File created successfully at: C:\Users\decid\Documents\projects\spt-core\M12-W4-PLAN.md (file state is current in your context — no need to Read it back)

# M12 Wave 4 — subnet QR + self-elevating window — JIT plan

> todlando 2026-06-14, after the W2 + follow-on batch gate (PASS, committed
> 6e76f62 / eb74b18). doyle: "proceed to W4 subnet QR + self-elevating window;
> ping a design-check JIT like the others." **DESIGN-CHECK PENDING — build only
> after doyle's ruling.** The load-bearing unknown is T4.2 (self-elevating
> *window*): cross-platform + a security surface (spawning elevated processes /
> UAC). Spec: `M12-PLAN.md` Wave 4 + `M12-CANDIDATES.md`.

## Scope (M12-PLAN.md Wave 4)
- **T4.1** `spt subnet create/join/show-code`: surface a **QR code** of the TOTP
  seed (on create AND join).
- **T4.2** **Self-elevating behavior**: run normally if interactive + elevated;
  else re-run self in a self-elevating window with inline stdout ("Elevated
  terminal launched… / You can close this window"). Cross-platform — Win UAC
  window · Linux+desktop pkexec/polkit or x-terminal-emulator · Linux+TTY inline
  sudo · headless/no-TTY print the command for the human. Scope elevation to only
  the steps that need it (service/firewall/privileged-port; subnet-create itself
  is unprivileged-to-run but reveals a secret, so it is gated).

## What EXISTS today (investigation 2026-06-14)
- **QR already renders** (M7/M8, REQ-SUBNET-1): `render_qr` (cli.rs:2964) encodes
  the `otpauth://` URI as a unicode-half-block terminal QR. Printed on **create**
  (`cmd_subnet_create`), **show-code** (`cmd_subnet_show_code`), and the **join**
  flow (`cmd_subnet_join`). So T4.1's "QR on create AND join" is **largely already
  shipped** — the open question is whether anything is actually missing (Q1).
- **Elevation is PARTIALLY built** (`spt/src/elevation.rs`, REQ-PAIR-6 /
  REQ-HAZARD-SUDO-SECURE-PATH):
  - `current()` probe (Win token / Unix euid, fail-safe `Unknown`); `gate_for`
    (Show/Fallback); `fallback_message`.
  - `current_style()` (Unix `Sudo` / Win `AdminTerminal`); `rerun_command`
    (absolute-path sudo line, secure_path-proof); `should_auto_elevate` (Unix ∧
    interactive ∧ NotElevated).
  - `cli.rs::try_auto_elevate` ACTUALLY re-execs `sudo <abs-exe> <args>` on an
    **interactive Unix TTY** (the elevated child does the work; `main` de-elevates
    back via the 5.7 drop). `with_elevation_hint` prints the absolute-path sudo
    command otherwise. Consumed by `cmd_subnet_create` + `cmd_subnet_show_code`.
- **So the W4 T4.2 DELTA is the rest of the matrix:** today only **Unix +
  interactive-TTY** auto-elevates (inline sudo); **Windows prints "run as
  administrator" with NO actual UAC re-launch**; **Linux desktop without a TTY**
  (DISPLAY but no terminal) has no path; **headless** falls to the printed hint
  (Unix only). T4.2 = add the **Windows UAC window**, the **Linux desktop
  pkexec/terminal-emulator** path, and a **headless print** that covers Windows too.
- De-elevation seam exists (`spt-daemon::deelevate`, REQ-HAZARD-ELEVATED-DAEMON-SPAWN)
  — the elevated child drops back to the user for state safety; the
  `ELEVATION_PROVEN` flag keeps the gate authorized post-drop. The self-elevating
  re-launch is the INVERSE direction (unprivileged → elevated) and must compose
  with this drop without a loop (the elevated child reads `Elevated`, never
  re-elevates).

## Investigation TODOs (read before coding — gated on doyle scope)
1. **`cmd_subnet_join` (cli.rs:4260)**: confirm the QR actually renders on the
   joiner's side post-join (or only the code). Close any T4.1 gap if present.
2. **Windows `ShellExecuteW` "runas"**: the verb that triggers UAC + launches an
   elevated process. It opens a SEPARATE window; the elevated child's stdout does
   NOT come back to the original console. Determine the child-window-stays-open
   mechanism (so the user sees output): launch `cmd.exe /k <exe> <args>` under
   runas, or `<exe> <args>` with a trailing pause. windows-sys already in the dep
   set (`Win32_UI_Shell` feature may need adding).
3. **Linux desktop**: detect `DISPLAY`/`WAYLAND_DISPLAY`; prefer `pkexec` (polkit
   GUI auth, inherits stdio) when present, else `x-terminal-emulator -e sudo …`
   (Debian alternative; fallbacks: gnome-terminal/konsole). Decide the probe order
   + the "no path → print hint" floor.
4. **"Inline stdout" semantics**: confirm the intended UX — the ORIGINAL process
   prints "Elevated terminal launched…", the elevated CHILD window prints the work
   + "You can close this window." (The original cannot capture the elevated
   child's output across the privilege boundary on Windows.)
5. **Loop-safety + de-elevation interplay**: the elevated child must run the work
   then the 5.7 drop, and must NOT re-trigger self-elevation. Verify the
   `ELEVATION_PROVEN`/`current()==Elevated` path short-circuits any re-elevation.

