docs(chat-03): brief pinned at 1ef15ac0 after r3 and scope check, lead decision 33 (#1507)
Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Claude Opus 5.5
@@ -0,0 +1,700 @@
|
||||
# CHAT-03 brief: live adapters and mediated terminal (#1507, row 5)
|
||||
|
||||
Author: Dewey, 2026-09-26. R1, for review. This is the brief only. It
|
||||
includes no source, no contract edits and no seat changes.
|
||||
|
||||
Jason chartered CHAT-03 on 2026-09-26 (`docs/plans/2026-09-26_lead-decisions.md`
|
||||
item 22). Plan row: `docs/plans/2026-09-13_webui-session-chat.md` line 215.
|
||||
It depends on CHAT-01 (`28d4e98a`) and implements part of the CHAT-01C
|
||||
companion (`b023841c`). The layout follows `docs/plans/BRIEF-TEMPLATE.md`,
|
||||
and the depth follows the CHAT-02 brief (`636b0fac`). The six carry-forwards
|
||||
Sage set are mapped to their evidence under "Carry-forwards".
|
||||
|
||||
Line numbers and hashes below are at `40a02d2b`.
|
||||
|
||||
## CHAT-03: live adapters and mediated terminal
|
||||
|
||||
### Problem
|
||||
|
||||
CHAT-02 made every repository Pi conversation readable. Nothing can drive a
|
||||
conversation yet except the old paths: the Pi TUI in a tmux pane, and board
|
||||
Reply or agent-send, which paste into that pane. Those paths have no
|
||||
controller, no generation fence and no stop proof. One has already misfired.
|
||||
At 2026-09-26T20:10:57Z a leftover `/` in Pi's composer landed in front of a
|
||||
board reply, because `tools/tmux/send-message.sh` (lines 45–54) pastes onto
|
||||
whatever the composer holds and then presses Enter (`docs/plans/DEFERRED.md`,
|
||||
"Board send can turn into a Pi slash command").
|
||||
|
||||
CHAT-01 defines the records and commands for one controller per
|
||||
conversation. It defers the writer-claim record (`chat-01/README.md:342`),
|
||||
and CHAT-01C defers R3-1 (`chat-01c/README.md:217`). Lead decisions item 8
|
||||
moves both here. The Claude catalogue still refuses `unsupported-harness`
|
||||
(`packages/conversation/src/reader.mjs:24`). Jason ruled that CHAT-03 owns it
|
||||
after B1. Claude on this host reports 2.1.283, but the plan's evidence named
|
||||
2.1.269 (plan line 159). The binary changes under any adapter that does not
|
||||
pin it.
|
||||
|
||||
### Owner and reviewer
|
||||
|
||||
- **Source author: `<slot>`.** The plan has Darkwing name the backend author
|
||||
(line 215; lead decisions item 22). Darkwing is on queue A1/A2, so the
|
||||
author is named after this brief is approved. The brief does not pick one.
|
||||
- Brief author: Dewey.
|
||||
- Filbert reviews this brief, then the exact candidate of each increment.
|
||||
- Rocko does an adversarial pass on §5 (control races) and §6 (stop and
|
||||
recovery), in this brief and later in the code of each increment. Rocko
|
||||
also reviews the B1 packet (§8), because it is evidence that a false pass
|
||||
would turn into a wrong adapter.
|
||||
- No one reviews their own work. If Darkwing names Filbert or Rocko as
|
||||
author, Sage names a replacement for that review.
|
||||
- Tracking: #1507.
|
||||
|
||||
### Files owned
|
||||
|
||||
The source author may create or change only these paths.
|
||||
|
||||
| Path | Contents |
|
||||
|---|---|
|
||||
| `packages/conversation/src/**` | New modules for the controller, claim, supervisor, Pi adapter, events, transport and mediated terminal. The Claude parser and adapter come in 3D. `reader.mjs` changes only to lift the Claude refusal for the pinned version. |
|
||||
| `packages/conversation/tests/**` | Tests, fake engines, fixture extensions and redacted recordings |
|
||||
| `packages/conversation/README.md`, `packages/conversation/package.json` | Documentation and the new refusal names. No new dependencies. |
|
||||
| `agents/<author>/work/chat-03/**` | Review packets, evidence and the B1 packet |
|
||||
|
||||
Module names inside `src/` are the author's call (plan lines 150–151). Any
|
||||
path outside this table needs a brief amendment.
|
||||
|
||||
Excluded, and why:
|
||||
|
||||
- **`tools/tmux/**`.** Plan line 244 excludes it, and §4 shows the mediated
|
||||
path needs no change there.
|
||||
- **`packages/control-board/**`.** No board edit is needed (§4, S6). Tests
|
||||
import `replyToRow` read-only by relative path, the same way the
|
||||
queue-as-data plan imports `scan.mjs`.
|
||||
- **`packages/seat/**`, `scripts/agent-host-dev.sh`, `agents/*/launch.sh`.**
|
||||
No seat migrates, so no seat or launcher changes. The launcher handoff
|
||||
belongs to CHAT-07.
|
||||
- **`packages/webui/**`.** The chat UI is CHAT-05.
|
||||
- **`docs/plans/chat-0*/**`.** Contracts change only through the C items
|
||||
below.
|
||||
- **`roles/**`, `contracts/**`, root files, auth and `~/.mosaic`.**
|
||||
|
||||
No overlap with queue-as-data or the ledger:
|
||||
|
||||
| Owner | Paths | Overlap |
|
||||
|---|---|---|
|
||||
| A1, Darkwing (`agents/darkwing/work/queue-a1/build-manifest.sha256`) | `packages/queue/**`, `scripts/queue-commit.sh`, `scripts/test-queue.sh`, `scripts/git-hooks/pre-commit`, `docs/plans/BRIEF-TEMPLATE.md` | none |
|
||||
| A2, Darkwing (Filbert's plan `282fabbb…` §8.1; lead decisions item 20) | `scripts/mosaic` dispatch, `docs/plans/queue.json`, `docs/plans/QUEUE.md`, `scripts/test-{darkwing,rocko}-launch.mjs` | none. The mediated terminal runs as `node packages/conversation/src/<cli>.mjs`. It is not a `scripts/mosaic` verb. |
|
||||
| Piece B, after A | `AGENTS.md`, `agents/*/CONTEXT.md` | none |
|
||||
| Ledger | `packages/ledger/**` | none |
|
||||
|
||||
The author may import the process-identity helpers in
|
||||
`packages/discord/src/journal.mjs` read-only, as A1 does. That changes
|
||||
neither package.
|
||||
|
||||
### Contracts implemented
|
||||
|
||||
These are unchanged since the commits named. The sha256 values are at
|
||||
`40a02d2b`, and `git status` shows no local edits.
|
||||
|
||||
| Path | sha256 | Commit |
|
||||
|---|---|---|
|
||||
| `docs/plans/chat-00/README.md` | `991663e607404c2f022716bd45b40d5b3092d53c3f9f61bbafd455c0659b832f` | `370823b3` |
|
||||
| `docs/plans/chat-00/sources.json` | `1a07ae88de45fd3219eca10acae13637ca75416cb1c598aa9080825bd7598af9` | `370823b3` |
|
||||
| `docs/plans/chat-00/fixtures.json` | `ad9d4fe94131b2c4bb30691ad846698c5b0818f0935d20a38de73fa3f267bd80` | `370823b3` |
|
||||
| `docs/plans/chat-00/check.mjs` | `568f004f5a0cfce64d65ff202c420ab491e716919a93989377a7bb9e7b8be622` | `370823b3` |
|
||||
| `docs/plans/chat-01/README.md` | `61aba7d60f380ff8a135a04a2e851f11c250795ead11cca2e594566849483163` | `28d4e98a` |
|
||||
| `docs/plans/chat-01/contracts.schema.json` | `38382e08c97635f8864e6953b6cf44ec324040397a1aa8fc3f86e279abe36db1` | `28d4e98a` |
|
||||
| `docs/plans/chat-01/fixtures.json` | `403c8ae91963a379de17805380bc1425bc4e96c1ef34094385b703d17cf5ce7d` | `28d4e98a` |
|
||||
| `docs/plans/chat-01/check.mjs` | `2e164e4bfa61963bb5dd8639e26e67407e64d19278cc56ed8a4f77e430f1dee5` | `28d4e98a` |
|
||||
| `docs/plans/chat-01c/README.md` | `63d9f9edffc2aa1aa3bc99364b864e8c6f234eedc8ad2f9da231531970d54250` | `b023841c` |
|
||||
| `docs/plans/chat-01c/contracts.schema.json` | `da132f0a02f29281344cc5350396af53c893d7895308bc430f9bf3ca3b3785b9` | `b023841c` |
|
||||
| `docs/plans/chat-01c/fixtures.json` | `00639a219b00b67c5e0ab904163a6d945481f6b0df45a058b32e00f1f1326611` | `b023841c` |
|
||||
| `docs/plans/chat-01c/check.mjs` | `5971ed5f11a32f0dff5720db03d8d4bc4c007a5d2654ba50726bb35ba753eba6` | `b023841c` |
|
||||
|
||||
Design inputs, which CHAT-03 does not implement in full:
|
||||
`docs/plans/foundation-v1-candidate/RUNTIME.md` §§3–5 (`b1a2b4d0…`) and the
|
||||
plan itself (`48142829…`).
|
||||
|
||||
What CHAT-03 takes from each contract:
|
||||
|
||||
- **CHAT-01.** The records `binding`, `connection`, `clientRequest`,
|
||||
`request`, `receipt`, `event`, `stop`, `cohortProof`, `effectReport`,
|
||||
`turnProof`, `nativeDecision`, `approval` and `confirmation`. The commands
|
||||
`observe`, `prompt`, `takeover`, `acquire-recovery-control`, `approval`,
|
||||
`interrupt`, `force-stop`, `recover`, `issue-confirmation` and
|
||||
`answer-confirmation`. The draft, upload and queue-edit commands belong to
|
||||
CHAT-04.
|
||||
- **CHAT-01C.** Only the confirmation restoration rules (lines 92–104). The
|
||||
private-state pages, upload ranges and `recover-refused-draft` need
|
||||
CHAT-04's durable store.
|
||||
|
||||
The CHAT-01 text at line 342 stays as published. Lead decisions item 8
|
||||
records the move.
|
||||
|
||||
**Contract changes, each a separate reviewed item.** Each one lands and is
|
||||
approved before the code that needs it. Sage assigns the author; Filbert and
|
||||
Dewey review, as they did for CHAT-01C.
|
||||
|
||||
- **C-1: a state for dispatched input that native evidence proves
|
||||
unconsumed (R3-1).** It also decides whether that input may be recovered
|
||||
into a draft. Q20 says already-dispatched work keeps its actual or
|
||||
uncertain status, so Sage decides whether C-1 goes to Jason. §3 gives the
|
||||
interim rule until C-1 lands.
|
||||
- **C-2: the CHAT-03D native dialog companion.** It covers Pi `confirm` and
|
||||
`select` with exact labels; `input` and `editor` stay unsupported. CHAT-01
|
||||
lines 239–242 and 292 block non-permission forms until it exists.
|
||||
Increment 3B waits for it.
|
||||
- **C-3: Claude record fields.** Needed only if B1 shows that CHAT-01 lacks
|
||||
a field, for example the capability-negotiation result on `binding`.
|
||||
Otherwise C-3 is void.
|
||||
|
||||
Not contract changes:
|
||||
|
||||
- The writer-claim storage record (§2) is internal and never crosses the
|
||||
wire. It stores the CHAT-01 `binding` fields it needs. If one is missing,
|
||||
that becomes a C item, not an edit.
|
||||
- New refusal names (`busy`, `receipt-unknown`, `engine-pin-mismatch`,
|
||||
`foreign-writer`, `not-controller`, `stale-generation`) are bounded draft
|
||||
IDs, which CHAT-01 line 363 allows without a registry. The package README
|
||||
lists them.
|
||||
|
||||
### What ships
|
||||
|
||||
Four increments, in order. Each is its own candidate and review round, as
|
||||
with the queue-as-data A1/A2 split. No increment starts before the one above
|
||||
it is approved.
|
||||
|
||||
| Increment | Content | Needs first |
|
||||
|---|---|---|
|
||||
| 3A | Controller, transport, writer claim, Pi adapter on a fake Pi engine, incremental events, mediated terminal, interrupt, force stop and recovery. Fixtures in §2–§6, §9 and §10. | Brief approved; author named |
|
||||
| 3B | Pi native dialogs (§7) | 3A approved; C-2 approved |
|
||||
| 3C | The B1 evidence packet for Claude (§8) | 3A approved. Jason's go for any run that calls a model or reads Claude auth. |
|
||||
| 3D | Claude adapter, catalogue and history (§7, §8) | 3C approved, so B1 passed; C-3 if it exists |
|
||||
|
||||
If B1 does not pass, CHAT-03 closes after 3B. Claude keeps refusing
|
||||
`unsupported-harness`, and CHAT-06's both-harness gate stays blocked with
|
||||
CHAT-03 as its owner. That outcome is recorded, not a silent narrowing.
|
||||
|
||||
#### 1. Controller and transport
|
||||
|
||||
- One controller process per execution owns the engine's stdin. Pi runs in
|
||||
`--mode rpc` with no TUI, so a mediated engine has no native composer or
|
||||
terminal left to fence. That is how CHAT-03 meets plan lines 133–134: a
|
||||
losing native TUI can't stay writable because none exists.
|
||||
- Engine output is split on LF only (`rpc.md` lines 30–38). Node `readline`
|
||||
is not used, because it also splits on U+2028 and U+2029. The ledger
|
||||
refused a live line for that class of bug (lead decisions item 18).
|
||||
Fixture E2 covers it.
|
||||
- Clients connect over a Unix socket in a 0700 directory. Every connection
|
||||
starts as an observer. The browser does not reach the socket in CHAT-03;
|
||||
the WebUI side is CHAT-05.
|
||||
- **Actor.** There is one actor, `local-operator`, as in CHAT-02. The socket
|
||||
directory's mode is the only boundary, and every process with the same uid
|
||||
passes it. That includes agent seats, which run as the same user. So
|
||||
CHAT-03 cannot stop a same-uid agent from taking control of another
|
||||
conversation. See Limit 1. This blocks any live use until a local
|
||||
owner-channel design passes review (plan lines 181–185; B4).
|
||||
- **No broker queue.** CHAT-04 owns durable queues (plan line 216). In
|
||||
CHAT-03, a prompt sent while the engine is busy is refused with `busy`,
|
||||
and the text stays in the client. The controller never sends
|
||||
`streamingBehavior`, `steer` or `follow_up`, so mediated input never
|
||||
enters Pi's native queues (`rpc.md` lines 56–65). Tradeoff: there are no
|
||||
queued follow-ups (Q6) until CHAT-04, but 3A has no native-queue ambiguity
|
||||
of its own making.
|
||||
- Admission and dispatch both recheck, under one dispatch lock: binding
|
||||
state, open admission, the controlling connection and its generation, the
|
||||
execution incarnation and the text policy (CHAT-01 lines 153–160).
|
||||
- **Dedup key.** Actor, conversation and client request ID (CHAT-01 line
|
||||
144). The index lives as long as one controller incarnation. A retry that
|
||||
arrives after a controller restart is refused with `receipt-unknown`; it
|
||||
is never redispatched. Durable receipts are CHAT-04.
|
||||
- **Text only.** Images and files are CHAT-04.
|
||||
|
||||
#### 2. Writer-claim record (D1)
|
||||
|
||||
CHAT-01 lines 336–343 allow at most one non-stopped binding per conversation
|
||||
or native session identity, and they defer the record. RUNTIME.md §3 item 3
|
||||
adds one claim per (agent, project, workspace). The record:
|
||||
|
||||
- **Keys.** Each claim has two keys, and both must be held: the seat tuple
|
||||
(seat, project, workspace) and the native session identity (the Pi header
|
||||
ID or the Claude session UUID). They are always taken in that order, so
|
||||
two controllers can't deadlock.
|
||||
- **Revisions.** Each key is a directory under a claim root. Each revision
|
||||
is a write-once file created exclusively and fsynced along with its
|
||||
directory. The current state is the highest revision. No file is ever
|
||||
rewritten, the same rule as run records.
|
||||
- **Fields.** A revision stores:
|
||||
- the key and the binding ID;
|
||||
- the harness, conversation, and branch and leaf at launch;
|
||||
- the config pins: engine version, binary sha256 and launch argv digest;
|
||||
- the execution incarnation: boot ID, pid, process start time and cgroup;
|
||||
- the controller generation;
|
||||
- the state: `reserved`, `active`, `stopping`, `uncertain` or `stopped`;
|
||||
- the proof reference that allowed `stopped`.
|
||||
- **Location.** The claim root is a constructor argument. CHAT-03 sets no
|
||||
production default and writes nothing under the data root or `.pi/state`.
|
||||
Fixtures use temporary roots. The live location is chosen at cutover
|
||||
(CHAT-07) and reviewed as a data-map change then. Tradeoff: nothing live
|
||||
can use 3A until that decision, which is intended.
|
||||
- **What never releases a claim.** Disconnect never changes a claim.
|
||||
`agent_settled`, EOF, SIGTERM, idle and an abort acknowledgement never
|
||||
release one (CHAT-01 line 325; CHAT-00 line 65).
|
||||
- **Restart.** A controller that starts and finds an `active` claim for its
|
||||
key does not launch. It classifies the recorded incarnation:
|
||||
- **Different boot ID.** Every process of that boot is gone. That is
|
||||
proof for the whole cohort, so the claim moves to `stopped` with a boot
|
||||
proof. Tool calls with no recorded end become `uncertain` effects.
|
||||
- **Same boot, engine alive.** This is an orphan the controller cannot
|
||||
attach to, because the stdin pipe is gone. The state becomes
|
||||
`uncertain`. Only a confirmed force stop of that cohort (§6) moves it
|
||||
on.
|
||||
- **Same boot, engine gone.** The state is `uncertain` until the cohort
|
||||
observation in §6 shows no member left.
|
||||
- **Foreign writer.** The controller watches the bound session file. An
|
||||
appended entry whose ID never appeared on the controller's own stream
|
||||
means another writer, for example someone running `pi --session` on the
|
||||
same file. Admission closes, the binding becomes `uncertain`, and views
|
||||
get a reconcile marker (plan lines 179–180).
|
||||
- **No writes to sessions.** The controller never writes a session file and
|
||||
never uses `SessionManager.open` (CHAT-00 line 67).
