-identical to
the reference; the gate passes with 1058 tests; 12 mutations caught;
/private/tmp and TMPDIR unchanged around the runs; no tag in plan or
given files.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
loopd's self-test gains a check, run second (after "server matches
config", before any prompt): each tag in bxcore::sanitize::TAGS must be
one token from /tokenize, its recorded id, and its neutralised form
more than one. A failure names the tag by its id, never its text, and
points at a new runbook entry, loopd-tags-unexpected, given as a
fragment; SelfTestError::pointer picks the entry per failure. One
request per text (66): /tokenize has no batch form. The fake server
gains respond and a fake tokenizer; selftest.rs, serve.rs, pointers.rs
and support/mod.rs get M5b copies.
Checks, on a reference at ref 08 (titan, rustc 1.98.1, own target/):
- /tokenize fields from llama.cpp tools/server/README.md at b10964
(b29c606) and its handler; on straylight all 33 tags gave their ids
and every neutralised form 7 to 11 tokens, 66 requests in ~0.3 s
- given tests before the change: 4 fail as the task lists, selftest_tags
does not compile (7 E0599); pointers passes
- make gate: gate: ok, 1050 tests (1042 + 8); /tmp and $TMPDIR
unchanged around it; the four suites 25 runs under load, no failure
- 20 mutations, each caught: id not compared; neutralised check
dropped; > 1 as >= 1, as == 1 missing 0, as > 2; first or last tag
skipped; tag asked twice; pointer dropped or wrong (all or Tokenize);
check skipped in serve; check run last; parse_special false;
add_special left out; id missing from the message; the tag's text in
the message; tokenize error as Infer; wrong count; wrong other id
- the task's edits applied to a fresh ref-07 copy give files
byte-identical to the reference; every before block found once
- no chat-template tag whole in the task or given files; task lines
within 100 characters except tables and verbatim lines; given files
under 500 lines
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
loopd neutralises the user's message (the User record), every text
appended as a tool result (results, recall's, denials, failures and
loopd's own answers share the one append in run_turn), after the cap,
and the memory block in Baseline::assemble_with. The model's output,
system.md and replay are untouched: an old log with a raw tag is
replayed byte for byte.
Checks, on a reference at ref 07 (titan, rustc 1.98.1, own target/):
- given tests before the change: 7 of 9 fail as the task lists; the
two that guard what must not change pass before and after
- make gate: gate: ok, 1042 tests (1033 + 9); /tmp unchanged around it;
the two new suites 20 runs, no failure
- 14 mutations, each caught: user not neutralised; neutralised before
the cap; recall path missed; only untrusted results; truncated from
the final length; block not neutralised; model content, reasoning or
tool arguments neutralised; replay re-neutralises user, tool or
system; open rewrites records; system.md neutralised too
- the task's edits applied to a fresh ref-06 copy give files
byte-identical to the reference; every before block found once
- no chat-template tag whole in the task or given files; task lines
within 100 characters except tables; given files under 500 lines
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
memoryd's writes go through bxcore::sanitize::refuse, then flag; check.rs
and its test go. A refused write answers with the rule's sentence and is
logged with the rule's name; a flagged identity write becomes untrusted
notes with the rule in the answer, the journal (new optional field `flag`)
and the log, and is never staged for review; the block leaves out an
entry that breaks a refuse rule and logs the rule. The three runbook
entries the new pointers need are given here as fragments, because the
gate's runbook check fails on a pointer without its entry.
Checks, on titan (rustc 1.98.1, clippy 0.1.98):
- given tests fail before as the task says: 7 failing in edit, serve and
serve_sanitize; files and sanitize do not compile (E0609; E0432, E0609,
E0615)
- the task's edits, parsed from the task file and applied to a fresh
ref-05 worktree with its own target/, give a tree byte-identical to the
reference; its gate: ok, 1033 tests; /private/tmp unchanged
- 26 one-line mutations of the reference, each caught by the given tests
- new tests stressed under load: 30 runs, 0 failures
- no chat-template tag and no whole fake key in the task or given files
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The design model's review of task 05: a recalled flagged note taints the
reading session, so a false positive on a code-work note costs a session.