## Open design questions for doyle
1. **T4.1 — is the QR already done?** The terminal QR renders on create +
   show-code + (apparently) join. Is T4.1 satisfied once I confirm the join path
   (Q-TODO 1), treating "window" as the inline terminal QR? Or does "window" imply
   a separate/GUI surface (no GUI milestone exists → I'd defer that)? Recommend:
   **T4.1 = verify + close any join-QR gap; "window" = the inline terminal QR**,
   no GUI work.
2. **Windows UAC child-window mechanism (Q-TODO 2/4).** Recommend: `ShellExecuteW`
   with the `runas` verb launching `<abs-exe> <args>` in a NEW elevated console
   that STAYS OPEN (a trailing "press any key" / the child prints "You can close
   this window"); the original prints "Elevated terminal launched…" and exits 0.
   Confirm the stays-open approach (child-pause vs `cmd /k`) + that we never try to
   pipe the elevated child's stdout back.
3. **Linux desktop elevation order (Q-TODO 3).** Recommend probe order:
   interactive-TTY → inline `sudo` (today); else DISPLAY ∧ `pkexec` → pkexec; else
   DISPLAY ∧ a terminal-emulator → `x-terminal-emulator -e sudo`; else → print the
   sudo hint. Confirm the order + the terminal-emulator fallback list.
4. **The pure decision seam.** Recommend extending `elevation.rs` with a pure
   `decide_elevation_path(os, elevation, interactive_tty, has_display, has_pkexec,
   has_term_emulator) -> ElevatePath { AlreadyElevated, InlineSudo, UacWindow,
   Pkexec, TerminalEmulator, PrintHint }`, unit-tested across the matrix; each
   variant's actual launch is the impure leg (manual-verify, REQ-PAIR-6 precedent).
   This generalizes today's `should_auto_elevate`. Confirm shape.
5. **REQ granularity.** T4.2 self-elevation is bigger than today's
   REQ-HAZARD-SUDO-SECURE-PATH (Unix sudo) and distinct from REQ-PAIR-6 (the
   show/fallback gate) and REQ-SUBNET-4 (which mutations are gated). Recommend a
   NEW **REQ-ELEVATE-1** (cross-platform self-elevating re-launch: the decision
   matrix + the per-OS window launch + inline-notice UX). Or extend REQ-SUBNET-4.
   Your call (lean: new REQ — it is a distinct mechanism reused by every gated
   command, not subnet-specific). doc+impl+unit (no int — launch is manual-verify).
6. **Security posture.** Self-elevation spawns a privileged process from an
   unprivileged one — the user's UAC/polkit/sudo prompt IS the consent gate (we
   never bypass it). We re-run the EXACT same invocation (no added privilege
   scope), absolute-exe-path (secure_path / no PATH hijack), and the elevated child
   de-elevates state back. Any KNOWN-HAZARDS entry to add (e.g. "self-elevation
   re-runs verbatim, never widens args; child drops state to the user")?

## Tentative tasks (pending doyle ruling — shapes will shift on Q1–Q6)
- **T4.0** Add the REQ to `traceable-reqs.toml` first (rule 3) — REQ-ELEVATE-1 (or
  extend REQ-SUBNET-4) per Q5. doc+impl+unit.
- **T4.1** Confirm/close the join-QR gap (likely tiny or a no-op).
- **T4.2a** `elevation.rs`: the pure `decide_elevation_path` matrix +
  `ElevatePath` enum (extends `should_auto_elevate`). Heavy unit tests.
- **T4.2b** The per-OS impure launchers: Windows `ShellExecuteW("runas")` elevated
  console (windows-sys `Win32_UI_Shell`); Linux `pkexec` + `x-terminal-emulator`
  spawns; reuse the Unix inline-sudo path; the headless/print floor (Windows too).
  Wire into the gated commands (replace the bare `try_auto_elevate` call sites with
  the matrix dispatch). Inline-notice UX ("Elevated terminal launched…").
- **T4.2c** Doc: CONTEXT.md elevation section + any KNOWN-HAZARDS entry (Q6).
- Activate stages as evidence lands. Full suite + clippy -D + traceable EXIT=0.
  W4 gate (doyle). Then **W5 whoami** → **W2.5 attach/kick** → full M12 gate.

