Code spans stop both the link preview and the server's image fetch;
Markdown links are not previewed; images are fetched by the server at
posting time. Emoji refusal accepted, phrases move to flag, Hermes'
patterns ported at plan time.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
bxcore (compiler-driven rename, with the spike's four layers named); the
invalid-arguments reason on the wire; the secret store moved into
bxcore behind a feature loopd never enables; bxcore::sanitize with
refuse, neutralise and flag, its lists, hand-written normalisation, two
corpora, a rule-change procedure and `bxctl sanitize check`; memoryd
refusing and flagging (a flag keeps the text as an untrusted note);
loopd neutralising tags on append, with a tokenizer self-test and the
session's trust on TurnDone; gatewayd escaping images and, in untrusted
sessions, links; a table of every link between the roles; runbook
entries; attack tests per trust boundary and the device checks. Four
points left for the owner in section 14.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Owner's decisions, 2026-09-26. The second row lists what was adopted,
which driver guards are trials for M5b's run, and what was left out.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
One list for the design model to work through per task, gathering the
task-writing tips that apply before hand-over (T18, T19, T24 to T29,
T32 to T35, T39, T40) and three new ones from the combined Ornith
guidance: walk each given test by hand against the task's rules (T41),
grep earlier given files for anything the task changes (T42), and run
the gate's own checks on the given files (T43).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Owner's decision. The hardening half (sanitizer, tag neutralisation,
image links escaped, the invalid-arguments reason, and the secret store
available to every role) needs neither roncho nor Honcho and can be
specified now. Honcho waits on roncho's tagged release. Earlier
documents keep the old numbers; P24 says so.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
What Boxmaker checked of v0.1.0 and the fixes on top of it: the
blocking library now builds and its tests pass, but the quoted
blocking-only test command does not compile (ungated async test
files), and nothing is committed or tagged yet. Five MUST items and
nine SHOULD items remain, a queue-status operation among them. New
requirements R23 to R27 prepare for rift turning on API keys: 401/403
as their own error, an empty key refused, one key per client, keys
wiped on drop, and the live suite able to run with a key. Choices
roncho made that Boxmaker accepts are listed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
roncho moved twice while the requirements were written. Line numbers are
gone; each divergence is described by what the code does, rechecked at
a9708f1, which added the Workspaces API: O1 and O7 now name the async
functions, and workspace delete does not tell the 409 conflict apart.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The owner chose roncho over a client of memoryd's own. The requirements
for its developer: a blocking client whose dependency graph fits
Boxmaker's rules (no async runtime, licences, no duplicate versions,
Rust 1.95), no default server and no hidden environment settings or
redirects, caller-set idle timeouts and body caps, thirteen operations
checked against rift, the search and paging fixes found reading the
code, and eight questions about Honcho 3.2 to answer from its docs and
rift. References are to roncho at f24fc4a.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Two review entries in the implementer log: tasks 01 to 15 (the header
forgery, review ids, the runbook entries, log rows written from memory)
and tasks 16 to 22 with the device check on straylight (the ledger
raising state by the grant's label, the note answers, the stale target/
that stalled task 21, the clippy 1.95 stop, the fake podman race). Two
short rules go into AGENTS.md: stop after one check when a test outside
the task fails, and write the log row from the diff.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Found in the M5a review: task 13 renamed core-memory-unreadable to
memory-unavailable but kept its body, which still described
memory/core.md, and appended a memory-index-damaged entry of its own that
names a pointer memoryd never prints and leaves out `bxctl reindex`. Its
log row says both fragments were copied. Both entries are now the plan's
fragments, verbatim.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
M5a task 21. The work is Ornith's, from the stopped run; the design
model checked it against the task file and committed it after finding
that the gate's failure came from its own reference worktree's stale
test binaries in the shared target/ (fixed with cargo clean; 944 tests).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
21: the ledger raises a session's state by the stricter of the grant's
label and the result's own, so a clean session that recalls a
memory-tainted note becomes untrusted and cannot write it into
memory.md (found on straylight, 2026-09-25). 22: the answers to a note
name notes.md, and for an untrusted add the file that was not changed.