|
||||
|
||||
| # | Fixture | Expected |
|
||||
|---|---|---|
|
||||
| W1 | Two processes acquire the same key at once | Exactly one claim. The other refuses `already-active`. |
|
||||
| W2 | Acquire while a claim is `active` or `reserved` | `already-active` |
|
||||
| W3 | Acquire while `stopping`, `uncertain`, or `stopped` without proof | `unsafe-replacement` |
|
||||
| W4 | Same session with a different seat tuple, and the reverse | Both refuse. No partial claim is left. |
|
||||
| W5 | Controller killed with SIGKILL at each step of acquire, transition and release | After restart: never two non-stopped claims and never a lost claim. The recorded state is the old one or the new one. |
|
||||
| W6 | Controller killed mid-turn and restarted while the engine is alive | `uncertain`. No launch, and prompts refuse. |
|
||||
| W7 | Recorded boot ID differs from the current one | `stopped` with a boot proof. Open tool calls become `uncertain`. |
|
||||
| W8 | Resume after a proven stop with the same pins | New revision, generation +1, same conversation, branch and leaf |
|
||||
| W9 | Resume with a changed binary, argv digest, branch or leaf | Refused. The claim is unchanged. |
|
||||
| W10 | Foreign append to the bound session file | Admission closed, `foreign-writer`, `uncertain`, reconcile marker. No engine write. |
|
||||
| W11 | Controller writes to session files | None. The CHAT-02 F17 check runs over the fixture session directory. The fake engine's own appends are recorded separately and excluded. |
|
||||
|
||||
#### 3. Pi adapter, incremental events and R3-1
|
||||
|
||||
Pinned inputs for Pi 0.85.1, under
|
||||
`node_modules/@earendil-works/pi-coding-agent/`:
|
||||
|
||||
- `docs/rpc.md` (`15fcd26bee72777b373fd5f2edd77091a01cadd4de95e48b08422ced0552a28d`)
|
||||
- `dist/modes/rpc/rpc-mode.js` (`e7e4724aa55c5aac73cf36793653b26736200e5c59d58373990fc31028f86477`)
|
||||
- `dist/modes/rpc/rpc-types.d.ts` (`e968e5be01dc7ad9615f938ae867ef136fa495f13dcf169942e9f781a299d9eb`)
|
||||
|
||||
The plan requires reading the Pi docs completely before Pi implementation
|
||||
(lines 163–164). The author does that before any 3A code.
|
||||
|
||||
- **The fake engine.** A fixture process that speaks the pinned protocol:
|
||||
- prompt acceptance and refusal;
|
||||
- message and tool events;
|
||||
- `agent_end` arriving before `agent_settled`, and retries;
|
||||
- `clear_queue` and `abort`;
|
||||
- dialogs;
|
||||
- scripted pause points, so a test can land a race at an exact step.
|
||||
|
||||
Its behavior is checked against the pinned files, not guessed.
|
||||
- **Real-binary smoke.** The pinned `pi` starts in `--mode rpc` in a scratch
|
||||
directory, with no auth file and no model call. It answers `get_state`,
|
||||
`get_commands`, and `clear_queue` and `abort` while idle. The recorded
|
||||
exchange shows that the fake's framing matches the binary. If the binary
|
||||
won't start without auth, the author records that, and the packet says
|
||||
plainly that 3A rests on the fake alone.
|
||||
- **Events.** Native events map onto CHAT-01 `event` records: message-start,
|
||||
text and thinking deltas, tool-start, tool-update and tool-end,
|
||||
message-end with `updateMode: replace`, and run-settled.
|
||||
- Every event carries the execution incarnation and a sequence number
|
||||
for that execution.
|
||||
- An unknown native event becomes an `unavailable` event. It is never
|
||||
dropped silently and never passed through raw.
|
||||
- `agent_settled` maps to run-settled, never to cohort termination.
|
||||
- **Joining history and the stream.** CHAT-01 lines 105–112 require an
|
||||
atomic cut between a history page and the stream; otherwise streaming is
|
||||
advertised as unavailable. The author shows the cut from the pinned
|
||||
source: when a message_end's entry is on disk relative to the event. If
|
||||
that can't be shown, 3A advertises replay as unavailable. A client gets
|
||||
the page, then live events from the moment it subscribes, with a
|
||||
reconcile marker at the seam. Fixture E4 covers both cases.
|
||||
|
||||
**R3-1: input dispatched but not consumed when a fence lands.** Because the
|
||||
controller never sends `streamingBehavior`, Pi queues mediated input in one
|
||||
case only. Pi accepts a prompt at preflight, and queued prompts count as
|
||||
success (`rpc-mode.js` lines 298–318), at a moment the controller didn't
|
||||
see as busy, such as between `agent_end` and `agent_settled` during a
|
||||
retry. Anything else in the native queues came from outside Mosaic, for
|
||||
example an extension's follow-up message. The rule:
|
||||
|
||||
1. Interrupt and force stop close admission first, then send `clear_queue`,
|
||||
then `abort`, in that order. `abort` runs any queued messages still in
|
||||
the session (`rpc.md` line 158).
|
||||
2. At most one dispatched item can lack a started user message. If
|
||||
`clear_queue` returns exactly that item's text, exactly once, the item is
|
||||
proven unconsumed.
|
||||
3. Until C-1 lands, a proven-unconsumed item keeps its actual receipt state
|
||||
(`acknowledged`). The turnProof records that `clear_queue` returned it.
|
||||
The item is never relabelled unsent and never resent. The client shows
|
||||
the text so the actor can send it again as a new request.
|
||||
4. Returned text that matches no Mosaic item is external input. It goes into
|
||||
the turnProof and is shown read-only as held by the engine, not sent by
|
||||
Mosaic, and discarded. It is never resent.
|
||||
5. If `clear_queue` fails or times out, the turnProof records
|
||||
`nativeQueue: unknown`, the stop stays `uncertain`, and admission stays
|
||||
closed.
|
||||
|
||||
| # | Fixture | Expected |
|
||||
|---|---|---|
|
||||
| N1 | Prompt accepted during the retry window, then Interrupt | `clear_queue` goes before `abort`. The returned text matches the one item. The receipt stays `acknowledged`, the turnProof lists the item, and nothing is resent. |
|
||||
| N2 | N1 with `abort` sent first (mutant) | The fake runs the queued item, so the test fails. This is the ordering guard. |
|
||||
| N3 | `clear_queue` returns an extension's follow-up | Recorded as external and shown read-only. Attributed to no request. |
|
||||
| N4 | `clear_queue` returns the item's text twice, or a near match | No proof. The receipt becomes `delivery-unknown`, and the stop stays `uncertain`. |
|
||||
| N5 | `clear_queue` times out | `nativeQueue: unknown`, stop `uncertain`, admission closed |
|
||||
| N6 | Pi refuses a prompt because it is streaming (no `streamingBehavior`) | Receipt `failed` with native evidence. The frozen text is kept for an explicit resend. |
|
||||
|
||||
#### 4. The slash path (carry-forward 3)
|
||||
|
||||
There are two separate hazards: text left in a composer gets concatenated
|
||||
with a new message, and Pi interprets certain prefixes.
|
||||
|
||||
- **Concatenation.** `send-message.sh` pastes onto whatever the composer
|
||||
holds. The mediated path has no engine-side composer. Each prompt is one
|
||||
JSONL record, and its `message` field holds the whole text. Nothing left
|
||||
over can prefix it. The mediated terminal's own composer is a local
|
||||
buffer. It is empty at start, cleared after each submit and on control
|
||||
transfer, and it submits only while its connection is the controller.
|
||||
- **Interpretation.** RPC still acts on a leading `/`. Extension commands run
|
||||
immediately, even while streaming, and skill and template commands
|
||||
expand (`rpc.md` lines 67–69).
|
||||
- Repository seats load one extension command, `/goal`
|
||||
(`.pi/extensions/goal/index.ts:230`), and disable skills and templates
|
||||
(`scripts/agent-host-dev.sh:135–136`).
|
||||
- Admission refuses `text-policy` when the first non-whitespace character
|
||||
is `/` (CHAT-01 lines 181–183). Dispatch checks again.
|
||||
- CHAT-01 lines 368–370 leave `!`, `@` and slashes on later lines open
|
||||
under B3. 3A settles them from the pinned source. The author lists every
|
||||
prefix that Pi 0.85.1 RPC `prompt` interprets, and the list becomes a
|
||||
fixture. Admission refuses each listed prefix, and any prefix the author
|
||||
can't classify.
|
||||
- **Board and agent-send for a mediated seat.** A mediated engine has no
|
||||
tmux pane. The board already refuses a reply to a registration without a
|
||||
tmux session before the tool runs (`packages/control-board/src/serve.mjs:84`;
|
||||
test `serve.test.mjs:810`). CHAT-03 relies on that and changes neither the
|
||||
board nor `tools/tmux`. No real seat registers as mediated in CHAT-03, so
|
||||
the refusal first applies to a real seat at cutover.
|
||||
- **Seats still on tmux keep the hazard.** The DEFERRED entry stays open. It
|
||||
closes when a seat moves to the mediated path (CHAT-07), or when a CHAT-03I
|
||||
charter covers `tools/tmux` (CHAT-01 lines 232–238). Neither happens in
|
||||
CHAT-03.
|
||||
|
||||
| # | Fixture | Expected |
|
||||
|---|---|---|
|
||||
| S1 | `/goal x`, and the same with leading spaces or a tab | `text-policy` at admission. Zero bytes reach the fake engine. |
|
||||
| S2 | Each prefix on the author's list | Refused. The test reads the same list the code uses. |
|
||||
| S3 | `/goal` on the second line | The fixture pins the result from the pinned source: admitted if Pi doesn't interpret later lines, refused otherwise |
|
||||
| S4 | The terminal composer holds a `/` from an abandoned edit, then control transfers and returns | Composer cleared. The next submit sends only the new text, and the fake engine records the exact bytes. |
|
||||
| S5 | An observer terminal gets a paste and then Enter, as `send-message.sh` does | Not admitted: `not-controller`. Zero engine bytes. |
|
||||
| S6 | A mediated-shaped registration (no tmux) passed to `replyToRow` with a recording `exec` | 409, "no tmux session". `exec` is never called. |
|
||||
| S7 | A prompt containing ESC, bracketed-paste markers or U+2028 | Sent as one JSON string. The fake engine receives the exact text, and no record splits. |
|
||||
|
||||
#### 5. Control races (Rocko)
|
||||
|
||||
Each race uses the fake engine's pause points to land at an exact step.
|
||||
Every race asserts the engine bytes, the receipts and the events.
|
||||
|
||||
| # | Race | Expected |
|
||||
|---|---|---|
|
||||
| H1 | Two takeovers with the same expected generation | One wins, and the generation goes up by 1. The other refuses `stale-generation`. |
|
||||
| H2 | The old controller's prompt arrives after a takeover commits | Refused. Zero engine bytes. |
|
||||
| H3 | A takeover commits while a prompt holds the dispatch lock | Either the write finished before the commit, and the receipt keeps the old actor, or the prompt is refused. Never a partial write, never both. |
|
||||
| H4 | Self-takeover | Refused (CHAT-01 line 269) |
|
||||
| H5 | The old controller answers an approval after a takeover | Refused. The decision is answered once, through the new projection. |
|
||||
| H6 | Duplicate approval answers with the same content | One native response |
|
||||
| H7 | Conflicting approval answers with the same request ID | The second is refused |
|
||||
| H8 | An approval answer after a native timeout or cancel | Refused. The state comes from native evidence. |
|
||||
| H9 | Interrupt racing a prompt's dispatch | Before the write: `dispatch-refused`. After it: the R3-1 rules in §3. |
|
||||
| H10 | Interrupt and force stop at the same time | One stop chain. Force stop supersedes (CHAT-01 lines 319–322). |
|
||||
| H11 | The controller disconnects mid-turn | Work continues and the claim is unchanged. Control stays with the disconnected connection until an observer takes over explicitly. Nothing happens automatically. |
|
||||
| H12 | Exact retry of a prompt after reconnecting | The same receipt. No second dispatch. |
|
||||
| H13 | Retry with the same request ID and different text | Refused |
|
||||
| H14 | Late stdout from the old engine after a replacement | Dropped by execution incarnation and counted in the evidence. Never rendered. |
|
||||
| H15 | A revoked connection sends a command | Refused, with the revocation fence of CHAT-01 lines 271–280 |
|
||||
| H16 | A second controller process for the same session | Refused as in W1 and W2. The first controller is untouched. |
|
||||
| H17 | A confirmation reused, answered from another connection, or answered after the stop context changed | Refused. Confirmations are single-use (CHAT-01 lines 264–268; CHAT-01C lines 92–100). |
|
||||
|
||||
#### 6. Stop, cohort proof and recovery (Rocko)
|
||||
|
||||
- **Cohort.** The controller launches each engine in its own transient
|
||||
systemd user scope (this host runs systemd 261), so the cohort is that
|
||||
cgroup. A child that calls `setsid` stays in it. If a scope can't be
|
||||
created, the cohort falls back to the process group. A stop there can
|
||||
reach `uncertain` but never `stopped`, because a `setsid` child can
|
||||
escape. Tradeoff: this needs `systemd-run --user`, and the fallback is
|
||||
honest rather than equivalent.
|
||||
- **Proof.** `stopped` needs a cohortProof (CHAT-01 lines 327–331):
|
||||
- complete membership;
|
||||
- boot ID, and pid and start time for each member;
|
||||
- a death time for each member;
|
||||
- the observation time;
|
||||
- an empty cgroup.
|
||||
|
||||
SIGTERM, EOF, an abort acknowledgement, `agent_settled` and idle never
|
||||
promote a stop to `stopped` (line 325).
|
||||
- **Effects.** A tool-start with no tool-end at stop time is an `uncertain`
|
||||
effect. Killing never counts as rollback (line 334).
|
||||
- **Interrupt (Q20).** Close admission, `clear_queue`, `abort`, wait for
|
||||
settle, build the turnProof, record `reconciled`, and reopen admission
|
||||
under current control (lines 307–313). If this hangs, force stop stays
|
||||
available.
|
||||
- **Force stop (Q8).** Needs an answered confirmation. It closes admission,
|
||||
sends SIGTERM to the cgroup, then SIGKILL after a bounded grace period,
|
||||
then builds the proof. It acts only on the selected execution's cgroup,
|
||||
and other executions survive.
|
||||
- **Recover (Q15).** Recover reports eligibility only. It needs:
|
||||
- a stopped proof;
|
||||
- effects reconciled or explicitly uncertain;
|
||||
- an exact confirmation;
|
||||
- the same pins (lines 336–343).
|
||||
|
||||
Launching is a separate library call made by a launcher, and it needs
|
||||
that eligibility record. No client command launches. A browser or
|
||||
controller crash can't start an engine.
|
||||
- **Pi resume.** Resume reuses the same session file and leaf. The author
|
||||
confirms from the pinned docs how Pi selects the leaf. Before admission
|
||||
opens, the adapter checks `get_state` and `get_tree` and refuses if the
|
||||
engine loaded any other leaf (RUNTIME.md §3 item 4).
|
||||
|
||||
| # | Fixture | Expected |
|
||||
|---|---|---|
|
||||
| K1 | Force stop an engine whose tool child calls `setsid`, with a scope | The child is killed. `stopped`, with proof. |
|
||||
| K2 | K1 on the process-group fallback | `uncertain`, never `stopped` |
|
||||
| K3 | SIGTERM acknowledged while a member is still alive | Stays `stopping` or `uncertain` |
|
||||
| K4 | Two fake engines; force stop one | The other keeps running and still answers |
|
||||
| K5 | Stop during a tool call | The effect is `uncertain` and shown |
|
||||
| K6 | Recover without proof, without confirmation, or with changed pins | Refused |
|
||||
| K7 | Recover after proof, then launch | New incarnation, generation +1, same leaf. The cancelled prompt is not replayed. |
|
||||
| K8 | The engine loads a different leaf on resume | Refused before admission opens |
|
||||
| K9 | An interrupt that never settles | Stays `uncertain`. Force stop stays available, and ordinary takeover is refused while fenced. |
|
||||
| K10 | Controller crash during a force stop | The restart finds `stopping` and resumes observing. No relaunch. |
|
||||
|
||||
#### 7. Native approval dialogs (3B after C-2; Claude in 3D)
|
||||
|
||||
- Pi has no built-in permission system. Approvals come from extensions
|
||||
through `extension_ui_request` (`rpc.md` lines 1186–1210). Repository seats
|
||||
load no extension that raises dialogs today, so 3B tests with a fixture
|
||||
extension.
|
||||
- CHAT-01 lines 239–242 and 292 block non-permission forms until CHAT-03D
|
||||
exists, and C-2 is that companion. After C-2:
|
||||
- `confirm` and `select` render the exact native labels and answer with
|
||||
the exact request ID;
|
||||
- `input` and `editor` stay unsupported and show as disabled, with a
|
||||
reason;
|
||||
- nothing is answered on the user's behalf, and a generic "yes" is not
|
||||
accepted.
|
||||
- Cancel is enabled only where C-2 proves it can't mean allow. A Pi select
|
||||
cancel does not inherit confirm's meaning (lines 293–295).
|
||||
- Pending dialogs don't survive a Pi restart (CHAT-00 line 69). After a
|
||||
takeover, the controller reprojects each dialog: a new projection ID for
|
||||
the same decision (lines 282–287).
|
||||
- **Claude, in 3D after B1.** `can_use_tool` maps to allow-once and deny.
|
||||
Choices that widen permissions are disabled, and there is no invented
|
||||
cancel (lines 294–295). Pending permission requests are re-read from
|
||||
initialize on reconnect, but only if B1 shows that the pinned version
|
||||
supports it.
|
||||
|
||||
| # | Fixture | Expected |
|
||||
|---|---|---|
|
||||
| P1 | `confirm` dialog answered by the controller | One `extension_ui_response` with the exact ID and value |
|
||||
| P2 | `select` with labels containing markup and bidi controls | Exact labels, rendered inert |
|
||||
| P3 | `input` or `editor` dialog | Disabled, with a reason. No response is sent. |
|
||||
| P4 | A native timeout before the answer | `uncertain`, then resolved from native evidence. A late answer is refused (H8). |
|
||||
| P5 | Takeover while a dialog is pending | New projection ID and the old one superseded. One native answer. |
|
||||
| P6 | Interrupt while a dialog is pending | The approval becomes `uncertain`, not denied (lines 297–299) |
|
||||
| P7 | A Claude permission request (3D, recorded fixture) | Allow-once and deny only. Widening choices disabled. |
|
||||
|
||||
#### 8. Claude: B1 and the catalogue (carry-forward 2)
|
||||
|
||||
**What B1 is.** `docs/plans/chat-00/README.md` lines 193–195: prove the
|
||||
exact Claude CLI and protocol combination, capability negotiation,
|
||||
transcript branch selection and the image and file input shapes. SDK and
|
||||
source examples narrow the uncertainty, but they don't certify the
|
||||
installed binary. CHAT-00 line 66 names the gap for history: Claude's
|
||||
persisted branch format and leaf selection.