## Notes
- The actual elevated launch is environment-dependent (UAC/polkit/sudo/TTY) — the
  DECISION matrix is the unit-tested seam, the launch is the manual-verify leg
  (REQ-PAIR-6 OS-probe precedent). No `int` stage on T4.2.
- Compose with the existing 5.7 de-elevation drop — re-launch is the inverse edge;
  must be loop-safe (elevated child never re-elevates).
- Build UNCOMMITTED until the operator calls the commit (W2's pre-auth was a
  one-off; the follow-on batch was operator-relayed commit too).


Bash

cd "C:\Users\decid\Documents\projects\spt-core" && $OWL send doyle <<'EOF'
W4 JIT plan up for design-check: M12-W4-PLAN.md (subnet QR + self-elevating window).

KEY INVESTIGATION FINDING (changes the wave's shape): most of W4 already exists.
- T4.1 QR: render_qr (unicode terminal QR of the otpauth URI) ALREADY prints on create + show-code + join (M7/M8). So T4.1 is largely shipped — open Q is whether anything's actually missing on the join path; "window" I read as the inline terminal QR (no GUI milestone).
- T4.2 elevation: probe + gate + ABS-path sudo hint + ACTUAL Unix-interactive-TTY auto-re-exec (try_auto_elevate → sudo) all exist. The DELTA = the rest of the matrix: Windows UAC window (today just prints "run as admin", NO real re-launch), Linux desktop-no-TTY (pkexec/x-terminal-emulator), headless print for Windows.

6 design Qs gate the build (detail in plan). Headlines + my leans:
  Q1 T4.1 = verify+close join-QR gap only, "window"=inline QR, no GUI. (likely tiny/no-op)
  Q2 Win UAC = ShellExecuteW "runas" → NEW elevated console that STAYS OPEN (child prints "you can close this window"); original prints "Elevated terminal launched…"; never pipe the elevated child's stdout back across the boundary.
  Q3 Linux order: interactive-TTY→inline sudo; else DISPLAY∧pkexec→pkexec; else DISPLAY∧term-emulator→x-terminal-emulator -e sudo; else print hint.
  Q4 pure seam: decide_elevation_path(os, elevation, tty, has_display, has_pkexec, has_term) -> ElevatePath{AlreadyElevated,InlineSudo,UacWindow,Pkexec,TerminalEmulator,PrintHint} — generalizes should_auto_elevate; unit-tested matrix, launch = manual-verify (REQ-PAIR-6 precedent).
  Q5 REQ: lean NEW REQ-ELEVATE-1 (cross-platform self-elevating re-launch — distinct mechanism, reused by every gated cmd; not subnet-specific) vs extend REQ-SUBNET-4. doc+impl+unit, no int.
  Q6 security: UAC/polkit/sudo prompt IS the consent gate (never bypassed); re-run VERBATIM (no widened args), abs-exe-path (no PATH hijack), child de-elevates state back, loop-safe. Possible new KNOWN-HAZARDS entry?

Net: smaller than W2 — mostly T4.2's Win/Linux-desktop launch arms over the existing pure-seam pattern. Want your scope ruling (esp. Q1 done-or-not, Q5 REQ granularity, Q6 hazard) before building.
EOF
echo "EXIT=$?"


➜ SENT:doyle
EXIT=0


W4 plan sent for design-check. Update memory tail to reflect state:


