boxmaker/docs/plans/M6b/README.md

M6b implementation plan: consult

For the implementer: each task file is one closed task for one fresh session. Read AGENTS.md, then the task file, and do exactly that task. The driver is tools/run-plan.sh.

Goal: a consult tool, not core, decided by brokerd. The grant's max_taint is the class gate. brokerd POSTs an allowlisted chat-completions body (question only, no history, no tools) over loopback HTTP/1.1. Every decision records that JSON body, including a denial. No vendor names in code.

Architecture: loopd registers consult after subagent and Ports it to brokerd. timeout_for("consult") is 180 s or [broker] timeout_ms, whichever is longer. brokerd loads [consult] and the named bxcore::secrets key at start. No [consult] denies with consult-not-configured. The HTTP client is not a container and not http_fetch.

Tech stack: Rust 1.98.1, edition 2024; no new crate. HTTPS is later.

Spec: docs/specs/2026-10-04-m6-subagents-consult.md, sections 4, 5, 6, 7 (M6b tests), and 8 (consult-not-configured, consult-secret-unreadable).

The owner's decisions (2026-10-04)

1. Given tests use an in-process fake. The device check starts a loopback dummy on straylight. No live vendor in M6.
2. Cloud-led sessions are later, not in M6. consult stays text-in, text-out, no tools.

What the code already has, and what it lacks

• subagent is in m5c(), not core. dispatch Ports every other non-core name to brokerd. There is no consult tool.
• BrokerPort::timeout_for special-cases only ask_memory. [broker] timeout_ms defaults to 120_000; do not change that default.
• brokerd.toml has no [consult] and no [secrets]. brokerd does not enable bxcore's secrets feature.
• ToolName has no Consult. Grant.untrusted already defaults true.
• AuditEvent::Decision has no body.

Global constraints

• Roles depend on bxcore only. No unsafe, no async runtime, no new crate.
• No file the implementer reads holds a chat-template tag whole (T33): build tags from pieces (concat!("<", "think", ">")).
• Every path a given test creates is removed by a guard (T44); no test depends on timing (T27).
• Fail-closed states consult-not-configured and consult-secret-unreadable have runbook entries, added by the task that adds the pointer (T49).
• Each task gives its baseline and its gate count (T50, T53); the branch line is a check, never git switch (T51).
• Cargo.lock is in the git add line (T24). Gate timeout 600000 ms (T40).
• docs/implementer-log.md: at log-and-commit, read only the first 12 lines (T62).
• Do not edit existing given tests the task does not list (broker_port_ask_wait.rs, crates/loopd/tests/config.rs, crates/brokerd/tests/grants.rs rule_3, crates/brokerd/tests/config.rs).

Tasks

Every task below has been written to be replayed from its text. The gate count is the passed total of cargo test --workspace plus one, for the ignored end_to_end test the gate runs on its own. Before task 01 it is 1590 (straylight, rustc 1.98.1 / clippy 0.1.98; M6a).

#	Delivers	Crates	Gate after	Tests added	Mutations tried, caught
01	consult in m5c(), not core; epoch tools array unchanged	loopd	1592	2	1, 1
02	CONSULT_WAIT 180 s via timeout_for; default [broker] timeout_ms stays 120_000	loopd	1593	1	1, 1
03	[consult] + [secrets]; start fails closed; runbook both consult entries	brokerd	1602	9	2, 2
04	ToolName::Consult; parse; grants covers as Some(None); no paths/hosts	brokerd	1606	4	2, 2
05	Decision body; not-configured and TaintTooHigh record the body	bxcore, brokerd	1609	3	2, 2
06	Fake HTTP 200; audit body equals posted JSON; tool result is the answer	brokerd	1611	2	2, 2

Mutations (reference, one line each, restored after): core: true fails both task-01 tests; dropping the consult arm of timeout_for fails consult_waits_one_hundred_and_eighty_seconds and leaves the_wait_for_each_tool green; skipping parse_loopback_http in validate fails a_non_loopback_url_is_invalid; skipping the 0.6 check in de_temperature_milli fails temperature_above_zero_point_six_is_invalid; omitting Consult from parse fails consult_parses_and_is_not_a_container_tool; omitting the paths arm fails consult_does_not_take_paths_or_hosts; omitting decide_forced when [consult] is absent fails no_consult_table_is_denied_with_the_runbook_and_records_the_body; omitting body on the event fails both deny tests that assert the body; skipping neutralise fails the < assert in an_allowed_consult_posts_only_the_question_and_returns_the_answer; posting a second message in wire_body_parts fails the_consult_body_is_only_the_question.

After task 06, the design model runs the M6b device check (spec 7) on straylight: a loopback OpenAI-compatible dummy the check starts; a clean session's audit body matches a captured request; a session that first recalled an untrusted note is refused. Slot 1 is left busy. No internet consult.

Review Focus

• consult is not in the epoch tools array (task 01).
• [broker] timeout_ms still defaults to 120_000 (task 02).
• URL is loopback http:// only (task 03). Temperature ≤ 0.6.
• A consult grant with paths or hosts is invalid; unknown tool names still fail with the four-tool sentence (task 04; do not edit rule_3).
• A denial still records the body that would have been sent (task 05).
• The posted bytes equal the audit body; messages has one user item, no tools (task 06). The answer is tag-neutralised.

Known limits

• No internet consult in M6. A live URL later is its own egress row, grant, and secret.
• No HTTPS in M6. The client is HTTP/1.1 to 127.0.0.1 or localhost.
• Cloud-led sessions are not in M6.

Before hand-over

Work through docs/plans/CHECKLIST.md with a reference in a scratch worktree with its own build directory, replayed from its task text; mutations; /tmp compared around a gate run; the reference moved off this machine as a bundle before the run (T18). Task files name their log row (T47).

Running it

The reference (m6b-ref at 5fb05f0, tasks 01 to 06) is a git bundle ~/boxmaker-refs/m6b-ref.bundle. Copy it to straylight and delete the local worktree (/home/kyle/boxmaker-refs/m6b-ref) and branch before the run (T18). Then, from the repository root, with the OpenCode TUI closed, after M6a has landed on master:

git switch -c m6b master
OPENCODE_MODEL=llama.cpp/ornith-1.5-35b-a3b RESUME=1 \
  SLOTS_URL='http://straylight:11434/slots?model=ornith-1.5-35b-a3b' \
  tools/run-plan.sh docs/plans/M6b 01

After task 06, the gate count is 1611. Then the device check above.