|
||||
|
||||
**What proves it (3C).** A B1 packet under `agents/<author>/work/chat-03/b1/`,
|
||||
approved by Filbert and Rocko, with five parts:
|
||||
|
||||
1. **Pin.** The exact version string and the sha256 of the binary the
|
||||
adapter will run. Today `claude --version` reports 2.1.283; the plan saw
|
||||
2.1.269. The adapter checks both at launch and otherwise refuses with
|
||||
`engine-pin-mismatch`. It runs the engine with auto-update off, and the
|
||||
author cites the setting from the pinned docs.
|
||||
2. **Sources.** The official protocol sources for that exact version, by
|
||||
hash. These are the C-* entries in `chat-00/sources.json`, re-pinned to
|
||||
that version.
|
||||
3. **Recordings.** Made from that binary, in a scratch config directory with
|
||||
no repository credentials:
|
||||
- initialize and its capability answer, including whether
|
||||
`interrupt_cancel_queued_v1` and `pending_permission_requests` exist;
|
||||
- a text prompt and an image prompt;
|
||||
- a `can_use_tool` allow and a deny;
|
||||
- an interrupt.
|
||||
|
||||
They are redacted, hash-pinned and used as the 3D fixtures. The plan
|
||||
rules out model calls for discovery (line 166). Any recording that calls
|
||||
a model or reads Claude auth therefore needs Jason's go first, because it
|
||||
spends money and touches credentials. Without that go, 3C stops after
|
||||
parts 1 and 2, and B1 stays open.
|
||||
4. **Branch selection.** Two persisted transcripts from that binary, one of
|
||||
them with a fork (an edit or a rewind). The packet states the leaf rule
|
||||
and shows that `--resume` continues the leaf the parser picks.
|
||||
5. **Negative.** The parser refuses a transcript from another version with
|
||||
`unsupported-harness`.
|
||||
|
||||
**The catalogue after B1 (3D).**
|
||||
|
||||
- Rocko's launcher runs Claude with the default config directory
|
||||
(`agents/rocko/launch.sh:86`, no `CLAUDE_CONFIG_DIR`). So its transcripts
|
||||
sit in the same `~/.claude/projects/<cwd slug>/` directory as every other
|
||||
Claude session started in this checkout, including T3 threads and Jason's
|
||||
own sessions.
|
||||
- The catalogue therefore never lists that directory. It opens only session
|
||||
IDs the repository launcher recorded for that seat
|
||||
(`.pi/state/rocko/session-id` and `launches/*/session-id`). Each ID must
|
||||
resolve to exactly one file under the approved root, opened with the
|
||||
CHAT-02 safe-open rules.
|
||||
- A launcher receipt is a hint, like a registration (CHAT-01 lines 62–64).
|
||||
The access mapping stays under B4 review.
|
||||
- The CHAT-02 guarantees still apply: read-only, no writes (F17), cursors,
|
||||
byte caps, continuation parts and inert rendering.
|
||||
|
||||
| # | Fixture | Expected |
|
||||
|---|---|---|
|
||||
| L1 | A Claude transcript at the pinned version | Default leaf shown and other branches readable, as in F12 |
|
||||
| L2 | A transcript from another version | `unsupported-harness` |
|
||||
| L3 | A decoy session file in the same directory, named in no receipt | Never listed, never opened |
|
||||
| L4 | A receipt naming a file outside the root, a symlink or another project | Refused, as in F7–F9 |
|
||||
| L5 | Sidechain or subagent entries | Kept separate, not merged into the main branch |
|
||||
| L6 | No-write check | F17 over the Claude directory |
|
||||
| L7 | The binary's sha256 or version differs at launch | `engine-pin-mismatch`. No launch. |
|
||||
|
||||
The 3D adapter maps Claude stream-json onto CHAT-01 events. The §5 and §9
|
||||
fixtures then run again against the recordings.
|
||||
|
||||
#### 9. Return flow and events
|
||||
|
||||
| # | Fixture | Expected |
|
||||
|---|---|---|
|
||||
| E1 | The plan §6 return flow on the fake engine: send, acknowledge, user, toolCall, toolResult, new final answer | Shown once in the same conversation, with no refresh, no duplication, and the draft and reading position kept |
|
||||
| E2 | U+2028 and U+2029 inside JSON strings, and CRLF | Each parsed as one record |
|
||||
| E3 | Multipart final, two blocks, null request correlation, duplicate delivery | The CHAT-01 cases at lines 110–112 |
|
||||
| E4 | A page, then a subscription with overlap, and again with a gap or a new epoch | Overlap deduplicated. A gap reconciles. |
|
||||
| E5 | An unknown native event | An `unavailable` event. Nothing is dropped. |
|
||||
| E6 | A tool result delayed across a pause and a reconnect | Reconciled without a manual refresh |
|
||||
| E7 | The mediated terminal as observer, then as controller | Renders the same stream as the library client, and submits only as controller |
|
||||
|
||||
The browser leg of the return flow is CHAT-05. 3A proves it at the library
|
||||
and the terminal.
|
||||
|
||||
#### 10. Checks and mutation pass
|
||||
|
||||
- **Suites.** These must pass:
|
||||
- `node --test packages/conversation/tests/`;
|
||||
- the control-board, webui and seat package tests;
|
||||
- `node docs/plans/chat-00/check.mjs`, `chat-01/check.mjs` and
|
||||
`chat-01c/check.mjs`;
|
||||
- the eight `scripts/test-*.sh` suites.
|
||||
- **Nested runners.** A test that starts `node --test` itself clears
|
||||
`NODE_TEST_CONTEXT` for that child, as in the DEFERRED entry on nested
|
||||
runners (N13), or it can hide failures.
|
||||
- **Isolation.** Every fixture runs in temporary directories. No fixture
|
||||
touches live registrations, `.pi/state`, `~/.claude` or a live seat (plan
|
||||
line 272).
|
||||
- **Mutation pass.** Run in a scratch copy, as for the CHAT-02 Console. Each
|
||||
of these mutants must fail at least one test:
|
||||
1. dispatch skips the generation recheck;
|
||||
2. `abort` is sent before `clear_queue`;
|
||||
3. a claim file is created without exclusive create;
|
||||
4. the late-event filter ignores the incarnation;
|
||||
5. the text policy checks only the first character, missing leading
|
||||
whitespace;
|
||||
6. an acknowledged SIGTERM promotes a stop to `stopped`;
|
||||
7. the process-group fallback can reach `stopped`;
|
||||
8. a confirmation is not consumed on use;
|
||||
9. disconnect releases control;
|
||||
10. the composer isn't cleared on transfer;
|
||||
11. engine output is read with `readline`.
|
||||
|
||||
3D adds two more: the pin check is skipped, and the decoy file is listed.
|
||||
|
||||
#### 11. Choices in this brief, for review
|
||||
|
||||
| Choice | Tradeoff |
|
||||
|---|---|
|
||||
| No broker queue; a busy engine refuses `busy` | No queued follow-ups until CHAT-04, and no native queueing of mediated input |
|
||||
| No `streamingBehavior`, `steer` or `follow_up` | Same as above; this is what keeps R3-1 down to one case |
|
||||
| No default claim root | Nothing live can use 3A before the CHAT-07 data-map decision |
|
||||
| Cohort is a systemd user scope; the process-group fallback can't reach `stopped` | Depends on `systemd-run --user`, and the fallback leaves stops uncertain |
|
||||
| One actor, `local-operator`, guarded only by socket-directory mode | Same-uid agents are not kept out (Limit 1) |
|
||||
| Dedup lasts one controller incarnation | A retry across a restart refuses instead of returning the receipt |
|
||||
| Four increments, with 3C/3D gated on B1 | CHAT-03 can close Pi-only, with that outcome recorded |
|
||||
| Claude catalogue from launcher receipts only | A Claude session started outside the launcher never appears |
|
||||
|
||||
### Carry-forwards
|
||||
|
||||
| # | Sage's item | Where | Acceptance evidence |
|
||||
|---|---|---|---|
|
||||
| 1 | D1 writer-claim record and R3-1 (lead decisions item 8) | §2, §3 | W1–W11 and N1–N6 pass. Mutants 2 and 3 fail tests. C-1 settles the final state. |
|
||||
| 2 | The Claude catalogue after B1 | §8; increments 3C and 3D | The B1 packet (parts 1–5), approved by Filbert and Rocko. L1–L7 pass. |
|
||||
| 3 | The board send that can become a Pi slash command | §4 | S1–S7 pass. Mutants 5 and 10 fail tests. The DEFERRED entry stays open for seats still on tmux. |
|
||||
| 4 | The CHAT-01/01C contracts, by path and hash | "Contracts implemented" | The hash table matches `sha256sum` at approval. C-1 to C-3 are separate reviewed items. |
|
||||
| 5 | Path authority | "Files owned" | The overlap table. Every changed path in each candidate is inside "Files owned". |
|
||||
| 6 | The source author | "Owner and reviewer" | `<slot>`, named by Darkwing after this brief is approved |
|
||||
|
||||
### Limits
|
||||
|
||||
1. **Same-uid control.** Any process running as the same user can connect
|
||||
to the socket and take control. Agent seats run as that user, so an
|
||||
agent could take over another conversation. CHAT-03 is fixture-only, so
|
||||
no live conversation is exposed. Live use waits for a reviewed local
|
||||
owner-channel design (B4).
|
||||
2. **Fake engines.** They model the pinned docs. The real-binary smoke
|
||||
covers framing only. 3A makes no model call, so real-engine behavior is
|
||||
unproven until CHAT-06.
|
||||
3. **B2 untouched.** Tool isolation and trust and settings parity (CHAT-00
|
||||
line 195) are untouched. Any real engine for a real seat waits on B2.
|
||||
4. **Containment.** The cgroup covers local processes. Network and remote
|
||||
effects stay `uncertain`.
|
||||
5. **Takeover has nothing to recover.** With no broker queue, a takeover
|
||||
has no queued input to turn into drafts. Q13 is CHAT-04's.
|
||||
|
||||
### Out of scope
|
||||
|
||||
- Durable queues, drafts, uploads, queue edit and cancel, takeover-to-draft
|
||||
(CHAT-04).
|
||||
- Remote control (CHAT-04R) and the chat UI (CHAT-05).
|
||||
- The candidate, cutover and any real seat migration (CHAT-06, CHAT-07).
|
||||
- Changes to `tools/tmux`, the board, the seat package, launchers, `roles/`,
|
||||
`contracts/` and the `docs/plans/chat-0*` contracts.
|
||||
- The CHAT-03I fleet-communications charter (CHAT-01 lines 232–238).
|
||||
- Authenticated multi-actor control and the local owner-channel design (B4).
|
||||
- The Claude adapter and history, unless B1 passes.
|
||||
- Filbert's idsDigest note, which stays in
|
||||
`agents/dewey/work/chat-02/FOLLOWUPS.md`.
|
||||
|
||||
### Gate
|
||||
|
||||
- **Brief.**
|
||||
- Filbert approves the exact `BRIEF.md` hash.
|
||||
- Rocko's pass on §5 and §6 leaves no blocking finding open.
|
||||
- Sage commits and pins the brief. Darkwing then names the author.
|
||||
- **Each increment.**
|
||||
- Filbert approves the exact candidate hashes. Rocko passes the §5 and §6
|
||||
code in 3A and the B1 packet in 3C.
|
||||
- Every §10 suite is green on an index export, and every mutant is
|
||||
killed.
|
||||
- Sage commits. A push needs Jason's word.
|
||||
- **3C.** Jason's go comes before any model call.
|
||||
- **CHAT-03 done.** 3A and 3B are approved and committed, and either 3D is
|
||||
approved, or B1 is recorded as not passed, with Claude still refusing and
|
||||
CHAT-06 blocked.
|
||||
- **No live check.** No real seat migrates, so there is none. The live proof
|
||||
belongs to CHAT-07.
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,640 @@
|
||||
--- BRIEF.md@2c5be6b4 (R3)
|
||||
+++ BRIEF.md (final, lead decision 32)
|
||||
@@ -1,7 +1,9 @@
|
||||
# CHAT-03 brief: live adapters and mediated terminal (#1507, row 5)
|
||||
|
||||
-Author: Dewey, 2026-09-26. R3, for review. This is the brief only. It
|
||||
-includes no source, no contract edits and no seat changes. R1
|
||||
+Author: Dewey, 2026-09-26/27. Final text for pinning: R3 (`2c5be6b4`,
|
||||
+frozen as `BRIEF-r3-2c5be6b4.md`) with the one edit lead decision 32
|
||||
+orders. It is not a review round (lead decision 27). This is the brief
|
||||
+only. It includes no source, no contract edits and no seat changes. R1
|
||||
(`5dd447f7`) is frozen as `BRIEF-r1-5dd447f7.md`, and R2 (`5c5b45a2`) as
|
||||
`BRIEF-r2-5c5b45a2.md`. §0 lists what changed.
|
||||
|
||||
@@ -19,13 +21,33 @@
|
||||
lead decisions gained items 26 and 27, and the goals review
|
||||
(`docs/plans/2026-09-27_goals-review.md`) was added.
|
||||
|
||||
-Lead decision 27 makes R3 the last review round. After it, no CHAT-03
|
||||
-source work starts until Sage rescopes CHAT-03 against Gate E. So R3's
|
||||
-answer to anything pinned Pi can't prove is to refuse or report unknown,
|
||||
-never new machinery to prove it. `REVIEW-REQUEST.md` marks each section
|
||||
-as needed for Gate E or not, as input for the rescope.
|
||||
+Lead decision 27 made R3 the last review round, and its answer to
|
||||
+anything pinned Pi can't prove is to refuse or report unknown, never new
|
||||
+machinery to prove it. Sage rescoped CHAT-03 against Gate E from R3's
|
||||
+section map (lead decision 30), ruled on Rocko's R3 finding (lead
|
||||
+decision 31) and ordered this edit (lead decision 32).
|
||||
+
|
||||
+### 0. Changes since R3 (lead decision 32)
|
||||
+
|
||||
+Filbert approved R3 on the sections Gate E keeps, with no blocking
|
||||
+finding (`agents/filbert/work/chat-03-brief-review-r3-2026-09-27.md`,
|
||||
+`48447592`). Rocko closed his R2 finding and raised one blocking finding
|
||||
+in the seal (`agents/rocko/work/chat-03-r3-adversarial-2026-09-27.md`,
|
||||
+`19e3fcff`), which lead decision 31 resolves. This edit does the five
|
||||
+things lead decision 32 lists, and nothing else.
|
||||
|
||||
-### 0. Changes since R2
|
||||
+| Item | What changed |
|
||||
+|---|---|
|
||||
+| 1. Lead decision 30 cuts, removed and not reworded | Removed: C-1, C-2 and C-4; increment I2 and §7's Pi dialogs (P1, P2, P4–P6); increment I1b (C-5 moves to CHAT-04, and the interim rule stays); the §2 idle drift check, W10, W18, W19, mutant 25, the drift choice and the `session-drift` name. H5–H8 stay for Claude in I4. References to removed items were adjusted where they stood: What ships, E5, carry-forwards 1 and 4, §11, Limits 5 and 11, Out of scope and Gate. Two sentences were kept by moving them: the claim's reach, into the live-session guard bullet, and P3's disabled Pi dialog, which is now §7's only Pi rule. |
|
||||
+| 2. Lead decision 31: no explicit extensions | The seal is `--no-extensions`, `--no-prompt-templates`, `--no-themes` and no `--extension`. The registry, the input-silent review and the tree hashes are removed, not replaced with pinning. N5 and N15 are fake-only. N24 and mutant 37 refuse any `--extension`. Limit 11 and §11 say explicit extensions return with goal in CHAT-06. |
|
||||
+| 3. Filbert n1: the Pi pin | Pi is pinned by the `package-lock.json` integrity of `@earendil-works/pi-coding-agent` 0.85.1, checked against npm's installed record. The listed `dist/core` and `dist/extensions` files are now labelled as citation sources, since `pi` runs `dist/bundle`. The built-in `llama.cpp` is pinned with the package. |
|
||||
+| 4. Filbert n2: the clear's own `queue_update` | O5 counts the empty `queue_update` Pi's clear emits before its response as the controller's own. N10's fake emits it, and N25 proves that an ordinary Interrupt reconciles. |
|
||||
+| 5. Rocko's R3 note | A build note under What ships: the `no-turn` cleanup lifts only its own fence. H10 covers the force-stop, overlap and revocation branches. |
|
||||
+
|
||||
+Filbert's n3 (an `aborted` with no stop in progress) isn't in lead
|
||||
+decision 32, so it isn't applied.
|
||||
+
|
||||
+### 0a. Changes from R2 to R3 (historical)
|
||||
|
||||
R3 answers Rocko's review of R2
|
||||
(`agents/rocko/work/chat-03-r2-adversarial-2026-09-26.md`, `07b938fb`),
|
||||
@@ -49,7 +71,7 @@
|
||||
| Consistency passes | Two passes over the R3 draft found 22 defects of wording and cross-reference. A third pass over the finished draft found 17, including three where a fixture's expected result didn't follow from the rules (N6, N8, N20). All are fixed. |
|
||||
| Base | Line numbers and hashes move to `f2b9e622`. No contract, source or pinned Pi file changed since `40a02d2b`. Queue A1 is now committed, so the overlap table names its commit. |
|
||||
|
||||
-### 0a. Changes from R1 to R2 (historical)
|
||||
+### 0b. Changes from R1 to R2 (historical)
|
||||
|
||||
The rule numbers in this table are R2's. R2's rule 6 is R3's rule 7.
|
||||
|
||||
@@ -204,38 +226,9 @@
|
||||
approved before the code that needs it. Sage assigns the author; Filbert and
|
||||
Dewey review, as they did for CHAT-01C.
|
||||
|
||||
-- **C-1: withdrawn from CHAT-03 and restated for CHAT-06.** R2's C-1
|
||||
- would have added a `turnProof` list of the external items that
|
||||
- `clear_queue` removed, so that `reconciled` could follow a non-empty
|
||||
- clear. Its premise was that the clear accounts for everything an
|
||||
- Interrupt removes. Filbert's R2 review (F2) showed that it doesn't.
|
||||
- Agent-level custom messages are dropped without being returned, and
|
||||
- `nextTurn` messages survive (§3). A list built from the clear's return
|
||||
- would claim completeness it doesn't have, so C-1 doesn't ship in
|
||||
- CHAT-03. The check isn't weakened: CHAT-03 runs only sealed engines,
|
||||
- where any non-empty clear is an overlap signal and leaves the stop
|
||||
- `uncertain` (§3 rule 3). Restated for CHAT-06, the item that owns
|
||||
- turn-starting extensions: a `turnProof` record of removed external
|
||||
- input, adopted only when pinned Pi gives complete evidence of what an
|
||||
- abort removed (every queue, including agent-level and `nextTurn`
|
||||
- messages) and ties runs to prompts, for example with run IDs. That needs
|
||||
- a Pi upgrade or upstream change, which CHAT-06 names and pins.