The new given tests are ledger_label.rs and new versions of memoryd's
edit.rs and serve.rs; the old copies are kept as -task06 and -task10. On
a scratch tree at the end of task 20: the named tests fail and then pass,
5 and 4 mutations are caught, and the gate passes with 944 tests.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Found on the device (2026-09-25): the ledger raised a session's state by
the grant's label, so a clean session that recalled a memory-tainted note
stayed trusted and could add it to memory.md. The spec's "as today" was
wrong; section 8 now says the state is raised by the stricter of the
grant's label and the result's, and the recall section says the session
becomes untrusted. The note answers (section 3) name notes.md and, for an
untrusted add, the file that was not changed: the model read the old ones
as success. Tasks 21 and 22.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Crossbar (main, 4c64158) cannot serve Boxmaker as deployed; agents
connect straight to a host's llama-server until crossbar adds a default
route, per-route stickiness, side calls outside its limiter and
llama-server's error shape. Queued-looks-idle stays open.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
M5a task 16. The work is Ornith's, from the stopped run; the design
model checked it against the task file and committed it once the
memoryd lint that stopped the gate was fixed (44bdcbd).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The three task changes (.cargo/config.toml, copied toolkit shell test, and the three read_checked edits in gatewayd/secrets.rs) are done and all gatewayd/toolkit/brokerd tests pass. make gate does not reach them: it fails to compile memoryd on clippy collapsible_match at crates/memoryd/src/index.rs:224, which fails identically on the original committed code and is outside this task's scope. Per AGENTS.md point 4, committed only this log row.
Titan serves ornith-1.5-35b-a3b itself, so OpenCode there uses
titan/ornith-1.5-35b-a3b. The harness's device checks still use straylight.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The work moved to titan (macOS), where the gate failed for reasons older
than M5a: sockets under macOS's long TMPDIR pass its 104-byte limit,
gatewayd reads /proc/self for its uid, and /tmp is /private/tmp. Task 16
sets TMPDIR=/tmp for every process Cargo runs (.cargo/config.toml [env]),
has gatewayd take its uid from the owner of a pipe it makes (no dependency,
no unsafe), and hands over a toolkit shell.rs that compares resolved paths.
On a scratch tree the gate passes on titan and on talos with 936 tests, and
a wrong uid fails 7 gatewayd tests. Tasks 16 to 19 are renumbered 17 to 20.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
review::submit counted only the writes still waiting, so a write staged
after an accepted one got that one's id and was lost: never listed, never
acceptable. It now counts every Waiting line of the day. On a scratch tree
with task 16's line applied, both new tests fail and then pass, the old code
and a count of every line are both caught, and the gate passes (938 there;
941 after task 18).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
entry_problem refuses any line that starts with the separator, and a noted
header with an unknown last part is not a header. The new given tests are
forgery.rs and new versions of memory_args.rs and notes.rs; the old copies
are kept as -task02 and -task06. On a scratch tree at the end of task 17,
the three tests named in the task fail and then pass, four mutations of the
fix are caught, and the gate passes with 939 tests.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The M5a review found that a note's text could hold a line shaped like a
notes.md header. Read back, the line started an entry of its own: an
untrusted session could plant a 'moved from memory.md' header, and recall
showed what followed it as identity, not untrusted. Entries and notes now
refuse any line that starts with the separator, and a header must match one
of its three forms exactly.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task 16: memoryd takes the day and the month of a time with str::get, never a
slice. Task 17: repeated error lines in memoryd, proto, brokerd and bxctl
written once. Neither changes behaviour. Both were applied to a scratch tree
from 5f82260: the gate passes with 936 tests, and four mutations of the new
helpers are caught by the existing tests. The README runs with OPENCODE_MODEL.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Every row from M2a to M5a that read ? or Ornith, from the reviews' own
records of who ran each milestone. The DEBUG-HANDOFF row stays ? : no record
says which model it was.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
M5a task 04 stopped twice on the chat-template tags the check refuses.
The first time, the model read them in a file and took them for its own
template. The second time, it spelled them out in its own reasoning.
Measured on straylight: the think and tool-call tags are one token
whatever the tokenizer's flag. Inside any chat message, the turn
markers become control tokens, so a tool result can forge a system
turn.
Adds the rule to AGENTS.md, and proposes neutralizing the tags in
loopd as an open decision.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The session did the task and stopped on make verify-device. The cause
was not the server: run-plan.sh and the device tests both read
BOXMAKER_MODEL, and the run's value (OpenCode's provider-prefixed id)
reached llama-server as the model name. With it unset, verify-device
passes 6 of 6. The copied files are identical to the plan's, and the
gate prints gate: ok, 936 tests.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task 04's second session stopped too. It checked its code against the
markup test cases in its reasoning, and the tag it spelled out ended
its reasoning. Building tags from pieces keeps them out of files, not
out of the model's thoughts.
check.rs is now given whole, with the tags from pieces, and task 04
fills only entries.rs. The three later tests that used a tag only as
something the check refuses now use an instruction phrase or an
invisible character. They pass against the reference.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Task 04's session read the given test and the check.rs skeleton, both
holding the tags the check refuses, and Ornith took them for its own
template. It lost track of the file and made no change. The tags are
now built with concat! and format! in check.rs and in the four given
tests that held them, and the spec describes them in words. The
rewritten tests pass against the reference, are rustfmt-clean, and
still catch the case-folding mutation.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
kyleandClaude Opus 5.5