- dump-conversation: the object must end its clause (a new part, Ends,
and a function to write, ends_clause): punctuation after it, the last
word, or one of so far, above, to, into, in, with, verbatim next. "include
the conversation id in each log line" and CLAUDE.md's "spike output that
contains conversation content" now pass (code-work corpus).
- persist-agent-config dropped: Boxmaker's agent never loads AGENTS.md,
CLAUDE.md, .cursorrules or .clinerules as its instructions. Listed under
not ported; its notes are code-work cases, its attack a decided edge.
- normalise folds the typographic apostrophes U+2018 and U+2019 to '.
- The corpus is split: other scripts and decided edges move to
sanitize_flag_edges.rs, keeping each file under 500 lines.
Checks: make gate on the reference (ref 05, 818dbc7), rustc 1.98.1: gate
ok, 1023 tests (22 + 2 + 2 new); the task applied to a fresh ref-04 copy
is byte-identical to it; 60 mutations, each caught; /tmp unchanged around
the gate; no chat-template tag in the task or given files; given files
pass rustfmt and the 500-line limit.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task 05 adds normalise (case, full width, white space and zero-width,
leetspeak, fifty Cyrillic and Greek look-alikes from UTS #39
confusables 18.0.0) and flag: nine rules, eight ported from Hermes
Agent's tools/threat_patterns.py (NousResearch/hermes-agent at d0288be,
MIT) as word sequences with bounded gaps, and M5a's six phrases. Given:
two skeletons (eleven small todo!()s, tables whole) and two test files
(21 unit tests, 4 corpus tests including Russian and Greek notes and a
table of decided edges).
Checks: the given tests fail before for unresolved imports only (E0432);
the reference (ref 05) passes make gate on rustc 1.98.1, 1022 tests;
the task applied to a fresh ref-04 copy is byte-identical to it; 45
one-line mutations, each caught; /tmp unchanged around the gate; no
chat-template tag in the task or given files; given files pass rustfmt
and the 500-line limit; every todo!() comment read beside its signature.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The private-key rule also refuses a line that starts `-----BEGIN` and
ends `PRIVATE KEY BLOCK-----`, OpenPGP's armor header (RFC 9580
section 6.2.1; RFC 4880 section 6.2). The two endings are a given
table, PRIVATE_KEY_ENDS; the skeleton's private_key comment names it.
A PGP private key block joins the attack corpus, a PGP public key
block and a signature the code-work corpus, and the edge test gains an
indented PGP header (refused), a PGP public header and a PGP header
without its closing dashes (both pass).
Checks: the reference passes the gate on titan, 997 tests (unchanged:
the cases are inside existing tests), /tmp unchanged around the run;
the task's edits applied to a fresh ref-03 copy are byte-identical to
the reference; 8 private-key mutations, 4 of them new for PGP, all
caught; tag and private-key-header greps over the task and given files
are empty; given files pass rustfmt and the 500-line limit.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The refuse half of spec 6.1 in bxcore: M5a's control and invisible
rules and tables, the tag rule narrowed to task 03's exact matching,
and new rules for private use, noncharacters and known-prefix secrets
(GitHub, GitLab, sk-, Slack, AWS, private-key lines). A skeleton with
eight small todo!()s; the rule table, sentences and secret tables are
given filled in. memoryd is untouched until task 06.
Checks: given tests fail before (E0432, then 16 not yet implemented);
the reference passes the gate on titan, 997 tests (981 + 16), /tmp
unchanged around the run; the task's edits applied to a fresh ref-03
copy are byte-identical to the reference; 36 mutations, all caught
(one needed a new case: lower case after AKIA); tag grep over the task
and given files is empty; given files pass rustfmt and the 500-line
limit; every todo!() comment read beside its signature.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task 03 is now the tag list and sanitize::neutralise; refuse moves to 04 and flag
to 05. The list is the 33 control and user-defined entries of the model file
straylight's router loads (Ornith-1.5-35B-Q4_K_M.gguf, snapshot 12393612fd4f,
llama-server b10964-b29c606), each checked with /tokenize on 2026-09-26 to be one
token with its id. Review focus 1 is decided by the same measurement: a tag
inside a word is still the token and is neutralised; upper or mixed case, a
zero-width, space or line-feed split, and full-width brackets are not, and are
left as is. Each shape is pinned by a given test.