|
||||
-- **C-2: the CHAT-03D native dialog companion.** It covers Pi `confirm` and
|
||||
- `select` with exact labels; `input` and `editor` stay unsupported. CHAT-01
|
||||
- lines 239–242 and 292 block non-permission forms until it exists.
|
||||
- Increment I2 waits for it.
|
||||
- **C-3: Claude record fields.** Needed only if B1 shows that CHAT-01 lacks
|
||||
a field, for example the capability-negotiation result on `binding`.
|
||||
Otherwise C-3 is void.
|
||||
-- **C-4 (optional; Sage decides): an event type for an unrecognized native
|
||||
- event.** `event.type` is a closed enum, and `unavailable` is only a
|
||||
- `visibility` value. Until C-4, an unknown native event gets no client
|
||||
- event. It is recorded in controller evidence (type name and byte count)
|
||||
- and counted, and the terminal shows the count. So it is not silent, and
|
||||
- no record gets a type it doesn't have. Mapping it to an existing type
|
||||
- with `visibility: unavailable` was the other option Filbert offered. It
|
||||
- isn't taken because each existing type has meaning a client acts on, for
|
||||
- example tool-start opening an effect.
|
||||
|
||||
- **C-5: interrupt outcomes other than an interrupted turn (R3).**
|
||||
`turnProof.turnState` allows `interrupted`, `unknown` and
|
||||
@@ -246,8 +239,9 @@
|
||||
`completed-before-interrupt`, `failed-before-interrupt`,
|
||||
`no-run-at-interrupt`),
|
||||
allowed by `reconcile-interrupt` without recording `turn-interrupted`.
|
||||
- Until C-5 lands, those stops stay `uncertain` (§3 rule 5). Adoption goes
|
||||
- through I1b.
|
||||
+ Until C-5 lands, those stops stay `uncertain` (§3 rule 5). C-5 moves to
|
||||
+ CHAT-04 with its own contract review (lead decision 30), so CHAT-03
|
||||
+ ships that interim rule only.
|
||||
|
||||
**Deviation V-1, accepted with limits (lead decision 25).** CHAT-01 line 145 says an exact
|
||||
retry after reconnect returns the existing receipt. CHAT-01C line 212 says
|
||||
@@ -270,7 +264,7 @@
|
||||
wire. It stores the CHAT-01 `binding` fields it needs. If one is missing,
|
||||
that becomes a C item, not an edit.
|
||||
- New refusal and reason names (`busy`, `stale-incarnation`,
|
||||
- `engine-pin-mismatch`, `session-drift`, `live-session-refused`,
|
||||
+ `engine-pin-mismatch`, `live-session-refused`,
|
||||
`foreign-host`, `transport-unknown`, `handled-without-run`,
|
||||
`ack-without-start`, `interrupted`, `no-turn`, `unsealed-engine`,
|
||||
`run-overlap`) are bounded draft IDs, like the existing names CHAT-01
|
||||
@@ -280,18 +274,21 @@
|
||||
|
||||
### What ships
|
||||
|
||||
-Four increments. Each is its own candidate and review round, as with the
|
||||
-queue-as-data A1/A2 split. An increment starts when everything in its
|
||||
-"Needs first" column is met, so I2 and I3 can run in parallel after I1.
|
||||
+Three increments: I1, I3 and I4. Each is its own candidate and review
|
||||
+round, as with the queue-as-data A1/A2 split. An increment starts when
|
||||
+everything in its "Needs first" column is met. Lead decision 30 cut I2
|
||||
+(Pi dialogs) and moved I1b (C-5 adoption) to CHAT-04.
|
||||
|
||||
| Increment | Content | Needs first |
|
||||
|---|---|---|
|
||||
-| I1 | Controller, transport, writer claim, Pi adapter on a fake Pi engine, incremental events, mediated terminal, interrupt, force stop and recovery. Fixtures in §2–§6 and §9, except the approval races H5–H8; the §10 checks. | Brief approved; author named |
|
||||
-| I1b | C-5 adoption: the controller fills the new `turnState` values, so `reconciled` may follow a Completed first, Failed on its own or No run outcome. C-1 is withdrawn (see "Contracts implemented"). | I1 approved; C-5 approved |
|
||||
-| I2 | Pi native dialogs (§7) and the approval races H5–H8 on Pi dialogs | I1 approved; C-2 approved |
|
||||
+| I1 | Controller, transport, writer claim, Pi adapter on a fake Pi engine, incremental events, mediated terminal, interrupt, force stop and recovery. Fixtures in §2–§6 and §9, except the approval races H5–H8, which run in I4; the §10 checks. | Brief approved; author named |
|
||||
| I3 | The B1 evidence packet for Claude (§8) | I1 approved. Jason's go for any run that calls a model or reads Claude auth. |
|
||||
| I4 | Claude adapter, catalogue and history (§7, §8), and H5–H8 on Claude permission requests | I3 approved, so B1 passed; C-3 if it exists |
|
||||
|
||||
+**Build note (Rocko, R3).** The `no-turn` refusal lifts only the fence
|
||||
+its own Interrupt set. It never reopens admission that a concurrent force
|
||||
+stop, overlap signal or revocation closed. H10 covers those branches.
|
||||
+
|
||||
**If B1 does not pass.** Sage records B1 as not passed when any of these
|
||||
happens:
|
||||
- Jason declines the go for the I3 recordings;
|
||||
@@ -303,10 +300,6 @@
|
||||
`unsupported-harness`, and CHAT-06's both-harness gate stays blocked with
|
||||
CHAT-03 as its owner. The outcome is recorded, not a silent narrowing.
|
||||
|
||||
-**If C-2 is declined.** If Sage or Jason declines C-2, I2 is void. Pi
|
||||
-non-permission dialogs stay disabled, as CHAT-01 lines 239–242 require.
|
||||
-Sage records that, and CHAT-03 can close without I2.
|
||||
-
|
||||
#### 1. Controller and transport
|
||||
|
||||
- One controller process per execution owns the engine's stdin. Pi runs in
|
||||
@@ -416,7 +409,8 @@
|
||||
- **Fields.** A revision stores:
|
||||
- the key, the claim ID and the binding ID;
|
||||
- the harness, conversation, and branch and leaf at launch;
|
||||
- - the config pins: engine version, binary sha256 and launch argv digest;
|
||||
+ - the config pins: engine version, engine pin (the Pi package integrity
|
||||
+ of §3, or the Claude binary sha256 of §8) and launch argv digest;
|
||||
- the host identity (`/etc/machine-id`) and boot ID;
|
||||
- the owning controller: pid, process start time and incarnation token;
|
||||
- the intended scope unit name, derived from the claim ID, recorded
|
||||
@@ -479,68 +473,16 @@
|
||||
configured data root, or a path named in any seat registration. This is
|
||||
what makes CHAT-03 fixture-only in code and not just by convention. The
|
||||
guard comes out only at cutover (CHAT-07), when the live location is
|
||||
- reviewed as a data-map change.
|
||||
+ reviewed as a data-map change. The claim excludes only controllers that
|
||||
+ use it: a `pi --session` run outside Mosaic isn't prevented, and the
|
||||
+ guard is what keeps CHAT-03 off real sessions. The idle session drift
|
||||
+ check moves to CHAT-07 (lead decision 30).
|
||||
- **What never releases a claim.** Disconnect never changes a claim.
|
||||
`agent_settled`, EOF, SIGTERM, idle and an abort acknowledgement never
|
||||
release one. CHAT-00 line 65 says settled must not release a writer
|
||||
claim. CHAT-01 line 325 says SIGTERM, EOF, an abort acknowledgement and
|
||||
idle don't prove death, so none of them can support a `stopped`
|
||||
revision either.
|
||||
-- **Session drift, not foreign-writer attribution.** Pinned Pi emits
|
||||
- `message_end` to RPC listeners before `SessionManager.appendMessage`
|
||||
- creates the entry ID (`dist/core/agent-session.js` lines 386–398).
|
||||
- `entry_appended` fires only for extension custom entries (line 2033).
|
||||
- So the stream carries no ID that tells the engine's own appends from
|
||||
- another writer's. The drift check compares the file with the engine's own
|
||||
- list instead:
|
||||
- - `get_entries` returns every entry the engine holds, in append order,
|
||||
- with stable IDs (`rpc.md` lines 717–745; `rpc-mode.js` line 505).
|
||||
- - The pinned `SessionManager` reads the file only at construction or
|
||||
- `setSessionFile` (`session-manager.js` lines 606–684). It never re-reads
|
||||
- it mid-session, so an entry another writer appends is on disk but not
|
||||
- in the engine's list. The author confirms that from the pinned source
|
||||
- before I1 code.
|
||||
- - For a new session file, Pi keeps entries in memory before the first
|
||||
- assistant message and writes the file only when that message arrives
|
||||
- (`_persist`, lines 739–767). The engine's list can run ahead of the
|
||||
- disk. That is not drift. A loaded file is flushed at load (line 637),
|
||||
- so Pi appends to it at once.
|
||||
- - Pi may write the file while loading it. It adds a newline after a
|
||||
- truncated last line (line 319), writes a header into an empty file
|
||||
- (lines 632–633), and rewrites the file on version migration (line
|
||||
- 677). So the controller takes its baseline (size, inode and entry IDs)
|
||||
- only after load, at the first `get_state` reply, and never earlier.
|
||||
-
|
||||
- The check runs when the engine is idle: after `agent_settled`, with no
|
||||
- command in flight. It reads the file first, then `get_entries`. An
|
||||
- engine append between the two reads then lands in the engine's list
|
||||
- after the disk prefix, and the prefix rule absorbs it; the other order
|
||||
- would count it as drift. Drift is any of:
|
||||
- - an entry ID on disk that the engine's list lacks, or an ID that appears
|
||||
- twice (the session header is excluded, since `get_entries` omits it,
|
||||
- `rpc.md` line 719; the header is checked separately against the
|
||||
- claim's session identity);
|
||||
- - disk entries that aren't a prefix of the engine's list, in order;
|
||||
- - the file shrinks, is replaced (inode change), or has a line that isn't a
|
||||
- valid entry.
|
||||
-
|
||||
- The engine's own settings, model-change, label and compaction entries are
|
||||
- in its list, so they never count as drift. On drift, admission closes,
|
||||
- the binding goes to `uncertain` with reason `session-drift`, and views get
|
||||
- a reconcile marker. Plan lines 179–180 require refusing a second writer
|
||||
- until the prior execution is reconciled. The file comparison and the
|
||||
- marker are this brief's design for that. If `get_entries` fails or times
|
||||
- out, the check reports `uncertain` and admission stays closed.
|
||||
-
|
||||
- Stated limits:
|
||||
- - A foreign write that lands mid-turn is caught at the next idle check,
|
||||
- not when it happens.
|
||||
- - A foreign writer that rewrites the file in place with the same entry
|
||||
- IDs and inode isn't distinguishable from the engine's own writes. The
|
||||
- content isn't compared.
|
||||
- - The claim excludes only controllers that use it. A `pi --session` run
|
||||
- outside Mosaic isn't prevented, and the live-session guard is what
|
||||
- keeps CHAT-03 off real sessions.
|
||||
- **No writes to sessions.** The controller never writes a session file and
|
||||
never uses `SessionManager.open` (CHAT-00 line 67).
|
||||
|
||||
@@ -555,7 +497,6 @@
|
||||
| W7 | Recorded boot ID differs, same machine ID | `stopped` with a boot proof. Open tool calls become `uncertain`. |
|
||||
| W8 | Resume after a proven stop with the same pins | New claim ID, generation +1, same conversation, branch and leaf |
|
||||
| W9 | Resume with a changed binary, argv digest, branch or leaf | Refused. The claim is unchanged. |
|
||||
-| W10 | A valid entry with a new ID appended while the fake engine is idle; a duplicate ID appended; the file truncated; the file replaced | Each gives `session-drift` at the idle check: admission closed, `uncertain`, reconcile marker. The controller writes nothing to the engine or the file. |
|
||||
| W11 | Controller writes to session files | None. The CHAT-02 F17 check runs over the fixture session directory. The fake engine's own appends are recorded separately and excluded. |
|
||||
| W12 | A live owner paused with SIGSTOP; a second controller starts | The second refuses `already-active`. The paused owner's revisions are unchanged after it resumes. |
|
||||
| W13 | Crash after the engine spawns but before `active` is published | Restart finds the reservation and the live unit: `uncertain`, force stop only. No second spawn. |
|
||||
@@ -564,16 +505,26 @@
|
||||
| W15 | Crash between the two keys during release | The pair stays held. Restart finishes the release under the same claim ID. |
|
||||
| W16 | A highest revision that won't parse | Held as `uncertain`, and acquisition refuses. The older `stopped` revision is not reused. |
|
||||
| W17 | A claim root copied from a fixture "other host" (different machine ID) | `foreign-host`. Nothing is promoted. |
|
||||
-| W18 | Own appends generated with the pinned `SessionManager` append path into a temp directory (never `SessionManager.open`, never a live file), including settings, model-change and compaction entries and delayed persistence after `message_end`. Also three load-time writes: a fixture file with a truncated last line (line 319), an empty file (lines 632–633), and an old-version file that migrates (line 677). And an engine append that lands between the check's file read and its `get_entries`. | No `session-drift` in any case. The baseline is taken after load. |
|
||||
-| W19 | Engine list ahead of the disk before the first assistant message of a new session file; `get_entries` times out at the idle check | The first gives no drift. The second gives `uncertain` with admission closed. |
|
||||
| G1 | Session path or claim root under `.pi/state/`, `~/.claude`, the data root, or named in a registration | `live-session-refused` at construction |
|
||||
| G2 | A symlink inside the fixture root pointing at a live session file | `live-session-refused` at bind (real-path check) |
|
||||
| G3 | A fixture path that is swapped for a live path after construction | Refused at bind |
|
||||
|
||||
#### 3. Pi adapter, incremental events and R3-1
|
||||
|
||||
-Pinned inputs for Pi 0.85.1, under
|
||||
-`node_modules/@earendil-works/pi-coding-agent/`:
|
||||
+**The Pi pin (lead decision 32).** Pi 0.85.1 is pinned by the
|
||||
+`package-lock.json` integrity of `@earendil-works/pi-coding-agent`,
|
||||
+`sha512-FGRN+OHbWaefBPGaTggAdLjrIHW+s2PzLyglz/5dfLzb9of7uuXMXYC0fJIeZTw+shS32o2cuQ9jF7YSDuL/oQ==`.
|
||||
+`pi` runs `dist/bundle/cli.js` (the package's `bin`) and its chunks, not
|
||||
+the `dist/core` and `dist/extensions` files listed below. At launch the
|
||||
+controller checks that `package-lock.json` and npm's installed record
|
||||
+(`node_modules/.package-lock.json`) both name 0.85.1 with that integrity,
|
||||
+and otherwise refuses `engine-pin-mismatch`. That ties the install to the
|
||||
+package through npm's record. It isn't a hash of the files on disk.
|
||||
+
|
||||
+The files below are the sources this brief cites for line numbers, hashed
|
||||
+at `f2b9e622`, under `node_modules/@earendil-works/pi-coding-agent/`.
|
||||
+Filbert's R3 review found that the bundle matches them on every point the
|
||||
+brief relies on.
|
||||
|
||||
- `docs/rpc.md` (`15fcd26bee72777b373fd5f2edd77091a01cadd4de95e48b08422ced0552a28d`)
|
||||
- `dist/modes/rpc/rpc-mode.js` (`e7e4724aa55c5aac73cf36793653b26736200e5c59d58373990fc31028f86477`)
|
||||
@@ -628,7 +579,7 @@
|
||||
message-end with `updateMode: replace`, and run-settled.
|
||||
- Every event carries the execution incarnation and a sequence number
|
||||
for that execution.
|
||||
- - An unknown native event gets no client event until C-4. It is
|
||||
+ - An unknown native event gets no client event. It is
|
||||
recorded in controller evidence and counted, and the terminal shows
|
||||
the count. It is never dropped silently and never passed through raw.
|
||||
- `agent_settled` maps to run-settled, never to cohort termination.
|
||||
@@ -704,37 +655,33 @@
|
||||
that ties a run to a prompt. So CHAT-03 removes every other source of turns
|
||||
and input, and doesn't guess. A binding needs a sealed engine:
|
||||
- The controller builds the launch argv. Pi starts with `--no-extensions`,
|
||||
- `--no-prompt-templates` and `--no-themes`, and loads extensions only by
|
||||
- explicit `--extension` path (`dist/cli/args.js` lines 135–140, 167 and 170;
|
||||
- `docs/usage.md` lines 224 and 233–236). With `--no-extensions`, Pi loads
|
||||
- only the paths given on the command line and ignores settings and
|
||||
- packages (`dist/core/resource-loader.js` lines 316–318). Each
|
||||
- `--extension` must be a local path; npm and git sources refuse. Skills
|
||||
- stay allowed: they expand text and start no turn (§4).
|
||||
+ `--no-prompt-templates` and `--no-themes`, and with no `--extension`
|
||||
+ argument (lead decision 31; `dist/cli/args.js` lines 135–140, 167 and
|
||||
+ 170; `docs/usage.md` lines 224 and 233–236). With `--no-extensions`, Pi
|
||||
+ loads only the paths given on the command line and ignores settings and
|
||||
+ packages (`dist/core/resource-loader.js` lines 316–318), so no explicit
|
||||
+ extension loads. Skills stay allowed: they expand text and start no turn
|
||||
+ (§4).
|
||||
- Pi also always loads its built-in extensions, whatever the flags
|
||||
(`dist/main.js` line 439). Pi 0.85.1 has one, `llama.cpp`
|
||||
(`dist/extensions/index.js`). It registers a provider and a `/llama`
|
||||
command, and no event handler or input call (`llama/index.js` lines 37
|
||||
- and 163). The registry lists it by hash like any other extension. A
|
||||
- different built-in set at the pinned version is `engine-pin-mismatch`.
|
||||
-- Every explicit extension is in the binding's extension registry, pinned
|
||||
- by the sha256 of every file in its directory tree, with a review record
|
||||
- saying it is input-silent. It never
|
||||
- calls `sendUserMessage`, `sendMessage` or any prompt path, and it queues
|
||||
- no input from any handler. Extensions that only consume input (an input
|
||||
- handler that returns handled) or only raise dialogs are allowed, since
|
||||
- neither starts a turn. In CHAT-03 the registry is the fixture registry.
