Spec 13 requires that a secret session's query is sent unless the query
itself holds a known-prefix secret. serve.rs already ignores MemoryCall
taint on both read tools; the serve tests always sent Private. A skip of
Honcho for Secret would not have failed. Each suite now has one call at
class secret that asserts the fake received the search or chat.
Co-Authored-By: Grok 4.6 <noreply@x.ai>
json_prints_only_json_and_never_asks_brokerd failed once under load: the helper wrote the typed
input to a `bxctl chat --json` that never reads stdin and had already exited, and unwrapped the
broken pipe. A broken pipe on that write is now accepted; any other error still fails the test,
and a test whose input must be read checks the output.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
From M5c-2 task 00's recordings on rift: a chat at reasoning low returned raw tool-call markup,
and a search with no match still returned the nearest messages.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Workspace search with a limit and with no match, conclusion queries for the owner's and another
agent's peer, and what a workspace that does not exist answers to search, query, chat and delete.
Recorded through roncho 1.0.0's blocking client in the throwaway workspace boxmaker-plan-probe,
deleted afterwards.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Owner, 2026-09-28: recall and ask_memory query Honcho from a session of any class, since Honcho
stores no query and rift's models and telemetry stay on the owner's hosts; the assumption is
written down, with what changes if rift's configuration does. A query holding a known-prefix
secret is refused. ask_memory names at most two workspaces, both asked at once inside brokerd's
wait. A session keeps the tools array it started with, so M5c-2 needs no new epoch.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Every M5c-1 item of the spec's section 13 passed against a build of m5c1 with the review's fixes:
clean, untrusted and secret turns routed as decided, a remembered fact concluded at once and
deleted by undo, a secret session's memory write skipped, and an outage waited out and drained
with nothing sent twice. The check's three rift workspaces were deleted afterwards.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The serve tests waited for the socket file, then killed `loopd` and read its stderr, but the
socket is bound before its mode is set and before "serving on" and the broker notice are printed,
so a kill in between lost those lines (`pointers` failed once under load in M5c-1 task 15). The
broker notice now comes before the bind, so "serving on" is the last startup line, and the tests
wait for it (`tests/support/serving.rs`).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Every path that told the loop `Ended` did so while the handler still held the receiver of the
approver's answer; it was dropped only when the handler returned. An answer sent in between was
taken, reported to the approver as sent, and lost. `end` now takes the receiver and drops it
first. `brokerd_closing_first_ends_it_as_no_longer_pending` failed 10 of 60 runs under load
before, and 0 of 100 after.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The review of tasks 01 to 15 in the implementer log, with the six findings fixed in review. Nine
tips for writing tasks from the run's transcripts and the review, new evidence for I16 and I17,
and four rules in AGENTS.md: the Cargo registry is outside the repository, `git stash -u` and the
README's flaky tests, an edit never anchors on another line, and what a test count includes.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The worker marked a turn failed on any error reading its log. A missing log,
a damaged line or a turn not found still fail it; any other I/O error is now
waited out with the outage's doubling wait, logged once when it starts and
once when the log reads again (pointer session-log-damaged, whose runbook
entry now covers it), shown by bxctl memory sync, and the turn stays waiting.
read_records tells an unreadable file from a damaged line (read_log is
unchanged). The message helpers move from worker.rs to honcho/messages.rs,
re-exported, to keep worker.rs under 500 lines.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
has_secret masked each character a character rule matches to a space, so one
zero-width space inside a key cut it into two runs too short to match. The
secret rules now also run on the text with those characters deleted, and the
text is a secret if either matches.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A shared status, kept by the worker and the walk and read by the report under
its own leaf lock, holds the workspaces whose key was refused, when an outage
of Honcho began, and when brokerd stopped answering. The report adds a line
for each while it lasts, and is unchanged when all is well. The runbook's
Honcho entries and broker-state-unavailable now say what sync shows.