Checks: the given tests fail before (E0432, no bxcore::sanitize); the reference
passes make gate on titan (rustc and clippy 1.98.1) with 981 tests (963 + 18);
16 mutations of tags.rs, all caught; no failure message prints a tag; /tmp
unchanged around the gate; the task's edits applied to a fresh ref 02 tree give
a tree byte-identical to the reference; no plan or given file holds a tag whole;
given files pass rustfmt and are under 500 lines.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The task moves gatewayd's secret store to bxcore::secrets behind the
Cargo feature `secrets` (spec, section 5). The moved module is given
whole; SecretSpec and SecretSource move with it, so gatewayd's config
keeps its [secrets.<name>] table with the per-secret type from bxcore.
load and read_checked take the role's name first, so the three
sentences that named gatewayd literally now name the role; gatewayd
passes "gatewayd" and its bytes are unchanged (its tests/main.rs pins
them and is not touched). A given loopd test parses the three
manifests (loopd's, the workspace entry, bxcore's features) and checks
the cfg line in bxcore's lib.rs; the task also checks `cargo tree -p
loopd -e features` and builds loopd on its own.
Checked: the reference, replayed from the task text applied
mechanically to the start tree (master plus task 01), is byte for byte
the reference; every before block found exactly once there. Step 2's
failures recorded from that tree: ten test targets with E0432 on
`bxcore::secrets`, two of four no_secrets tests. make gate on titan's
toolchain: gate: ok, 963 tests (956 + 3 + 4), clippy clean, /tmp
unchanged across the run. 23 one-line mutations of the reference, all
caught; removing the zeroize wrapper is not observable and not counted. Given
files pass fmt and the line limit; no chat-template tags.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task file and 13 given files (2 new: the wire fixture with a detail and
brokerd/tests/invalid_detail.rs; 11 new versions of existing tests, most
only adding `detail: None`).
Checked against a reference in a scratch worktree with its own target/,
on titan (rustc 1.98.1, clippy 0.1.98): make gate prints gate: ok with
956 tests (944 + 12 new); /tmp has no new entries after the gate. All 21
quoted before-blocks occur once in master, and applying the edits to
master gives the reference byte for byte. The given files are the
reference's, formatted, none over 500 lines; no chat-template tag in
the plan.
Before the edits, strict's envelopes_reject_unknown_keys_at_every_depth
fails and ten test targets do not compile, as step 2 lists.
Mutations: 21 one-line breaks of the reference; 20 caught by the given
tests. The one not caught (dropping `default` from the detail attribute)
cannot change behaviour: serde reads a missing Option field as None.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task 00 (proto -> bxcore) by the design model before the run; fourteen
Ornith tasks: the invalid-arguments detail, the secrets move, the
sanitizer in three tasks, memoryd, loopd's neutralising and self-test,
TurnDone.untrusted, gatewayd's links, bxctl sanitize check, the instance
lock in two tasks, and the runbook. Global constraints, five review-focus
inputs each owned by a task, and the interfaces between tasks. The task
files and the reference come next, through docs/plans/CHECKLIST.md.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
One list for the design model to work through per task, gathering the
task-writing tips that apply before hand-over (T18, T19, T24 to T29,
T32 to T35, T39, T40) and three new ones from the combined Ornith
guidance: walk each given test by hand against the task's rules (T41),
grep earlier given files for anything the task changes (T42), and run
the gate's own checks on the given files (T43).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
21: the ledger raises a session's state by the stricter of the grant's
label and the result's own, so a clean session that recalls a
memory-tainted note becomes untrusted and cannot write it into
memory.md (found on straylight, 2026-09-25). 22: the answers to a note
name notes.md, and for an untrusted add the file that was not changed.