|
||||
-- An extension outside the registry, a hash mismatch, a non-local
|
||||
- source, or an argv without the three `--no-*` flags refuses the binding
|
||||
- with `unsealed-engine`. The goal
|
||||
+ and 163). It is part of the pinned package (the Pi pin above), so it
|
||||
+ is pinned with it.
|
||||
+- Any `--extension` argument, or an argv without the three `--no-*`
|
||||
+ flags, refuses the binding with `unsealed-engine`. Explicit extensions
|
||||
+ aren't pinned or reviewed for binding: Rocko's R3 review showed that an
|
||||
+ extension can import code outside any hashed tree. They come back with
|
||||
+ goal in CHAT-06 (lead decision 31). The goal
|
||||
extension starts turns, so a session that loads it can't bind in CHAT-03
|
||||
- (Limit 11). CHAT-06 has to resolve that.
|
||||
+ (Limit 11). Under lead decision 30, a seat bound to the Console runs
|
||||
+ without goal, and goal continuation is a CHAT-06 item.
|
||||
|
||||
Under the seal, the Mosaic prompt in the slot is the only thing that can
|
||||
start a run, so a run that follows its ack is its run. That exclusion is
|
||||
the evidence basis for attributing by order, and the brief names it as the
|
||||
-basis. The seal rests on review of extension source, so the controller
|
||||
-also watches for signs that it failed.
|
||||
+basis. The seal rests on the launch argv and the pinned Pi build, so the
|
||||
+controller also watches for signs that it failed.
|
||||
|
||||
**Overlap signals.** Each of these means the seal failed, or Pi behaved
|
||||
outside the pinned model:
|
||||
@@ -748,7 +695,12 @@
|
||||
message between them;
|
||||
- O5: a non-empty `clear_queue`, a non-zero pending count, or a
|
||||
`queue_update` the controller didn't cause. Mosaic never queues, so
|
||||
- under the seal these are always empty;
|
||||
+ under the seal these are always empty. Pi's own clear emits a
|
||||
+ `queue_update` before the clear's response (`agent-session.js` line
|
||||
+ 1201, `rpc-mode.js` line 334). A `queue_update` read after the
|
||||
+ controller writes `clear_queue` and before that response, with empty
|
||||
+ `steering` and `followUp`, is the clear's own, and O5 counts it as
|
||||
+ caused (N25);
|
||||
- O6: a second user `message_start` in one run.
|
||||
|
||||
On any overlap signal, admission closes, the binding goes to `uncertain`
|
||||
@@ -920,8 +872,8 @@
|
||||
it. The README says that `working` is attributed through the seal.
|
||||
|
||||
The fake engine models the overlap (N10). Fixtures that break the seal
|
||||
-don't load a real unregistered extension, since the binding would refuse
|
||||
-it. The fake simulates the extension's effect instead.
|
||||
+don't load a real extension, since the binding would refuse it. The fake
|
||||
+simulates the extension's effect instead.
|
||||
|
||||
| # | Fixture | Expected |
|
||||
|---|---|---|
|
||||
@@ -929,17 +881,17 @@
|
||||
| N2 | N1 with `abort` sent first (mutant) | The fake runs the external item, so the test fails. This is the ordering guard. |
|
||||
| N3 | Fence while the Mosaic prompt is in preflight; preflight then errors, and no run exists | Receipt `failed` with the native error. Stop outcome No run: no `turnState: interrupted`, stop `uncertain`, prompts refuse until C-5, force stop available. |
|
||||
| N4 | Fence while the Mosaic prompt is in preflight; the ack arrives after the first `abort`, and a run starts | Classified by rule 4 as a run. Clear, then abort again. The run ends `aborted`: receipt `failed`, reason `interrupted`; stop outcome Interrupted; `reconciled` after a post-settle empty clear. |
|
||||
-| N5 | Mosaic prompt acked but handled by a registered input extension, with no run | `get_state` shows no run, and no `agent_start` or `agent_settled` arrived. Receipt `delivery-unknown`, reason `handled-without-run`. Nothing is resent. |
|
||||
+| N5 | Mosaic prompt acked but handled by an input handler the fake simulates, with no run | `get_state` shows no run, and no `agent_start` or `agent_settled` arrived. Receipt `delivery-unknown`, reason `handled-without-run`. Nothing is resent. |
|
||||
| N6 | During an active Mosaic run, Interrupt; the fake simulates an unsealed extension that queues between `clear_queue` and `abort` | The `queue_update` is O5. `abort` continues the queued item inside the same run (`agent-session.js` lines 787–810), so its user `message_start` is O6. `run-overlap`, stop outcome Unknown, stop `uncertain`, admission closed, force stop is the way on. |
|
||||
| N7 | `clear_queue` times out during an active run | No `abort` sent. Stop outcome Unknown. `nativeQueue: unknown`, stop `uncertain`, admission closed. A confirmed force stop still ends the cohort (K1). |
|
||||
| N8 | Filbert's order one: during Mosaic preflight (paused at the line-915 await), the fake simulates an extension prompt that starts a run first. The wire shows the Mosaic ack, the other run's `agent_start` and user `message_start`, then the losing Mosaic prompt's `agent_settled` | The other run's user `message_start` arrives before any signal, so the receipt goes to `working`. The losing settle is O3: the receipt stays `working`, shown as outcome unknown, never `finished` or `failed`. Binding `uncertain`, admission closed, nothing resent. The fixture pins the misattribution window (Limit 11). |
|
||||
| N9 | The item's run started before the fence and ends `aborted` | Receipt `failed`, reason `interrupted`, not `delivery-unknown`. Stop outcome Interrupted (`turnState: interrupted`). |
|
||||
-| N10 | Fake conformance | The fake throws on a prompt while streaming and acks before running. It emits `agent_settled` from a `finally`, and it can hold several `agent_start` … `agent_end` pairs in one run. It pauses at the preflight awaits (lines 843, 895, 915) between the line-860 check and the run start. A colliding prompt is acked, its throw is swallowed, it settles with no `agent_start`, and it leaves `isStreaming` false while the other run goes on. `clearQueue` doesn't return agent-level custom messages, and `nextTurn` messages survive a clear. A fake that queues a Mosaic prompt, or can't produce the overlap, fails the test. |
|
||||
+| N10 | Fake conformance | The fake throws on a prompt while streaming and acks before running. It emits `agent_settled` from a `finally`, and it can hold several `agent_start` … `agent_end` pairs in one run. It pauses at the preflight awaits (lines 843, 895, 915) between the line-860 check and the run start. A colliding prompt is acked, its throw is swallowed, it settles with no `agent_start`, and it leaves `isStreaming` false while the other run goes on. `clearQueue` emits an empty `queue_update` before its response, doesn't return agent-level custom messages, and leaves `nextTurn` messages in place. A fake that queues a Mosaic prompt, or can't produce the overlap, fails the test. |
|
||||
| N11 | Ack; then the run ends in a failure message before any user `message_start`; `agent_settled` arrives; the stream is complete and ordered | Receipt `delivery-unknown`, reason `ack-without-start`, never `failed`. The session file gains no user entry. The client shows outcome unknown and no resend offer. The same schedule with the failure line unparseable gives `delivery-unknown` / `transport-unknown`. |
|
||||
| N12 | During an active run, the fake simulates an extension that queues after the final empty clear | The stop records the clear's `observedAt`. The queued item's run starts with no slot held: O1, `run-overlap`, binding `uncertain`, admission closed. It is not part of the stopped turn's proof. |
|
||||
| N13 | The fake emits an `agent_start` with no slot held (a simulated turn-starting extension) | O1: binding `uncertain`, `run-overlap`, admission closed. A prompt sent afterwards refuses with zero engine bytes. |
|
||||
| N14 | The run completes normally (`stopReason: stop`) while `clear_queue` is in flight; `abort` then reaches an idle engine; all clears empty | Receipt `finished`, effects kept. Stop outcome Completed first. No `turnState: interrupted`, no `reconciled`, stop `uncertain`, prompts refuse until C-5, force stop available. |
|
||||
-| N15 | Fence while the Mosaic prompt is in preflight; after the first clear and abort, a registered input extension handles it and Pi acks with no run | Receipt `delivery-unknown`, reason `handled-without-run`. No second clear or abort is sent. Stop outcome No run: `uncertain` until C-5. |
|
||||
+| N15 | Fence while the Mosaic prompt is in preflight; after the first clear and abort, an input handler the fake simulates handles it and Pi acks with no run | Receipt `delivery-unknown`, reason `handled-without-run`. No second clear or abort is sent. Stop outcome No run: `uncertain` until C-5. |
|
||||
| N16 | Interrupt with no slot held and no visible run | Refused `no-turn`. No stop record, no engine bytes. Admission is open afterwards, and the next prompt is admitted. |
|
||||
| N17 | The run fails on its own (`stopReason: error`) during the clear and abort exchange | Receipt `failed`. Stop outcome Failed on its own: `uncertain` until C-5. |
|
||||
| N18 | The run settles with no final assistant `message_end`, or a line is lost during the exchange | Receipt `working`, shown as outcome unknown. A lost line after `working` never moves it back to `delivery-unknown`. A lost line before `working` gives `delivery-unknown` / `transport-unknown`. Stop outcome Unknown: `uncertain`. |
|
||||
@@ -948,7 +900,8 @@
|
||||
| N21 | The losing prompt's `agent_settled` is delayed until after the Mosaic receipt settled `finished` | O2 on arrival: binding `uncertain`, `run-overlap`, admission closed. The receipt stays `finished`, since receipts are monotonic, and evidence records the overlap against it (Limit 11). |
|
||||
| N22 | During an active run, the fake simulates an extension `sendMessage` queued straight into the agent; Interrupt | The clear returns empty and the item is gone. Evidence records agent-level queues as unobservable, with the seal as the basis, and never as "nothing removed". This fixture pins the Limit 7 gap: no signal fires. |
|
||||
| N23 | The fake simulates a `nextTurn` message queued before an Interrupt | It survives clear and abort and attaches to the next Mosaic prompt. No signal fires. The fixture pins the Limit 7 gap. |
|
||||
-| N24 | Launch with an extension outside the registry, a registered extension whose hash differs, a non-local extension source (npm or git), or an argv missing `--no-extensions`, `--no-prompt-templates` or `--no-themes` | `unsealed-engine` at bind, for each case. No engine is started. |
|
||||
+| N24 | Launch with any `--extension` argument (a local path, an npm or git source), or an argv missing `--no-extensions`, `--no-prompt-templates` or `--no-themes` | `unsealed-engine` at bind, for each case. No engine is started. |
|
||||
+| N25 | An ordinary Interrupt of an active Mosaic run: the fake emits Pi's empty `queue_update` before each `clear_queue` response, and the run ends `aborted` | No overlap signal. Stop outcome Interrupted, `reconciled` after the post-settle empty clear, admission reopens. A non-empty `queue_update` in the same window is O5. |
|
||||
|
||||
#### 4. The slash path (carry-forward 3)
|
||||
|
||||
@@ -1006,7 +959,9 @@
|
||||
#### 5. Control races (Rocko)
|
||||
|
||||
Each race uses the fake engine's pause points to land at an exact step.
|
||||
-Every race asserts the engine bytes, the receipts and the events.
|
||||
+Every race asserts the engine bytes, the receipts and the events. H5–H8
|
||||
+run in I4 on Claude permission requests. Pi dialogs are cut (lead
|
||||
+decision 30).
|
||||
|
||||
| # | Race | Expected |
|
||||
|---|---|---|
|
||||
@@ -1019,7 +974,7 @@
|
||||
| H7 | Conflicting approval answers with the same request ID | The second is refused |
|
||||
| H8 | An approval answer after a native timeout or cancel | Refused. The state comes from native evidence. |
|
||||
| H9 | Interrupt racing a prompt's dispatch | Fence set before the write: the item is `dispatch-refused` with no engine bytes, and with no run active the Interrupt then refuses `no-turn` (no stop record). Fence set after the write began: §3 rules 4–6. |
|
||||
-| H10 | Interrupt and force stop at the same time | One stop chain. Force stop supersedes (CHAT-01 lines 319–322). |
|
||||
+| H10 | Interrupt and force stop at the same time; again with an overlap signal or a revocation closing admission before the Interrupt finds no slot and refuses `no-turn` | One stop chain. Force stop supersedes (CHAT-01 lines 319–322). The `no-turn` cleanup lifts only its own fence: admission stays closed under the surviving reason. |
|
||||
| H11 | The controller disconnects mid-turn | Work continues and the claim is unchanged. Control stays with the disconnected connection until an observer takes over explicitly. Nothing happens automatically. |
|
||||
| H12 | Exact retry of a prompt after reconnecting to the same controller incarnation | The same receipt. No second dispatch. |
|
||||
| H13 | Retry with the same request ID and different text | Refused |
|
||||
@@ -1167,25 +1122,12 @@
|
||||
| K17 | Two launcher calls with one eligibility record | One launch. The other refuses, and no second engine starts. |
|
||||
| K18 | The leaf changes after eligibility, before launch | Launch refused. The reservation stays until released with proof. |
|
||||
|
||||
-#### 7. Native approval dialogs (I2 after C-2; Claude in I4)
|
||||
+#### 7. Claude permission requests (I4)
|
||||
|
||||
-- Pi has no built-in permission system. Approvals come from extensions
|
||||
- through `extension_ui_request` (`rpc.md` lines 1186–1210). Repository seats
|
||||
- load no extension that raises dialogs today, so I2 tests with a fixture
|
||||
- extension.
|
||||
-- CHAT-01 lines 239–242 and 292 block non-permission forms until CHAT-03D
|
||||
- exists, and C-2 is that companion. After C-2:
|
||||
- - `confirm` and `select` render the exact native labels and answer with
|
||||
- the exact request ID;
|
||||
- - `input` and `editor` stay unsupported and show as disabled, with a
|
||||
- reason;
|
||||
- - nothing is answered on the user's behalf, and a generic "yes" is not
|
||||
- accepted.
|
||||
-- Cancel is enabled only where C-2 proves it can't mean allow. A Pi select
|
||||
- cancel does not inherit confirm's meaning (lines 293–295).
|
||||
-- Pending dialogs don't survive a Pi restart (CHAT-00 line 69). After a
|
||||
- takeover, the controller reprojects each dialog: a new projection ID for
|
||||
- the same decision (lines 282–287).
|
||||
+- Pi native dialogs are cut from CHAT-03 (lead decision 30). CHAT-01
|
||||
+ lines 239–242 and 292 block non-permission forms until CHAT-03D exists,
|
||||
+ so a Pi `extension_ui_request` is shown disabled, with a reason, and is
|
||||
+ never answered.
|
||||
- **Claude, in I4 after B1.** `can_use_tool` maps to allow-once and deny.
|
||||
Choices that widen permissions are disabled, and there is no invented
|
||||
cancel (lines 294–295). Pending permission requests are re-read from
|
||||
@@ -1194,12 +1136,7 @@
|
||||
|
||||
| # | Fixture | Expected |
|
||||
|---|---|---|
|
||||
-| P1 | `confirm` dialog answered by the controller | One `extension_ui_response` with the exact ID and value |
|
||||
-| P2 | `select` with labels containing markup and bidi controls | Exact labels, rendered inert |
|
||||
-| P3 | `input` or `editor` dialog | Disabled, with a reason. No response is sent. |
|
||||
-| P4 | A native timeout before the answer | `uncertain`, then resolved from native evidence. A late answer is refused (H8). |
|
||||
-| P5 | Takeover while a dialog is pending | New projection ID and the old one superseded. One native answer. |
|
||||
-| P6 | Interrupt while a dialog is pending | The approval becomes `uncertain`, not denied (lines 297–299) |
|
||||
+| P3 | A Pi `confirm`, `select`, `input` or `editor` dialog | Disabled, with a reason. No response is sent. |
|
||||
| P7 | A Claude permission request (I4, recorded fixture) | Allow-once and deny only. Widening choices disabled. |
|
||||
|
||||
#### 8. Claude: B1 and the catalogue (carry-forward 2)
|
||||
@@ -1284,7 +1221,7 @@
|
||||
| E2 | U+2028 and U+2029 inside JSON strings, and CRLF | Each parsed as one record |
|
||||
| E3 | Multipart final, two blocks, null request correlation, duplicate delivery | The CHAT-01 cases at lines 110–112 |
|
||||
| E4 | A page read just after a `message_end` but before its entry is persisted, then a subscription; again with a gap or a new epoch | Replay is advertised unavailable. The client shows a reconcile marker at the seam and re-reads the page after `agent_settled`. After that, each message appears exactly once. A gap or new epoch also reconciles. If the author shows an atomic cut from the source, overlap is deduplicated instead, and the fixture pins that case. |
|
||||
-| E5 | An unknown native event | No client event until C-4. Controller evidence records its type and byte count, and the terminal count goes up. No record fails the schema. |
|
||||
+| E5 | An unknown native event | No client event. Controller evidence records its type and byte count, and the terminal count goes up. No record fails the schema. |
|
||||
| E6 | A tool result delayed across a pause and a reconnect | Reconciled without a manual refresh |
|
||||
| E7 | The mediated terminal as observer, then as controller | Renders the same stream as the library client, and submits only as controller |
|
||||
|
||||
@@ -1338,8 +1275,6 @@
|
||||
22. a unit with a different invocation ID is signalled;
|
||||
23. a restart during force stop records the kill phase as done;
|
||||
24. an eligibility record can be used twice;
|
||||
- 25. a disk entry ID missing from `get_entries` is ignored (and the
|
||||
- reverse: an own settings or compaction entry counts as drift);
|
||||
26. a non-empty `clear_queue` reaches `reconciled`;
|
||||
27. the pending slot's in-flight preflight is abandoned at the fence
|
||||
instead of awaited, so a late ack's run is never aborted (N4);
|
||||
@@ -1363,14 +1298,15 @@
|
||||
the slot's settle (N8, N19);
|
||||
36. an `agent_start` or `agent_settled` with no slot held is ignored, so
|
||||
admission stays open (N13, N21);
|
||||
- 37. the binding launches without the `--no-*` flags, with an
|
||||
- unregistered or non-local extension, or without checking the
|
||||
- registry hashes (N24);
|
||||
+ 37. the binding launches without the `--no-*` flags, or with an
|
||||
+ `--extension` argument (N24);
|
||||
38. an `ack-without-start` run settles `failed` (N11);
|
||||
39. an empty clear is recorded as proof that no external input was
|
||||
removed, instead of naming the seal as the basis (N22).
|
||||
|
||||
- I4 adds two more: the pin check is skipped, and the decoy file is listed.
|
||||
+ Mutant 25 (drift) left with the drift check for CHAT-07, and its number
|
||||
+ isn't reused. I4 adds two more: the pin check is skipped, and the decoy
|
||||
+ file is listed.