Tuning and Wake move to honcho/wake.rs (re-exported from worker) to keep
worker.rs under 500 lines. honcho_sync.rs's serve test now allows the outage
line: the write wakes the worker, which finds Honcho unreachable.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A write, an undo or an accepted write decided into the ledger waited out the
worker's 30 s idle sleep. Mirror::journalled now says whether it added a line,
and memoryd wakes the worker when it did. The Wake lock is a leaf, taken under
the index lock as before.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Undoing a consolidate concluded its moved entries a second time, and a later
removal deleted only the newer conclusion. An undo's added entry is now
concluded only when the ledger decided a Conclude for it and then an
Unconclude: an entry still concluded, or never concluded (a secret session's,
one from before sync), gets nothing. Ledger::concluded and unconcluded answer
from the decisions, in a module of their own to keep ledger.rs under 500 lines.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The journal now records each call's class (absent on the owner's undo and on
older lines, which still read). The mirror turns everything a secret write
would conclude or send to the fleet into one Skip, after its deletions, which
still go; a note whose own header says secret is skipped the same way.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A memory write is made during a turn, before that turn's Honcho session exists, and a session
whose turns are never synced has none, so each Boxmaker session's conclusions go to its own
<id>_memory session, holding the agent's peer and the owner's. `bxctl memory undo` refuses notes
(they are append-only), so the undo-of-a-fleet-note row and its retraction go. Owner, 2026-09-28.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The ledger cannot promise an item is never sent twice: a crash between a send and its sent line,
or an owner removing that line, sends it again. A decided line holds a skip and its reason, as
task 07's ledger does. Turns from before sync began are skipped (owner's decision, 2026-09-28).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
memoryd.toml gains an optional [honcho] section, [[honcho.read]] and the
Honcho keys in [secrets.<name>], checked at start into
memoryd::honcho::config::HonchoConfig (13 reasons, runbook entry
honcho-config-invalid given as a fragment), and [sockets] state for
brokerd's state.sock. Keys are checked, never read; no [honcho] leaves
memoryd as it was. memoryd enables bxcore's feature secrets.
Checks: a reference at ref 05 + this task passes make gate with 1188
tests (1171 + 17); /tmp unchanged around the gate; the given tests fail
before as the task says (two targets do not compile, 4 start tests
fail); 49 one-line mutations of the reference, all caught (one gap, a
URL with a user and no password, found and closed); the new tests 40
times under CPU load, no failure; a replay from the task text on a fresh
ref-05 worktree with its own target is byte-identical and passes the
gate, and every before block was found once; given files pass fmt and
the 500-line limit; no chat-template tag in any file.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
brokerd serves a third socket, [sockets] state (default
<home>/run/memory-broker/state.sock), bound by the same listen (dir 0700,
stale socket removed, socket 0600), one thread per connection, one
question per connection. The answer is StateStore::read: the stored taint
and flag, the store's default (private, trusted) for a session with no
file. A damaged state is an internal error with the store's text, never an
answer; other kinds are forbidden; malformed frames get read_request's
error. A new tests/serve.rs waits for an answer before reading the
startup notices (a race that failed about one run in ten under load,
before this task too).
Checks: every before block found once at ref 04 (20 edits); the new file
in the task is byte-identical to the reference; the given tests fail
before as the task says (config and state_socket do not compile;
serve_state 5 of 5 fail); gate ok with 1171 tests on the reference and on
a replay from the task text in a fresh ref-04 worktree with its own build
dir (byte-identical to the reference; removed); /tmp unchanged around the
gate; 25 mutations, 24 caught, the one missed (state bound last) changes
no tested behaviour; the socket tests 25 runs under load, 0 failures;
no task-text line over 100 characters outside tables and code.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The speaker goes on every turn of the chat: interactive, --say and --say's retry. Without the
flag it is None. A name that is empty or holds whitespace or a control character (Unicode), or a
second --speaker, is a usage error: the usage text on stderr and exit status 2. The usage text
gains the flag and one line explaining it. Given: chat_speaker.rs (new) and new versions of
chat.rs, chat_approvals.rs and cli.rs. Task 01 now copies chat.rs-task01, the older chat.rs.
