---
name: psyche-sandbox-and-adr-leak
description: Psyche sandboxed to legacy-owl parity; ADR>0002 refs were foreign-leak (only 0001/0002 real); release held
metadata: 
  node_type: memory
  type: project
  originSessionId: a6fa2219-fa60-4b97-a2e9-de64d1e51a44
---

Session 2026-06-18 (post v0.3.0). **SHIPPED as adapter v0.4.0** (tag v0.4.0, GH release w/ both per-OS .spt assets rebuilt carrying the new psyche binary; cplugs NOT bumped — skeleton unchanged, plugin.json stays 0.1.3; min_spt_core stays 0.9.0). spt-core v0.12.0 published same day (lifecycle/liveness; relay-hosted live agents unaffected by new offline-marking; F-013 was already in 0.11.0; FINDING A = our F-011 still queued) — we do NOT require 0.12.0. dist linux .spt cross-built via zigbuild (zig at ~/.sptc-zig, cargo-zigbuild in ~/.cargo/bin).

- **Removed placeholder `claude-spt:deep` profile.** Was a digest-window-20 + label demo; `:ccs` is now the sole shipped overlay (proves overlay-observability). All ints/setup.md/PARITY re-pointed deep→ccs.
- **`--dangerously-skip-permissions` on both `[session.self]` bringup commands** (base `claude` + `ccs`): broker spawns CC non-interactively into a PTY → perm prompt would deadlock launch.
- **Psyche sandboxed to legacy-owl parity** (`claude_skill_owl/src/live/wrapper/claude.rs`): `claude-spt-psyche` seed+pulse now carry `--tools Read,Edit,Write --disable-slash-commands --dangerously-skip-permissions --model sonnet --fallback-model opus --effort medium`. Decision = [[adr-0003]] (`docs/adr/0003-*`); cross-cutting deadlock invariant = `REQ-HAZARD-PSYCHE-PERMS-DEADLOCK` (KNOWN-HAZARDS §2.2). Was previously bare `claude` (full tools + deadlock risk).

**ADR-numbering gotcha (reference):** in THIS repo only **ADR-0001 and ADR-0002 are real**. Any `ADR-0003`..`ADR-0021` was doyle's spt-core project numbering that leaked via comms — wiped 2026-06-18 (34 tokens / 16 files, commit eab464b). Don't re-introduce foreign ADR numbers; mint local ADRs sequentially from 0003. The ADR-format template's `0003-old-decision.md` dummy is pedagogy, left intact.

**experimplate sibling** (`../experimplate`): checked for the same leak — CLEAN. Only ADR ref is the same template-dummy example. (User asked to wipe+commit there; pending decision on whether to neutralize the dummy.)