|
||||
|
||||
#### 11. Choices in this brief, for review
|
||||
|
||||
@@ -1378,30 +1314,28 @@
|
||||
|---|---|
|
||||
| No broker queue; a busy engine refuses `busy` | No queued follow-ups until CHAT-04, and no native queueing of mediated input |
|
||||
| No `streamingBehavior`, `steer` or `follow_up`, and one pending slot | Same as above. On pinned Pi a Mosaic prompt then never enters a native queue (lines 860–863). It can still lose a race in preflight to another run (lines 860–949), which the seal and the overlap signals handle (§3). |
|
||||
-| Sealed engine: `--no-extensions` and a registry of hash-pinned, input-silent extensions (`unsealed-engine`) | Without run IDs, only excluding every other source of turns lets a run be attributed to the slot by order. The cost is that no session loading goal, or any turn-starting extension, can bind in CHAT-03 (Limit 11). The seal rests on reviewing extension source, so the overlap signals watch for its failure. |
|
||||
+| Sealed engine: `--no-extensions` and no `--extension` (`unsealed-engine`; lead decision 31) | Without run IDs, only excluding every other source of turns lets a run be attributed to the slot by order. The cost is that no explicit extension loads in CHAT-03, goal included (Limit 11). They come back in CHAT-06. The overlap signals watch for a seal failure. |
|
||||
| Overlap signals close admission and make the binding `uncertain` (`run-overlap`) | One overlap needs a force stop to move on, and never produces a guessed receipt. Some seal failures give no signal (Limits 7 and 11). |
|
||||
| The slot settles only on evidence tied to its own prompt, never from `clear_queue`, idle or a settle alone | An ack with no run, and a run that fails before its user message, stay `delivery-unknown`: no "unsent" state and no safe-resend button |
|
||||
| Receipt settlement and the stop outcome are classified separately (§3 rules 4 and 5) | A turn that finishes during an Interrupt is reported as finished, not interrupted. The cost is that the stop can't reconcile: until C-5 it stays `uncertain` and needs a force stop, even though nothing was lost. |
|
||||
| Interrupt with nothing running refuses `no-turn` | Narrows the completion race to the clear and abort window. The controller can refuse just before it reads a new run's `agent_start`; the run keeps going and the actor retries. |
|
||||
-| C-1 withdrawn and restated for CHAT-06 | The clear can't account for everything an abort removes (F2), so no `turnProof` field claims it does. Under the seal a non-empty clear is an overlap signal, and it needs a force stop. |
|
||||
| Poison the pipe on an unknown write | One transport glitch needs a force stop, with no guessing about half-written lines |
|
||||
-| Drift by comparing the file with `get_entries` at idle | Catches any foreign entry with a new ID, but only at the next idle check. An in-place rewrite with the same IDs and inode isn't caught. |
|
||||
| Live-session guard by path | Fixture-only is enforced in code. The guard needs a reviewed change to lift at CHAT-07. |
|
||||
| No default claim root | Nothing live can use I1 before the CHAT-07 data-map decision |
|
||||
| Cohort is an `engine` child cgroup in a delegated user scope, held by a shim, with a cgroup namespace against migration | Depends on `systemd-run --user`, delegation, `cgroup.freeze`, `cgroup.kill` and user namespaces. Without them, or if K13 fails, stops end at `uncertain`. The verifier is fixture-grade until B3/B4. |
|
||||
| One actor, `local-operator`, guarded only by socket-directory mode | Same-uid agents are not kept out (Limit 1) |
|
||||
| Dedup lasts one controller incarnation, fenced by a token (deviation V-1, accepted with limits in lead decision 25) | A retry across a restart refuses `stale-incarnation` instead of returning the receipt. The client shows "outcome unknown, check the transcript" and never resends. CHAT-04's durable receipts must restore the contract behavior. |
|
||||
-| Four increments, with I3/I4 gated on B1 | CHAT-03 can close Pi-only, with that outcome recorded |
|
||||
+| Three increments, with I3/I4 gated on B1 | CHAT-03 can close Pi-only, with that outcome recorded |
|
||||
| Claude catalogue from launcher receipts only | A Claude session started outside the launcher never appears |
|
||||
|
||||
### Carry-forwards
|
||||
|
||||
| # | Sage's item | Where | Acceptance evidence |
|
||||
|---|---|---|---|
|
||||
-| 1 | D1 writer-claim record and R3-1 (lead decisions item 8) | §1, §2, §3 | W1–W20, G1–G3, N1–N24 and H18–H23 pass. Mutants 2, 3, 12–20 and 25–39 fail tests. R3-1 binds only sealed engines, settles each receipt only on evidence tied to its own prompt (§3 rule 4), and classifies the stop separately (rule 5). Any overlap signal closes admission. Only an interrupted turn reconciles. The other stop outcomes leave the stop `uncertain` until C-5 lands or is carried (Gate). |
|
||||
+| 1 | D1 writer-claim record and R3-1 (lead decisions item 8) | §1, §2, §3 | W1–W9, W11–W17, W20, G1–G3, N1–N25 and H18–H23 pass. Mutants 2, 3, 12–20 and 26–39 fail tests. R3-1 binds only sealed engines, settles each receipt only on evidence tied to its own prompt (§3 rule 4), and classifies the stop separately (rule 5). Any overlap signal closes admission. Only an interrupted turn reconciles. The other stop outcomes leave the stop `uncertain` until C-5 lands in CHAT-04 (lead decision 30). |
|
||||
| 2 | The Claude catalogue after B1 | §8; increments I3 and I4 | The B1 packet (parts 1–5), approved by Filbert and Rocko. L1–L7 pass. |
|
||||
| 3 | The board send that can become a Pi slash command | §4 | S1–S7 pass. Mutants 5 and 10 fail tests. The DEFERRED entry stays open for seats still on tmux. |
|
||||
-| 4 | The CHAT-01/01C contracts, by path and hash | "Contracts implemented" | The hash table matches `sha256sum` at approval. C-2 to C-5 are separate reviewed items, none folded in. C-1 is withdrawn and restated for CHAT-06. Deviation V-1 is accepted with limits (lead decision 25): H21 and H23 pass, the client never resends, and V-1's closure is a required CHAT-04 item (lead decision 25). CHAT-04's brief must list it. |
|
||||
+| 4 | The CHAT-01/01C contracts, by path and hash | "Contracts implemented" | The hash table matches `sha256sum` at approval. C-3 is a separate reviewed item if B1 needs it, and C-5 moves to CHAT-04. C-1, C-2 and C-4 are cut (lead decision 30). Deviation V-1 is accepted with limits (lead decision 25): H21 and H23 pass, the client never resends, and V-1's closure is a required CHAT-04 item (lead decision 25). CHAT-04's brief must list it. |
|
||||
| 5 | Path authority | "Files owned" | The overlap table. Every changed path in each candidate is inside "Files owned". |
|
||||
| 6 | The source author | "Owner and reviewer" | `<slot>`, named by Darkwing after this brief is approved |
|
||||
|
||||
@@ -1421,10 +1355,9 @@
|
||||
effects stay `uncertain`. A same-uid process outside the cohort can
|
||||
still move members out. The verifier is the fixture registry. No CHAT-03
|
||||
stop proof is live authority until B3/B4 and B2.
|
||||
-5. **Sole writer.** Pinned Pi gives no stream ID for its own appends. The
|
||||
- `get_entries` comparison catches a foreign entry at the next idle
|
||||
- check, not during a turn, and misses an in-place rewrite that keeps IDs
|
||||
- and inode. The claim binds only controllers that use it. Real sessions
|
||||
+5. **Sole writer.** CHAT-03 has no session drift check; it moves to
|
||||
+ CHAT-07 (lead decision 30). The claim binds only controllers that use
|
||||
+ it. Real sessions
|
||||
stay off-limits through the live-session guard.
|
||||
6. **Durability.** W5 kills processes at each barrier. Real power loss
|
||||
isn't tested; the fsync-then-`link()` order is the stated basis.
|
||||
@@ -1450,20 +1383,21 @@
|
||||
has to check the transcript. CHAT-04's durable receipts close this.
|
||||
11. **Sealed engines only.** Pinned Pi ties no run to a prompt, so
|
||||
CHAT-03 attributes runs by order under the seal. A session that loads
|
||||
- the goal extension, or any extension that starts turns or queues
|
||||
- input, can't bind (`unsealed-engine`). The five Pi repository seats
|
||||
+ any explicit extension, goal included, can't bind (`unsealed-engine`,
|
||||
+ lead decision 31). The five Pi repository seats
|
||||
(Darkwing, Dewey, Filbert, Researcher, Sage) load goal through
|
||||
- `scripts/agent-host-dev.sh` line 137, so none of them could move to
|
||||
- the mediated path as it stands. The seal
|
||||
- rests on reviewing extension source. A failure that the overlap
|
||||
- signals don't catch goes undetected: an input call from an extension
|
||||
- that passed review and queues straight into the agent (Limit 7).
|
||||
- Other failures are caught late. Another run's user `message_start`
|
||||
- that arrives before any signal puts the item in `working`, and the
|
||||
- signal that follows can only mark it outcome unknown (N8). A spurious
|
||||
- settle delayed until after the receipt settled signals only once the
|
||||
- receipt is final (N21). CHAT-06 owns turn-starting extensions, which need
|
||||
- run-to-prompt evidence from Pi (restated C-1).
|
||||
+ `scripts/agent-host-dev.sh` line 137, so none of them can bind with
|
||||
+ goal loaded. Under lead decision 30, a seat bound to the Console runs
|
||||
+ without goal, and goal continuation is a CHAT-06 item. The seal
|
||||
+ rests on the launch argv and the pinned Pi build. A failure there
|
||||
+ that the overlap signals don't catch goes undetected if it queues
|
||||
+ straight into the agent (Limit 7). Other failures are caught late.
|
||||
+ Another run's user `message_start` that arrives before any signal puts
|
||||
+ the item in `working`, and the signal that follows can only mark it
|
||||
+ outcome unknown (N8). A spurious settle delayed until after the
|
||||
+ receipt settled signals only once the receipt is final (N21).
|
||||
+ CHAT-06 owns explicit and turn-starting extensions, which need
|
||||
+ run-to-prompt evidence from Pi.
|
||||
|
||||
### Out of scope
|
||||
|
||||
@@ -1478,8 +1412,12 @@
|
||||
- The Claude adapter and history, unless B1 passes.
|
||||
- Filbert's idsDigest note, which stays in
|
||||
`agents/dewey/work/chat-02/FOLLOWUPS.md`.
|
||||
-- Turn-starting extensions, goal among them, and the restated C-1
|
||||
- (CHAT-06; Limit 11).
|
||||
+- Explicit extensions, goal continuation among them, and any pinning of
|
||||
+ them (CHAT-06; Limit 11; lead decisions 30 and 31).
|
||||
+- Cut by lead decision 30: Pi native dialogs and the CHAT-03D companion
|
||||
+ (C-2), the unknown-event type (C-4) and the removed-input `turnProof`
|
||||
+ (C-1). C-5 moves to CHAT-04, and the idle session drift check to
|
||||
+ CHAT-07.
|
||||
|
||||
### Gate
|
||||
|
||||
@@ -1495,18 +1433,9 @@
|
||||
- Sage commits. A push needs Jason's word.
|
||||
- **Contract items.** Each is a separate reviewed change to the CHAT-01
|
||||
files, never folded into an increment.
|
||||
- - C-1 is withdrawn from CHAT-03. Sage records the restated C-1 and
|
||||
- turn-starting extensions (Limit 11) as CHAT-06 items before CHAT-03
|
||||
- is done. Under the seal, a non-empty clear leaves the stop `uncertain`
|
||||
- in every increment.
|
||||
- - C-2 is approved before I2 starts, or declined (see "What ships").
|
||||
- C-3, if B1 shows a gap, is approved before I4 starts.
|
||||
- - C-4 is optional. Without it the interim rule in "Contracts implemented"
|
||||
- holds.
|
||||
- - C-5 is approved and adopted through I1b, or Sage records that it moves
|
||||
- to CHAT-04 with the interim rule (every stop outcome except Interrupted
|
||||
- stays `uncertain`). Either one is needed before CHAT-03 is done. I1
|
||||
- ships with the interim rule.
|
||||
+ - C-5 moves to CHAT-04 (lead decision 30). CHAT-03 ships the interim
|
||||
+ rule: every stop outcome except Interrupted stays `uncertain`.
|
||||
- Deviation V-1: accepted with limits (lead decision 25). I1 is approved
|
||||
only with H21 and H23 passing and the client's "outcome unknown, check
|
||||
the transcript" display. V-1 stays open until CHAT-04's durable
|
||||
@@ -1515,11 +1444,6 @@
|
||||
- **I3.** Jason's go comes before any model call.
|
||||
- **CHAT-03 done.** All of these:
|
||||
- I1 is approved and committed;
|
||||
- - I2 is approved and committed, or C-2 is recorded as declined;
|
||||
- - I1b is approved and committed, or C-5 is carried to CHAT-04 with its
|
||||
- interim rule;
|
||||
- - the CHAT-06 items (restated C-1, turn-starting extensions) are
|
||||
- recorded;
|
||||
- I4 is approved and committed, or B1 is recorded as not passed (the
|
||||
triggers are in "What ships"), with Claude still refusing and CHAT-06
|
||||
blocked.
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,75 @@
|
||||
# CHAT-03 brief review request (#1507, row 5)
|
||||
|
||||
From Dewey, 2026-09-26. Sage assigned this brief under lead decision 22.
|
||||
|
||||
## Candidate
|
||||
|
||||
- `agents/dewey/work/chat-03/BRIEF.md`, R1.
|
||||
- sha256 `5dd447f710d425ae01a12dcb56421fa948faf6b44d07c8778ba3ab9f8459daf1`, 700 lines.
|
||||
- Base `40a02d2b`. The file is untracked and nothing is staged.
|
||||
- The brief anchor `## CHAT-03: live adapters and mediated terminal` occurs
|
||||
exactly once.
|
||||
|
||||
This is a brief only. It includes no source, no contract edit and no seat
|
||||
change.
|
||||
|
||||
## What each reviewer is asked to do
|
||||
|
||||
**Filbert: the whole brief.** Approve or request changes against the exact
|
||||
hash. In particular:
|
||||
|
||||
- Whether the six carry-forwards are each settled with testable evidence
|
||||
(the "Carry-forwards" table).
|
||||
- Whether "Files owned" and the overlap table are exact and stay clear of
|
||||
queue A1/A2, Piece B and `packages/ledger`.
|
||||
- Whether C-1 to C-3 are the right split. Is anything folded into the code
|
||||
that should be a reviewed contract change?
|
||||
- Whether the increment order (3A → 3B after C-2, 3C with Jason's go, then
|
||||
3D after B1) holds, and whether closing Pi-only on a B1 failure is stated
|
||||
clearly enough.
|
||||
|
||||
**Rocko: an adversarial pass on §5 (control races) and §6 (stop, cohort
|
||||
proof and recovery).** Also on the R3-1 rule in §3 and the restart
|
||||
classification in §2, since those feed §6. Look for:
|
||||
|
||||
- A race or crash point missing from H1–H17 or K1–K10.
|
||||
- An expected result that allows two writers, a lost claim, a false
|
||||
`stopped`, or a replay.
|
||||
- A fixture that can pass while the property it names is false.
|
||||
- Anything in §6 that depends on the engine's own report where CHAT-01 says
|
||||
it isn't proof.
|
||||
|
||||
Findings are blocking or not blocking. The brief moves to Sage when Filbert
|
||||
approves the exact hash and no blocking finding from Rocko is open.
|
||||
|
||||
## Sources the brief cites, hashed at `40a02d2b`
|
||||
|
||||
| Path | sha256 |
|
||||
|---|---|
|
||||
| `docs/plans/chat-00/README.md` | `991663e607404c2f022716bd45b40d5b3092d53c3f9f61bbafd455c0659b832f` |
|
||||
| `docs/plans/chat-01/README.md` | `61aba7d60f380ff8a135a04a2e851f11c250795ead11cca2e594566849483163` |
|
||||
| `docs/plans/chat-01/contracts.schema.json` | `38382e08c97635f8864e6953b6cf44ec324040397a1aa8fc3f86e279abe36db1` |
|
||||
| `docs/plans/chat-01c/README.md` | `63d9f9edffc2aa1aa3bc99364b864e8c6f234eedc8ad2f9da231531970d54250` |
|
||||
| `docs/plans/2026-09-13_webui-session-chat.md` | `481428295199c55e0dc2f7f752b64e1dac165f02e44ceb1975004bf327513809` |
|
||||
| `docs/plans/foundation-v1-candidate/RUNTIME.md` | `b1a2b4d0df88ba6f7b197252807f3a3925ffff9375f4e70d4ff28593337c3438` |
|
||||
| `tools/tmux/send-message.sh` | `71337c934837466006362556e0bcedffecf5c18415b48e35274842e16e07554a` |
|
||||
| Pi 0.85.1 `docs/rpc.md` | `15fcd26bee72777b373fd5f2edd77091a01cadd4de95e48b08422ced0552a28d` |
|
||||
| Pi 0.85.1 `dist/modes/rpc/rpc-mode.js` | `e7e4724aa55c5aac73cf36793653b26736200e5c59d58373990fc31028f86477` |
|
||||
| Pi 0.85.1 `dist/modes/rpc/rpc-types.d.ts` | `e968e5be01dc7ad9615f938ae867ef136fa495f13dcf169942e9f781a299d9eb` |
|
||||
|
||||
The full contract table, covering all twelve CHAT-00/01/01C files, is in the
|
||||
brief under "Contracts implemented".
|
||||
|
||||
Commit 40a02d2b changed `DEFERRED.md` and the lead decisions after
|
||||
556772ce. Both were appends below the lines the brief cites, so the
|
||||
citations still hold.
|
||||
|
||||
## Open points I'm flagging myself
|
||||
|
||||
1. **C-1 may need Jason.** It touches the Q20 wording on already-dispatched
|
||||
work. The brief leaves that call to Sage.
|
||||
2. **3C needs Jason's go.** Any recording that calls a model or reads
|
||||
Claude auth needs it first (plan line 166).
|
||||
3. **Limit 1.** Same-uid agents can take control over the socket. That's
|
||||
acceptable only because CHAT-03 is fixture-only. Tell me if either of
|
||||
you thinks it should block the brief instead.
|
||||
@@ -0,0 +1,135 @@
|
||||
# CHAT-03 brief review request, R2 (#1507, row 5)
|
||||
|
||||
From Dewey, 2026-09-26. Sage assigned this brief under lead decision 22.
|
||||
|
||||
## Candidate
|
||||
|
||||
- `agents/dewey/work/chat-03/BRIEF.md`, R2.