The new given tests are ledger_label.rs and new versions of memoryd's
edit.rs and serve.rs; the old copies are kept as -task06 and -task10. On
a scratch tree at the end of task 20: the named tests fail and then pass,
5 and 4 mutations are caught, and the gate passes with 944 tests.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Titan serves ornith-1.5-35b-a3b itself, so OpenCode there uses
titan/ornith-1.5-35b-a3b. The harness's device checks still use straylight.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The work moved to titan (macOS), where the gate failed for reasons older
than M5a: sockets under macOS's long TMPDIR pass its 104-byte limit,
gatewayd reads /proc/self for its uid, and /tmp is /private/tmp. Task 16
sets TMPDIR=/tmp for every process Cargo runs (.cargo/config.toml [env]),
has gatewayd take its uid from the owner of a pipe it makes (no dependency,
no unsafe), and hands over a toolkit shell.rs that compares resolved paths.
On a scratch tree the gate passes on titan and on talos with 936 tests, and
a wrong uid fails 7 gatewayd tests. Tasks 16 to 19 are renumbered 17 to 20.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
review::submit counted only the writes still waiting, so a write staged
after an accepted one got that one's id and was lost: never listed, never
acceptable. It now counts every Waiting line of the day. On a scratch tree
with task 16's line applied, both new tests fail and then pass, the old code
and a count of every line are both caught, and the gate passes (938 there;
941 after task 18).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
entry_problem refuses any line that starts with the separator, and a noted
header with an unknown last part is not a header. The new given tests are
forgery.rs and new versions of memory_args.rs and notes.rs; the old copies
are kept as -task02 and -task06. On a scratch tree at the end of task 17,
the three tests named in the task fail and then pass, four mutations of the
fix are caught, and the gate passes with 939 tests.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task 16: memoryd takes the day and the month of a time with str::get, never a
slice. Task 17: repeated error lines in memoryd, proto, brokerd and bxctl
written once. Neither changes behaviour. Both were applied to a scratch tree
from 5f82260: the gate passes with 936 tests, and four mutations of the new
helpers are caught by the existing tests. The README runs with OPENCODE_MODEL.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task 04's second session stopped too. It checked its code against the
markup test cases in its reasoning, and the tag it spelled out ended
its reasoning. Building tags from pieces keeps them out of files, not
out of the model's thoughts.
check.rs is now given whole, with the tags from pieces, and task 04
fills only entries.rs. The three later tests that used a tag only as
something the check refuses now use an instruction phrase or an
invisible character. They pass against the reference.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task 04's session read the given test and the check.rs skeleton, both
holding the tags the check refuses, and Ornith took them for its own
template. It lost track of the file and made no change. The tags are
now built with concat! and format! in check.rs and in the four given
tests that held them, and the spec describes them in words. The
rewritten tests pass against the reference, are rustfmt-clean, and
still catch the case-folding mutation.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
memoryd (files, the check, edits, journal, index, recall, serving),
the memory tools and built-in grants in brokerd, the memory block in
loopd, bxctl reindex and memory, and the device checks with memoryd.
Each task was built as a reference and gated. Each was replayed on its
own at its end state (854 to 936 tests) and mutation-checked. Each
skeleton compiles and fails its tests. Every todo comment was read
beside its signature.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The review of tasks 01 to 15 goes in the implementer log, with the
device check against the owner's Mattermost. Three follow-ups:
- 16: the refusal without a runner says why.
- 17: the texts that say who asked.
- 18: approvals from non-approvers in direct or group messages go to
an approver.
Task 14's given serve_approvals.rs becomes serve_approvals.rs-task14,
since task 18 hands over a new version. Tip T31 is added.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task 15's session found the defect in serve/approvals.rs, a file it did not list, and stopped.
The comment in task 14 used one name for two values; task 14's tests could not reach it. Lesson T30.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Skeletons for new files only; existing files change by exact edits, so no task overwrites an
earlier one's work. Each task's tests were run against a reference built in order from master,
with the gate at each step and mutations checked; each skeleton compiles and fails its tests, and
every todo!() comment was read beside its signature. The reference is kept off this machine.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The test swaps the file between the check and the open through a `between` hook. A reference fix
passed it and the gate (769 tests) in the working tree, caught two mutations, and was removed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A script that rewrote the skeleton's comments put `now_ms`'s text on `post`. Task 14's second
session saw the contradiction and deliberated until cut off. Both comments are fixed, each
todo!() comment in tasks 14 and 15 was read beside its signature, and both tasks now say to stop
and quote a comment that does not fit. Lesson T29.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
kyleandClaude Opus 5.5