Checks: every before block found once at ref 03; replayed from the task text on a fresh ref-03
worktree with its own build directory, byte-identical to the reference, gate ok with 1158 tests
(1148 + 10); /tmp unchanged around the reference's and the replay's gate runs; 20 of 20
mutations caught; the new tests passed 40 of 40 runs under CPU load; given files pass fmt and
the 500-line check; no chat-template tag in the plan or the given files.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A batch carries the Mattermost user id of each message; the turn's speaker
is the username of the one user who wrote all of it (Client::username,
kept in a map on the event loop), and None for two or more people or a
failed lookup. The turn's text is unchanged.
Checks: reference replayed from the task text on a fresh ref-02 worktree
with its own build dir, byte-identical; make gate ok with 1148 tests
(1138 + 10); /tmp unchanged around both gate runs; 21 mutations, all
caught; new tests stressed 40 times under load, no failure; every before
block found once at ref 02; no chat-template tags.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The owner's hosts (titan, talos) run 1.98.1; nixos-26.05's Rust is
1.95.0, so builds and lints differed by host. The flake gains a second
input, oxalica's rust-overlay (following our nixpkgs, so host configs
can still follow theirs), and both the package build and the dev shell
use its stable 1.98.1 with clippy and rustfmt. The workspace's
rust-version rises to 1.98 to match; AGENTS.md, docs/dependencies.md
and the M5c-1 plan follow.
Checked on straylight: nix build gives all seven binaries; the dev
shell has rustc, cargo and clippy 1.98.1, rustfmt 1.9.0, cargo-deny
0.19.6; make gate in it passes with 1122 tests, as on titan.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
loopd copies the Turn's speaker onto the User record it logs, as it
came (not checked, not neutralised), and never into a request; after a
finished turn it sends SessionUpdated with the turn's number, the count
of User records in the session's log (Session::turns), so the first
turn is 1, a failed turn that was logged counts, and the count goes on
after a reopen or a restart. Failed turns are still not told.
Given: speaker_turn.rs (8 tests) and new versions of loopd's memory.rs,
turn_broker.rs, end_to_end.rs and support/turn.rs (run_turn gains
speaker, MemorySource::updated gains turn). Task 01 now copies
memory.rs-task01, its own version.
Checks: the reference passes make gate with 1138 tests (1130 + 8); the
task replayed from its text on a fresh ref-01 worktree with its own
target is byte-identical to the reference and passes the gate; /tmp
unchanged around both gate runs; 15 one-line mutations (speaker not
logged or dropped by the channel or neutralised, speaker in the request
at log time or at replay, turn 0-based or +1, counting Assistant
records, all records or only speakers' turns, a global or per-process
counter, told before logging or on failure, MemoryPort sending 0) all
caught; speaker_turn run 60 times under load, no failure; no
chat-template tag in the plan or given files; task lines within 100
characters but tables.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task 01 changes bxcore's wire and log types for M5c-1: Turn.speaker and
LogRecord::User.speaker (optional, skipped when None, so old frames and logs
keep their bytes), SessionUpdated.turn (required, refused when missing), and
the new SessionState / SessionStateReply messages. The other crates only
construct the new fields (speaker: None, turn: 0) and brokerd's kind() names
the two new kinds; later tasks give them values. 20 given files.