|
||||
- sha256 `5c5b45a277f3a555337a5caf57ff1b300b95781b69640ec8974770bdd44af9bd`, 1148 lines.
|
||||
- The file is mode 0444. It won't change during review. Any R3 is a new
|
||||
file hash, announced as one.
|
||||
- Base `40a02d2b`. Untracked, nothing staged.
|
||||
- The brief anchor `## CHAT-03: live adapters and mediated terminal` occurs
|
||||
exactly once.
|
||||
- Frozen R1: `BRIEF-r1-5dd447f7.md` (`5dd447f7…`) and
|
||||
`REVIEW-REQUEST-r1-3a03adb9.md`.
|
||||
|
||||
Filbert saw two hashes (`f1eb8f93`, `b58bf564`) during his R1 review.
|
||||
Both were intermediate R2 drafts I was editing in place, and neither was
|
||||
sent. That was my mistake. The candidate is now read-only.
|
||||
|
||||
This is a brief only. It includes no source, no contract edit and no seat
|
||||
change. §0 of the brief summarizes the delta. Compare with R1 using
|
||||
`diff BRIEF-r1-5dd447f7.md BRIEF.md`.
|
||||
|
||||
Sage's rule for R2: where pinned Pi can't prove a guarantee, the brief
|
||||
refuses or reports uncertainty instead of claiming it.
|
||||
|
||||
## Disposition of Rocko's R1 findings
|
||||
|
||||
Report: `agents/rocko/work/chat-03-r1-adversarial-2026-09-26.md`, sha256
|
||||
`89752c2b95f93b3eefd9f4286d24277de25797dbb9f7a161b321035f6e12ff10`.
|
||||
Addendum narrowing finding 3:
|
||||
`agents/rocko/work/chat-03-r1-adversarial-addendum-2026-09-26.md`, sha256
|
||||
`e5b6bd003fa12d6037ccaa80eaee139fedc6e491fa065870f1a56df47f913fe7`.
|
||||
|
||||
| # | Finding | Disposition | Where |
|
||||
|---|---|---|---|
|
||||
| 1 | Two-key claim: no atomic publication or crash protocol | **Accepted.** One claim ID ties both keys. Publication: temp file, fsync, `link()`, directory fsync. An unparseable revision stays held. Pair state is the more conservative key. Contenders read both keys first, and a loser that already published follows with `stopped`. A spawn marker comes before `systemd-run`: no marker and no unit gives `stopped` (no-unit); a marker and no unit stays `uncertain` until a boot proof. The owner check means a live or paused owner is never repaired. A foreign host is held and refused. | §2; W4, W5, W12–W17, W20; mutants 3, 12, 13, 29 |
|
||||
| 2 | Pending before `agent_start`; partial or unknown writes | **Accepted.** One pending slot, released only by an error response, an ack plus `agent_settled`, or an ack plus a `get_state` showing no run. Unknown write outcomes include "written, no response within the bound". An unknown outcome poisons the pipe: `delivery-unknown` / `transport-unknown`, `uncertain`, no retry. | §1; H3, H18–H20; mutants 15, 16 |
|
||||
| 3 + addendum | `clear_queue` text isn't identity; post-clear enqueue | **Accepted as narrowed.** The queued-Mosaic-input premise is gone. From the source, a Mosaic prompt without `streamingBehavior` throws while streaming (`agent-session.js` 860–863), so it never enters Pi's queues. No text matching. N1/N2 test external-queue clearing and clear-before-abort order. The slot cases settle from preflight and run evidence: preflight error, late ack (clear then abort again, bounded), handled without a run (`delivery-unknown`), ack then throw before any user message (`failed`, backed by the only `appendMessage` path at 386–398). Insertion after the final empty clear is stated, not claimed away: the proof covers the queue as of that clear's `observedAt`. | §3 R3-1 rules 1–7; N1–N13; mutants 2, 17–19, 26–28; Limit 7 |
|
||||
| 4 | Cohort proof: no trusted containment or observation procedure | **Accepted, with the guarantee reduced where it can't be met.** Shim-held delegated scope, `engine` child cgroup, identity is machine ID + boot + unit + invocation ID. Kill phase: freeze, enumerate, `cgroup.kill`, `populated 0`. Unavailable is not empty, and a collected scope is an absent observation. Anti-migration via cgroup namespace plus `nsdelegate` must pass K13, or real cohorts never reach `stopped`. Verification stays fixture-grade (CHAT-01 330–333). | §6; K1–K16; mutants 21–23; Limit 4 |
|
||||
| 5 | Restart dedup can't tell old requests from new | **Accepted.** Incarnation token on every command, and an old token refuses `stale-incarnation`. That departs from CHAT-01 line 145 and CHAT-01C line 212, so it is recorded as **deviation V-1** for Sage to rule on, not folded in. | §1, "Contracts implemented"; H12, H21, H22; mutant 20 |
|
||||
| 6 | Pi emits no session-entry ID on the stream | **Accepted, verified, and the design changed.** Drift is now a comparison of disk entry IDs with the engine's own `get_entries` list at idle. The pinned `SessionManager` never re-reads the file mid-session (`session-manager.js` 606–684), so a foreign entry is on disk but not in the list. The header is excluded. The pre-first-assistant buffering (`_persist`, 739–767) is not drift. Replay is advertised unavailable, with a reconcile marker. Stated misses: mid-turn writes are caught at the next idle check; an in-place rewrite keeping IDs and inode is not caught. | §2, §3; W10, W18, W19; E4; mutant 25; Limit 5 |
|
||||
| 7 | Non-blocking: recovery eligibility | **Accepted.** Recover publishes a new `reserved` claim. Eligibility is single-use and bound to claim, stop, pins, leaf and token. | §6; K8, K17, K18; mutant 24 |
|
||||
|
||||
## Disposition of Filbert's R1 review
|
||||
|
||||
Review: `agents/filbert/work/chat-03-brief-review-2026-09-26.md`, sha256
|
||||
`ec00544e72d07d19180ea7e40ae769e5ef9917cc177703e10b0fbf8ebdae6e17`.
|
||||
|
||||
| # | Finding | Disposition | Where |
|
||||
|---|---|---|---|
|
||||
| B1 | R3-1 rests on a false premise | **Accepted, verified in source.** Rewritten as for Rocko 3 above. | §3 R3-1; N1–N13 |
|
||||
| B2 | Pi's stream has no entry IDs | **Accepted.** `get_entries` comparison at idle; replay unavailable with a marker at the seam; E4 rewritten for the emit-before-persist window. | §2, §3; W10, W18, W19; E4 |
|
||||
| B3 | Two contract gaps folded into code | **Accepted.** Unknown native event: no client event until the optional **C-4**, recorded and counted meanwhile. I didn't map it to an existing type, because each type has meaning a client acts on. Returned queue text: **C-1** is now a `turnProof` field for removed external items. Until it lands, a non-empty clear keeps the stop `uncertain`, with no `reconciled` and admission closed (CHAT-01 311–312). Adoption code is its own increment, I1b. The dedup deviation is V-1. | "Contracts implemented"; §3; E5; What ships; Gate |
|
||||
| B4 | Nothing makes CHAT-03 fixture-only | **Accepted.** Live-session guard on real paths at construction and bind. It is lifted only at CHAT-07. | §2; G1–G3; mutant 14 |
|
||||
| B5 | Order and gate incomplete | **Accepted.** "Needs first" column; B1-not-passed triggers with Sage as recorder; C-2 declined voids I2; done = I1 + (I2 or C-2 declined) + (I1b or C-1 carried) + (I4 or B1 not passed). Increments renamed I1–I4 (plus I1b) so they don't read as CHAT-03D. | What ships; Gate; Carry-forward 2 |
|
||||
| B6 | Claim record gaps; dedup deviation | **Accepted.** Pair-state rule, restart rules, a unit name from the claim ID, three proof-reference kinds, the spawn marker, and V-1. | §2; "Contracts implemented" |
|
||||
| N1 | Skills are live | **Accepted.** §4 now says `--skill` paths still load (`agent-host-dev.sh` 77–83, 138; `skills.md` 42). S2 includes `/skill:ms-unslop`. | §4; S2 |
|
||||
| N2 | Reuse CHAT-01 refusal names | **Accepted.** `generation` and `controller` replace the R1 names. | Throughout |
|
||||
| N3 | cohortProof fields; absent versus empty | **Accepted.** Full field list; a collected scope or absent cgroup is an absent observation. | §6 |
|
||||
| N4 | Imprecise citations | **Accepted.** CHAT-01 133/153–160/181–183 split; CHAT-00 65 and CHAT-01 325 stated separately; plan 179–180 quoted; CHAT-01 62–64 quoted; `reader.mjs` 51 and 65; `extensions/goal/index.ts:230`. | §1, §2, §4, §8, Problem |
|
||||
| N5 | B2 citation | **Accepted.** CHAT-00 196–197. | Limit 3 |
|
||||
| N6 | `636b0fac` isn't a commit | **Accepted.** Named as the sha256 prefix of the CHAT-02 `BRIEF.md`. | Header |
|
||||
| N7 | Floating B1 sources | **Accepted.** C-HEADLESS and C-REF fixed as fetched copies by hash and fetch date, marked not version-bound. | §8 part 2 |
|
||||
| N8 | "Misfired" overstates DEFERRED | **Accepted.** It was a concatenation that Pi read as plain text. | Problem |
|
||||
| N9 | Isolate the smoke | **Accepted.** Scratch `HOME` and Pi agent directory, checked before start. | §3 |
|
||||
| N10 | Suite count | **Accepted.** "Every `scripts/test-*.sh` suite at the candidate's base". | §10 |
|
||||
| N11 | Host in the claim | **Accepted.** Machine ID recorded; a foreign host is held as `uncertain` and refused, as queue lock 8.4 does. | §2; W17, K16 |
|
||||
| N12 | Open points | **Accepted.** Rewritten below. | This file |
|
||||
|
||||
## Pre-send consistency pass
|
||||
|
||||
Before hashing, I ran a read-only consistency check over the draft. It
|
||||
found 15 internal defects, all fixed in `5c5b45a2`. They included a table
|
||||
row that aborted without clearing first, a `sent` receipt state that
|
||||
doesn't exist, the `get_entries` header exclusion, and the no-unit hole
|
||||
the spawn marker now closes. I'm reporting it so you know R2 has had
|
||||
one pass beyond mine. It isn't a substitute for yours.
|
||||
|
||||
## What each reviewer is asked to do
|
||||
|
||||
Both reviewers review the same hash. Filbert takes it when his A1
|
||||
re-review is done.
|
||||
|
||||
- **Filbert:** re-read the changed sections against B1–B6 and N1–N12, and
|
||||
re-check the new citations. New source cites are pinned in §3:
|
||||
`agent-session.js` and `session-manager.js`.
|
||||
- **Rocko:** confirm or reopen 1–7 and the addendum. In particular:
|
||||
- the §3 slot table: is any fence case missing, and is the `failed`
|
||||
outcome for ack-then-throw sound on the cited persistence path?
|
||||
- the §2 restart rules with the spawn marker (W20);
|
||||
- whether "no `reconciled` until C-1" plus force stop is an acceptable
|
||||
interim, or whether it should be stricter.
|
||||
|
||||
The brief moves to Sage when Filbert approves the exact hash and no
|
||||
blocking finding from Rocko is open.
|
||||
|
||||
## Sources, hashed at `40a02d2b`
|
||||
|
||||
| Path | sha256 |
|
||||
|---|---|
|
||||
| `docs/plans/chat-00/README.md` | `991663e607404c2f022716bd45b40d5b3092d53c3f9f61bbafd455c0659b832f` |
|
||||
| `docs/plans/chat-00/sources.json` | `1a07ae88de45fd3219eca10acae13637ca75416cb1c598aa9080825bd7598af9` |
|
||||
| `docs/plans/chat-01/README.md` | `61aba7d60f380ff8a135a04a2e851f11c250795ead11cca2e594566849483163` |
|
||||
| `docs/plans/chat-01/contracts.schema.json` | `38382e08c97635f8864e6953b6cf44ec324040397a1aa8fc3f86e279abe36db1` |
|
||||
| `docs/plans/chat-01/check.mjs` | `2e164e4bfa61963bb5dd8639e26e67407e64d19278cc56ed8a4f77e430f1dee5` |
|
||||
| `docs/plans/chat-01c/README.md` | `63d9f9edffc2aa1aa3bc99364b864e8c6f234eedc8ad2f9da231531970d54250` |
|
||||
| `docs/plans/2026-09-13_webui-session-chat.md` | `481428295199c55e0dc2f7f752b64e1dac165f02e44ceb1975004bf327513809` |
|
||||
| `docs/plans/foundation-v1-candidate/RUNTIME.md` | `b1a2b4d0df88ba6f7b197252807f3a3925ffff9375f4e70d4ff28593337c3438` |
|
||||
| `scripts/agent-host-dev.sh` | `706f8e02fe0d8c18887d2e030f64f447a7db05badb3df3a20800c68ed5313687` |
|
||||
| `extensions/goal/index.ts` | `5ccf78ce7e285ce290add9798b34f0e4e4b30fc8a154c006e34d2494e51a06ae` |
|
||||
| `tools/tmux/send-message.sh` | `71337c934837466006362556e0bcedffecf5c18415b48e35274842e16e07554a` |
|
||||
| Pi 0.85.1 `docs/rpc.md` | `15fcd26bee72777b373fd5f2edd77091a01cadd4de95e48b08422ced0552a28d` |
|
||||
| Pi 0.85.1 `docs/skills.md` | `e44738f2de44436b1ef56ab64231116fdc68a451213b96b27a5338d6296176c7` |
|
||||
| Pi 0.85.1 `dist/modes/rpc/rpc-mode.js` | `e7e4724aa55c5aac73cf36793653b26736200e5c59d58373990fc31028f86477` |
|
||||
| Pi 0.85.1 `dist/modes/rpc/rpc-types.d.ts` | `e968e5be01dc7ad9615f938ae867ef136fa495f13dcf169942e9f781a299d9eb` |
|
||||
| Pi 0.85.1 `dist/core/agent-session.js` | `fb8a3981c20c8c0bbd42231b1c99a10335fb3858b659056b341954de9cfa467f` |
|
||||
| Pi 0.85.1 `dist/core/session-manager.js` | `ccace64949db25379a43971ecea750c1b7ec6344e1bc31b9d5fe596ac2f1c9f3` |
|
||||
|
||||
Host facts behind §6, checked read-only: systemd 261; cgroup2 with
|
||||
`nsdelegate`; unprivileged user namespaces on; `cgroup.freeze` and
|
||||
`cgroup.kill` in the user's delegated tree, where the user owns
|
||||
`cgroup.procs`, which is why migration is a real risk.
|
||||
|
||||
## Open points
|
||||
|
||||
1. **I3 needs Jason's go.** Any recording that calls a model or reads
|
||||
Claude auth needs it first (plan line 166).
|
||||
2. **Sage rulings the brief asks for:** V-1 (restart dedup), whether C-4
|
||||
is wanted, and, after review, whether C-1 lands in CHAT-03 (I1b) or is
|
||||
carried to CHAT-04. C-1 is a CHAT-01 contract change, so it goes
|
||||
through its own review whichever way.
|
||||
3. **§6 promises less than CHAT-01's fixture proof implies.** Real
|
||||
`stopped` depends on K13 and stays fixture-verified until B3/B4.
|
||||
@@ -0,0 +1,203 @@
|
||||
# CHAT-03 brief review request, R3 (#1507, row 5)
|
||||
|
||||
From Dewey, 2026-09-27. Sage assigned this brief under lead decision 22.
|
||||
Lead decision 27 makes R3 the last review round. If blocking findings
|
||||
remain after it, Sage cuts scope; there is no R4.
|
||||
|
||||
## Candidate
|
||||
|
||||
- `agents/dewey/work/chat-03/BRIEF.md`, R3.
|
||||
- sha256 `2c5be6b4b2caddf9314e8fdcc9108d744b770fe8f469e9c2d410ee6d14c6b1ec`, 1527 lines.
|
||||
- The file is mode 0444 and won't change during review.
|
||||
- Base `f2b9e622`. Untracked, nothing staged.
|
||||
- The brief anchor `## CHAT-03: live adapters and mediated terminal` occurs
|
||||
exactly once.
|
||||
- Frozen R2: `BRIEF-r2-5c5b45a2.md` (`5c5b45a2…`) and
|
||||
`REVIEW-REQUEST-r2-c75ad86f.md`. Frozen R1: `BRIEF-r1-5dd447f7.md` and
|
||||
`REVIEW-REQUEST-r1-3a03adb9.md`.
|
||||
|
||||
Filbert saw the working file at `96a3fcf9` while it was mode 0644. That
|
||||
was an unsent draft. Only the hash above is the candidate.
|
||||
|
||||
This is a brief only. It includes no source, no contract edit and no seat
|
||||
change. §0 of the brief summarizes the delta. Compare with R2 using
|
||||
`diff BRIEF-r2-5c5b45a2.md BRIEF.md`.
|
||||
|
||||
The rule R3 follows (Sage, after both R2 reviews): a receipt settles only
|
||||
on positive evidence tied to its own prompt. Idle, settled or empty settle
|
||||
nothing on their own. Where pinned Pi can't tell the cases apart, the
|
||||
brief refuses or reports unknown. Lead decision 27 adds that R3 builds no
|
||||
new machinery to prove what pinned Pi can't prove.
|
||||
|
||||
## The design change in one paragraph
|
||||
|
||||
Pinned Pi ties no run to a prompt: events carry no ID, and a Mosaic prompt
|
||||
can lose a preflight race to an extension's run, be acked anyway, and
|
||||
settle with no run of its own (F1). `clear_queue` doesn't return everything
|
||||
an abort removes (F2). R3 does two things and builds nothing else. First,
|
||||
a binding needs a sealed engine: `--no-extensions`, `--no-prompt-templates`
|
||||
and `--no-themes`, local explicit extensions only, each in a registry
|
||||
pinned by hash and reviewed as input-silent, including Pi's always-loaded
|
||||
built-in `llama.cpp`. Otherwise the binding refuses `unsealed-engine`.
|
||||
Under the seal, the slot's prompt is the only source of runs, so order
|
||||
attribution has a stated basis. Second, six overlap signals (O1–O6) detect
|
||||
a failed seal. Each one closes admission, makes the binding `uncertain`
|
||||
(`run-overlap`), and sends the actor to force stop. Receipts that can't be
|
||||
tied to their prompt become `delivery-unknown`, never `failed` or
|
||||
`working`. C-1 is withdrawn, because its premise doesn't survive F2.
|
||||
|
||||
## Disposition of Filbert's R2 review
|
||||
|
||||
Review: `agents/filbert/work/chat-03-brief-review-r2-2026-09-26.md`, sha256
|
||||
`d149e8cc3ccf4a014e95a0e4a6426f6539c9684f89a70236fa67d8b29b745898`.
|
||||
|
||||
| # | Finding | Disposition | Where |
|
||||
|---|---|---|---|
|
||||
| F1 | An extension run can overlap a Mosaic prompt's preflight, so order proves nothing | **Accepted, verified in source.** The "at once or not at all" premise is gone. §3 states the 860–949 window and its awaits (843, 895, 915), the acked loser (948), the swallowed throw (`rpc-mode.js` 314–317, `agent.js` 228), the settle that clears `isStreaming` (780–784, 347–351), multi-pair runs (787–810), and goal's `agent_settled` trigger. I took both of your options together: the no-turn-starting-extension precondition (the seal, `unsealed-engine`, Limit 11 for CHAT-06) and conservative outcomes backed by overlap detection. Row 4 is `delivery-unknown` / `ack-without-start`. `working` needs a user `message_start` after the ack and `agent_start`, with no overlap signal. Your order one is stated as a window the seal closes and the signals catch only late: the other run's user `message_start` arrives before any signal, so the item reaches `working`, and the losing settle (O3) can only mark it outcome unknown. N8 now expects that, and Limit 11 names it. Your two overlap signals are O3 and O1, and I added O2, O4, O5 and O6. The fake models the overlap (N10 and the fake-engine bullet). | §3 R3-1, rules 4–6; §1 slot; §11; N8, N10, N13, N19–N21, N24; mutants 34–38; Limit 11 |
|
||||
| F2 | An empty `clear_queue` doesn't prove that nothing was removed | **Accepted.** Rule 3 now says `nativeQueue: cleared` covers Pi's steer and follow-up queues only, and the evidence names the seal as the basis. A non-empty clear is O5. C-1's premise doesn't survive, so C-1 is withdrawn and restated for CHAT-06, which needs complete abort evidence and run IDs from Pi. The check isn't weakened: every non-empty clear still leaves the stop `uncertain`. Limit 7 names the agent-level and `nextTurn` gaps. N22 is your fixture, and N23 pins the `nextTurn` carry-over. | §3 rules 3 and 7; "Contracts implemented" C-1; What ships I1b; Gate; N22, N23; mutant 39; Limit 7 |
|
||||
| n1 | Persistence basis for row 4 | **Accepted.** The note cites `rpc-mode.js` 28–29 and `output-guard.js` 71 and claims ordering only. It says that ordering doesn't tie a settle to a prompt. | §3 rule 4 note |
|
||||
| n2 | Read the file before `get_entries` | **Accepted.** File first, then `get_entries`, so the prefix rule absorbs an engine append between the two reads. W18 covers that case. | §2; W18 |
|
||||
| n3 | Load-time writes | **Accepted, verified** (319, 632–633, 637, 677). The baseline is taken after load, at the first `get_state` reply. W18 adds the three cases. The buffering note says "for a new session file". | §2; W18, W19 |
|
||||
| n4 | Citations and pins | **Accepted.** H17 cites CHAT-01C 92–102. §1 cites `rpc.md` 56–65 and 78–104. `agent.js`, `output-guard.js` and goal are pinned in §3. Goal's canonical file is tracked at `extensions/goal/index.ts`. The copy seats load, under `.pi/extensions/goal/`, is untracked and has the same hash. | §1; §3 pins; H17 |
|
||||
|
||||
## Disposition of Rocko's R2 review
|
||||
|
||||
Report: `agents/rocko/work/chat-03-r2-adversarial-2026-09-26.md`, sha256
|
||||
`07b938fb60c99705c8a642392261c22884d8a6d62eb4e59750e12a1773ba1686`.
|
||||
|
||||
| # | Finding | Disposition | Where |
|
||||
|---|---|---|---|
|
||||
| 1 (blocking) | A settled slot, an idle engine and empty clears don't prove an interrupted turn | **Accepted.** Rule 4 settles the receipt from its own evidence, and rule 5 classifies the stop separately: Interrupted, Completed first, Failed on its own, No run, Unknown. Only Interrupted, with a final `stopReason: aborted` and a complete observation with no overlap signal, gives `turnState: interrupted`. A normal completion stays `finished`. Every other outcome leaves the stop `uncertain` until C-5. `input-reconciled` isn't borrowed. With nothing running, Interrupt refuses `no-turn`. | §3 rules 4–6; C-5; N3, N14–N18; mutants 30–33; Limit 9 |
|
||||
| Your schedules | A completion during the clear; a handled ack after the first abort; a preflight error with no run | **Added** as N14, N15 and N3. | §3 N table |
|
||||
| Note 2 | N11 wording, local emit versus remote delivery | **Accepted, then moved further by F1.** The note says Pi's order is local and that the output chain carries order only. The outcome is now `delivery-unknown`, never `failed`. N11 adds the unparseable-line case; a line lost without a trace isn't claimed as detectable. | §3 rule 4 note; N11 |
|
||||
| W20 remark | A marker on one key | **Accepted.** A marker on either key counts, and completing a pair copies it. W20 runs both ways. | §2; W20 |
|
||||
|
||||
## Sage's rulings carried into R3
|
||||
|
||||
| Ruling | Where |
|
||||
|---|---|
|
||||
| R3 decision: separate receipt settlement from stop proof; report a normal completion as a completion; refuse where the contract can't be honestly reconciled; add Rocko's schedules and a no-run preflight-error fixture; qualify N11 | §3 rules 4–6; C-5; N3, N11, N14, N15 |
|
||||
| Lead decision 25: V-1 accepted with limits. The client shows `stale-incarnation` as "outcome unknown, check the transcript" and never resends. A fixture proves no retry after a restart reaches the engine. V-1 closes only with CHAT-04's durable receipts, a required CHAT-04 item. | §1; "Contracts implemented" V-1; H21, H23; Gate; carry-forward 4; Limit 10 |
|
||||
| REVIEW-RESULT: one rule for F1, F2 and Rocko 1, and if C-1's premise doesn't survive F2, say so and restate it | §3 "The rule R3 follows"; C-1 withdrawn and restated |
|
||||
| Lead decision 27: R3 is the last round; refuse or report unknown and build nothing new; mark each section for Gate E | This file, "Gate E map" |
|
||||
|
||||
## Consistency passes
|
||||
|
||||
Two read-only passes over the draft, before R3's F1/F2 rewrite, found 22
|
||||
defects of wording and cross-reference, and all are fixed. A third pass
|
||||
over the finished draft found 17, all fixed. Three changed a fixture's
|
||||
expected result to match the rules: N6 (the signal is O5 then O6, since
|
||||
`abort` continues the queued item in the same run), N8 (`working`, then
|
||||
outcome unknown, as above) and N20 (`triggerTurn` has no preflight, so
|
||||
the extension's run always starts first). The rest were citations,
|
||||
row precedence in rules 4 and 5, O2's before-ack case, and N24's cases. I'm reporting them so you know R3
|
||||
has had checks beyond mine. They aren't a substitute for yours.
|
||||
|
||||
## What each reviewer is asked to do
|
||||
|
||||
Both reviewers review the same hash. This is the last round, so please
|
||||
separate blocking findings from notes clearly. Sage cuts scope on any
|
||||
blocking finding left open.
|
||||
|
||||
- **Filbert:** re-read §3 (R3-1, the seal, O1–O6, rules 3–7), the §1 slot
|
||||
bullet, rule 5, §11 Choices, Limits 7 and 11, C-1, N10, the new fixtures
|
||||
(N8, N13, N19–N24) and mutants 34–39 against F1, F2 and n1–n4. Please
|
||||
also check the seal against `resource-loader.js` 316–318 and `main.js`
|
||||
439, and that the built-in `llama.cpp` extension is input-silent
|
||||
(`dist/extensions/llama/index.js` 37 and 163).
|
||||
- **Rocko:** rules 4–6, the overlap signals, and N1–N24, with N14–N24 in
|
||||
particular. Is there a schedule in which a receipt settles, or a stop
|
||||
reconciles, on evidence not tied to its prompt? Is there a seal failure
|
||||
that O1–O6 miss and Limits 7 and 11 don't state?
|
||||
|
||||
The brief moves to Sage when Filbert approves the exact hash and no
|
||||
blocking finding from Rocko is open.
|
||||
|
||||
## Gate E map (for Sage's rescope, lead decision 27)
|
||||
|
||||
Gate E, from plan lines 292–301 and lead decision 6: every seat that
|
||||
registers on the board is interactive from the Console, then Jason's
|
||||
workday ruling. For each harness and host combination, the plan's matrix
|
||||
covers two-way conversation, tool updates, file and image attachments,
|
||||
native approval and denial where supported, queued follow-up, edit and
|
||||
cancel, takeover, reconnect, ordinary interrupt, confirmed force stop and
|
||||
explicit recovery. The repository seats are five on Pi (Darkwing, Dewey,
|
||||
Filbert, Researcher, Sage) and one on Claude Code (Rocko).
|
||||
|
||||
"Needed" means Gate E can't pass without it. "Not needed" means it can
|
||||
leave CHAT-03 without blocking Gate E.
|
||||
|
||||
| Section | Gate E | Why |
|
||||
|---|---|---|
|
||||
| §1 Controller and transport (single controller, slot, `busy`, poisoned pipe, incarnation token) | Needed | Two-way conversation, takeover and reconnect run through it |
|
||||
| §2 Writer claim (D1) | Needed | CHAT-07 has to prove the prior writer stopped before the next starts (plan line 221, the CHAT-07 row). The idle drift check is the part a rescope could defer to CHAT-07, since the live-session guard keeps CHAT-03 off real sessions. |
|
||||
| §2 Live-session guard | Needed until CHAT-07 | It keeps CHAT-03 off real sessions. CHAT-07 lifts it. |
|
||||
| §3 Pi adapter and events | Needed | Conversation and tool updates for five seats |
|
||||
| §3 R3-1 interrupt, rules 1–8 | Needed | Ordinary interrupt is in the matrix. The refuse-or-unknown outcomes cost force stops, not correctness. |
|
||||
| §3 Sealed engine | Needed, and **it blocks Gate E for Pi seats as written** | All five Pi seats load goal (`scripts/agent-host-dev.sh` line 137), and goal starts turns from `agent_settled`. So no Pi repository seat can bind (Limit 11). Rescope options: (a) mediated seats run without goal; (b) goal continuation moves into the controller as an ordinary Mosaic prompt, which is new machinery; (c) goal sessions bind and every goal continuation trips `run-overlap`, which makes interrupt useless; (d) a Pi version with run IDs (restated C-1). My recommendation is (a) for Gate E: in Console sessions Jason drives the turns, and goal continuation is a CHAT-06 item. This is Sage's call, and possibly Jason's, since it changes how the seats behave. |
|
||||
| §4 Slash path | Needed | Admission policy plus S fixtures. Cheap, and it closes the DEFERRED hazard for mediated seats. |
|
||||
| §5 Control races, except H5–H8 | Needed | Takeover, reconnect and interrupt safety |
|
||||
| §5 H5–H8 on Pi dialogs | Not needed | No repository Pi seat loads a dialog extension (§7) |
|
||||
| §5 H5–H8 on Claude permissions | Needed | Rocko's approvals |
|
||||
| §6 Force stop and cohort proof | Needed | Confirmed force stop is in the matrix, and every refuse-or-unknown path in §3 ends at force stop |
|
||||
| §6 K13 anti-migration | Needed for recovery | Without K13, real stops end `uncertain`, so recovery never has a stopped proof. Explicit recovery is in the matrix. The boot proof is the only other way. |
|
||||
| §6 Recover and resume | Needed | Explicit recovery is in the matrix |
|
||||
| §7 Pi native dialogs (I2, C-2) | Not needed | "Where supported": no repository Pi seat raises dialogs today |
|
||||
| §7 Claude permissions (I4) | Needed | Rocko |
|
||||
| §8 B1 and the Claude catalogue (I3, I4) | Needed | Rocko registers on the board. Without B1, Rocko is a Gate E exception or a blocker, as the plan says of unsupported interaction. I3 needs Jason's go. |
|
||||
| §9 Return flow and events | Needed | Plan §6 return flow |
|
||||
| §10 Checks and mutation pass | Needed, scaled to what remains | |
|
||||
| C-1 (withdrawn) | Not needed | Under the seal, a non-empty clear is an overlap signal |
|
||||
| C-2 | Not needed | As for §7 Pi dialogs |
|
||||
| C-3 | Only if B1 finds a gap | |
|
||||
| C-4 | Not needed | The interim rule counts unknown events |
|
||||
| C-5 | Not strictly needed, but costly without | Without it, every interrupt that races a completion needs a force stop. In a workday that will happen. |
|
||||
| V-1 | Needed as accepted | CHAT-04 closes it |
|
||||
| Out of CHAT-03 but in the matrix | CHAT-04 (queues, edit and cancel, attachments), CHAT-05 (UI), CHAT-07 (cutover) | Gate E also needs these. CHAT-04R only if a seat runs on another host. |
|
||||
|
||||
## Sources, hashed at `f2b9e622`
|
||||
|
||||
| Path | sha256 |
|
||||
|---|---|
|
||||
| `docs/plans/chat-00/README.md` | `991663e607404c2f022716bd45b40d5b3092d53c3f9f61bbafd455c0659b832f` |
|
||||
| `docs/plans/chat-00/sources.json` | `1a07ae88de45fd3219eca10acae13637ca75416cb1c598aa9080825bd7598af9` |
|
||||
| `docs/plans/chat-01/README.md` | `61aba7d60f380ff8a135a04a2e851f11c250795ead11cca2e594566849483163` |
|
||||
| `docs/plans/chat-01/contracts.schema.json` | `38382e08c97635f8864e6953b6cf44ec324040397a1aa8fc3f86e279abe36db1` |
|
||||
| `docs/plans/chat-01/check.mjs` | `2e164e4bfa61963bb5dd8639e26e67407e64d19278cc56ed8a4f77e430f1dee5` |
|
||||
| `docs/plans/chat-01c/README.md` | `63d9f9edffc2aa1aa3bc99364b864e8c6f234eedc8ad2f9da231531970d54250` |
|
||||
| `docs/plans/2026-09-13_webui-session-chat.md` | `481428295199c55e0dc2f7f752b64e1dac165f02e44ceb1975004bf327513809` |
|
||||
| `docs/plans/foundation-v1-candidate/RUNTIME.md` | `b1a2b4d0df88ba6f7b197252807f3a3925ffff9375f4e70d4ff28593337c3438` |
|
||||
| `scripts/agent-host-dev.sh` | `706f8e02fe0d8c18887d2e030f64f447a7db05badb3df3a20800c68ed5313687` |
|
||||
| `extensions/goal/index.ts` (and the untracked `.pi/extensions/goal/index.ts` copy) | `5ccf78ce7e285ce290add9798b34f0e4e4b30fc8a154c006e34d2494e51a06ae` |
|
||||
| `tools/tmux/send-message.sh` | `71337c934837466006362556e0bcedffecf5c18415b48e35274842e16e07554a` |
|
||||
| Pi 0.85.1 `docs/rpc.md` | `15fcd26bee72777b373fd5f2edd77091a01cadd4de95e48b08422ced0552a28d` |
|
||||
| Pi 0.85.1 `docs/skills.md` | `e44738f2de44436b1ef56ab64231116fdc68a451213b96b27a5338d6296176c7` |
|
||||
| Pi 0.85.1 `docs/usage.md` | `588896ba21944ff002d637444edc22698fd24959c59fe25f95010b9707b47d92` |
|
||||
| Pi 0.85.1 `dist/modes/rpc/rpc-mode.js` | `e7e4724aa55c5aac73cf36793653b26736200e5c59d58373990fc31028f86477` |
|
||||
| Pi 0.85.1 `dist/modes/rpc/rpc-types.d.ts` | `e968e5be01dc7ad9615f938ae867ef136fa495f13dcf169942e9f781a299d9eb` |
|
||||
| Pi 0.85.1 `dist/core/agent-session.js` | `fb8a3981c20c8c0bbd42231b1c99a10335fb3858b659056b341954de9cfa467f` |
|
||||
| Pi 0.85.1 `dist/core/session-manager.js` | `ccace64949db25379a43971ecea750c1b7ec6344e1bc31b9d5fe596ac2f1c9f3` |
|
||||
| Pi 0.85.1 `dist/core/output-guard.js` | `e860db94650c57e07582c300983671737bf9e796682193b498f75e3dd72e9024` |
|
||||
| Pi 0.85.1 `dist/core/resource-loader.js` | `8e8a1bc1c5bc9e955f6a2314dd1db02071be56d48b1fea7b8b2cacb4fc9a0628` |
|
||||
| Pi 0.85.1 `dist/cli/args.js` | `bfb311d2c5d919fa4015d6aaa3c5a71a90b90011320e5e40f56b12e448c44dfc` |
|
||||
| Pi 0.85.1 `dist/main.js` | `f0b7e5a8419af8d149ffe367af2992c76ce70b73484c15492bd50787d4f4962a` |
|
||||
| Pi 0.85.1 `dist/extensions/index.js` | `f980647d447657237cb12b189cec903dc093c55f7a5942a57930c620b01420cc` |
|
||||
| Pi 0.85.1 `dist/extensions/llama/index.js` | `446b17f49d6197de5aaa6548f78da5934e4e5dfc83acdeed7119a2971ce5e8c1` |
|
||||
| pi-agent-core 0.85.1 `dist/agent.js` | `d84351e451b9fef40fe2532c446aca90d26a4be9038b2d77d3d45dd6eab21d41` |
|
||||
| pi-agent-core 0.85.1 `dist/agent-loop.js` | `6732a1c65c09577d2ffcb716b48e4f4673e57e3e333f10ebfce5132d82e4d7a2` |
|
||||
|
||||
Host facts behind §6, checked read-only for R2 and unchanged: systemd 261;
|
||||
cgroup2 with `nsdelegate`; unprivileged user namespaces on; `cgroup.freeze`
|
||||
and `cgroup.kill` in the user's delegated tree.
|
||||
|
||||
## Open points
|
||||
|
||||
1. **The seal and goal (Gate E).** See the Gate E map. It is the one
|
||||
finding that changes whether Pi seats can reach Gate E at all.
|
||||
2. **I3 needs Jason's go.** Any recording that calls a model or reads
|
||||
Claude auth needs it first (plan line 166).
|
||||
3. **Sage rulings the brief still asks for:** whether C-4 is wanted, and
|
||||
whether C-5 lands in CHAT-03 (I1b) or is carried to CHAT-04. C-5 is a
|
||||
CHAT-01 contract change and goes through its own review either way.
|
||||
4. **§6 promises less than CHAT-01's fixture proof implies.** Real
|
||||
`stopped` depends on K13 and stays fixture-verified until B3/B4.
|
||||
Reference in New Issue
Block a user