Checks, against a reference at 7b40686 with its own build directory:
- every "before" block found exactly once at 7b40686 (and at master, which
changed no crate since);
- step 2's failures as the task names them: two strict tests, fifteen test
targets with E0559/E0560/E0432/E0599 only;
- make gate: gate: ok, 1130 tests (1122 + 8); /tmp unchanged around it;
- replay from the task text in a fresh worktree of 7b40686 with its own
target/: crates/ byte-identical to the reference, gate ok, 1130; removed;
- 23 mutations: 21 caught; the two that drop `default` from an Option
field cannot change behaviour (serde reads a missing Option as None);
- no chat-template tag whole in the task or the given files; lines over
100 characters only in tables, fixtures and verbatim strings.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
`.envrc` runs `use flake` when Nix is present, so on the NixOS hosts
(programs.direnv.enable brings direnv and nix-direnv) cd'ing into a
clone gives the pinned Rust toolchain, clippy, rustfmt, cargo-deny and
make; on titan, which has no Nix, it does nothing. nix-direnv's cache,
.direnv/, is ignored. Checked on straylight in a throwaway copy:
cargo 1.95.0, cargo-deny 0.19.6, rustc from the Nix store.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
29 request/response pairs, each request exactly as roncho 1.0.0's
blocking client sends it, recorded in a throwaway workspace
(boxmaker-plan-probe) created for it and deleted afterwards; no other
workspace was touched. For the fake Honcho server of task 10. Found:
creation is get-or-create (201, then 200); adding messages to a missing
session creates it; a 422 echoes the whole input; a deleted conclusion
answers 204 with an empty body, and 404 the second time.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The owner's Honcho client, blocking, with TLS: default features off,
feature tls. It adds only itself to the lock file (checksum a5ccccc2…,
as checked against crates.io in review). cargo deny passes. The
dependency and the egress to rift are documented; the egress table also
lists the design model's probe of rift in a throwaway workspace.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Memory items 4 and 5: two workspaces per agent and one fleet workspace
for untrusted notes; the private ceiling, secret sessions never synced;
trusted memory writes mirrored as conclusions; the agent's peer not
observed; no rebuild, corrections by contra-fact or deleting our own
conclusion; the fleet workspace always untrusted. Recorded in
docs/decisions.md.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A turn without complete speaker information is not sent; every peer in
the fleet workspace is a member, so fleet notes are messages that one
search finds, with a retraction message for an undone note (Honcho
cannot delete a message); the fleet workspace derives nothing
(reasoning, summaries and dreaming off); API keys per workspace are
first-class, with a runbook entry for a refused key.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Designed with the owner on 2026-09-27: per agent a trusted and an
untrusted workspace plus one fleet workspace for untrusted notes;
private ceiling, secret sessions never synced; no rebuild (contra-facts,
or deleting our own conclusion); the owner and other people observed,
the agent not; every trusted memory write mirrored as a conclusion; a
decision ledger that doubles as the outbox; recall over the local index
and the fleet; ask_memory by workspace chat. Grounded in roncho 1.0.0
and Honcho 3.2.0 (source read at v3.2.0) and rift's live metrics.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
decisions: M5b settles the invalid-arguments reason, tag
neutralisation and the shared secret store (their open rows go), and
the verdict on the run's two driver trials. CLAUDE.md's current state:
M5b done, M5c (Honcho, roncho 1.0.0) next; straylight's clone is
boxmaker-m5b.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Found in the M5b device check on straylight: the self-test asked about
each of the 33 tags and each neutralised form, 66 requests, one
connection each, and inferproxy's token bucket (burst 10) refused the
ninth, so loopd would not start. Now it asks about all the tags at once,
one per line, and then all their neutralised forms: the answer to the
first must hold each tag's recorded token in order, the second none of
them. Each tag is a special token, split out before anything else, so
the lines between cannot change it; and a neutralised form is only
dangerous as a tag's own token, so that is what the second answer must
not hold. The errors name a tag by its id, as before.
The fake tokenizer reads text with several tags in it; the tests cover
each tag as ordinary tokens, as another listed or unlisted token, a
duplicated token in the middle and at the end, a form holding each tag,
and both requests failing. Spec section 8 and the runbook entry follow.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
kyleandGrok 4.6