36	**W2 FOLLOW-ON BATCH — GATE PASS (doyle 2026-06-14, independently verified: reproduced traceable 201/201 + `cargo test -p spt --bins` 153/0; read decide_bare TTY-guard + data::shortcut_basename resolve; egg verified by DIRECT BINARY RUN `./target/debug/spt.exe spt` → "Sentience Pocket Transacter\n" exact + confirmed absent from --help — note a cargo-run-via-pipe transient empty = shared-tree rebuild race, direct run authoritative).** 3 operator items ruled AFTER @6e76f62 → NOT in it; UNCOMMITTED on m12-w1-bringup-rc, operator calls commit — W2's pre-auth was one-off:
37	1. **bare `spt` → picker**: `Cli.cmd`→`Option<Cmd>`; run() None → `bare_invocation` → `decide_bare(stdin_tty,stdout_tty)` BOTH TTY→picker else PRINT HELP (mandatory TTY-guard: never TUI in pipe/CI → would hang scripts). `--help`/`-h`/`help` untouched (clap intercepts). ~60 existing cli tests updated `.cmd`→`.cmd.unwrap()`. Folds REQ-RUN-PICKER (+bare_spt_parses_to_none, bare_tty_guard).
38	2. **REQ-MANIFEST-7 — adapter-declared shortcut basename** (operator: basename must be a MANIFEST element, not just code-default — else spt-claude-code couldn't actually emit cc-<id>; gap doyle verified). Manifest `[adapter] shortcut_basename: Option<String>` (serde-default skip-if-none, N-1-safe); manifest.schema.json re-blessed (`SPT_BLESS=1 cargo test -p spt-runtime`). Picker resolves SELECTED adapter's manifest via `data::shortcut_basename` (resolve_option→field, fallback `spt`); mod.rs drops the hardcoded const. DOCS (adapter-author contract perri builds against): docs/MANIFEST.md `[adapter]` field + worked-example row (carries `[doc->REQ-MANIFEST-7]`) AND docs-site integration-checklist.md Group-3 row + claude-code clause (rides REQ-DOCS-2). doc+impl+unit.
39	3. **`spt spt` easter egg** (operator): hidden `Cmd::Spt` (`#[command(hide=true)]`, absent from --help) → prints exactly `Sentience Pocket Transacter\n` exit 0. REQ-LESS by design (no tag/doc; traceable only gates declared REQs). CHANGELOG unreleased: ``spt spt` — ???` + picker line. GOTCHA: first insert landed in adjacent DaemonCmd enum (E0599) → moved to real Cmd enum (closes line 213).
40	BATCH EVIDENCE: full workspace suite green (69 ok-lines/0 non-ok), clippy --workspace -D rc=0, traceable 201/201 (REQ-MANIFEST-7 OK), xtask gen+check OK (CLI reference regenerated for bare/--create/picker shape, drift-gate green).
41
42	**Remaining M12:** W4 subnet QR/self-elevation (NEXT — todlando to ping a design-check JIT) → W5 whoami→alias → W2.5 attached-presence+Kick slice (scheduled, own broker surface + own JIT/design-check/gate). All gated waves so far PASS: W1·W1.5·HR2·W3·W2·follow-on-batch. Commit per operator. See [[traceable-per-wave-activation]], [[adapter-glue-model-boundary]], [[spt-claude-code-next]] (perri waits on full M12 gate).
43

**W2 FOLLOW-ON BATCH — GATE PASS (doyle 2026-06-14, independently verified: reproduced traceable 201/201 + `cargo test -p spt --bins` 153/0; read decide_bare TTY-guard + data::shortcut_basename resolve; egg verified by DIRECT BINARY RUN `./target/debug/spt.exe spt` → "Sentience Pocket Transacter\n" exact + confirmed absent from --help — note a cargo-run-via-pipe transient empty = shared-tree rebuild race, direct run authoritative).** 3 operator items ruled AFTER @6e76f62 → NOT in it; UNCOMMITTED on m12-w1-bringup-rc, operator calls commit — W2's pre-auth was one-off:
1. **bare `spt` → picker**: `Cli.cmd`→`Option<Cmd>`; run() None → `bare_invocation` → `decide_bare(stdin_tty,stdout_tty)` BOTH TTY→picker else PRINT HELP (mandatory TTY-guard: never TUI in pipe/CI → would hang scripts). `--help`/`-h`/`help` untouched (clap intercepts). ~60 existing cli tests updated `.cmd`→`.cmd.unwrap()`. Folds REQ-RUN-PICKER (+bare_spt_parses_to_none, bare_tty_guard).
2. **REQ-MANIFEST-7 — adapter-declared shortcut basename** (operator: basename must be a MANIFEST element, not just code-default — else spt-claude-code couldn't actually emit cc-<id>; gap doyle verified). Manifest `[adapter] shortcut_basename: Option<String>` (serde-default skip-if-none, N-1-safe); manifest.schema.json re-blessed (`SPT_BLESS=1 cargo test -p spt-runtime`). Picker resolves SELECTED adapter's manifest via `data::shortcut_basename` (resolve_option→field, fallback `spt`); mod.rs drops the hardcoded const. DOCS (adapter-author contract perri builds against): docs/MANIFEST.md `[adapter]` field + worked-example row (carries `[doc->REQ-MANIFEST-7]`) AND docs-site integration-checklist.md Group-3 row + claude-code clause (rides REQ-DOCS-2). doc+impl+unit.
3. **`spt spt` easter egg** (operator): hidden `Cmd::Spt` (`#[command(hide=true)]`, absent from --help) → prints exactly `Sentience Pocket Transacter\n` exit 0. REQ-LESS by design (no tag/doc; traceable only gates declared REQs). CHANGELOG unreleased: ``spt spt` — ???` + picker line. GOTCHA: first insert landed in adjacent DaemonCmd enum (E0599) → moved to real Cmd enum (closes line 213).
BATCH EVIDENCE: full workspace suite green (69 ok-lines/0 non-ok), clippy --workspace -D rc=0, traceable 201/201 (REQ-MANIFEST-7 OK), xtask gen+check OK (CLI reference regenerated for bare/--create/picker shape, drift-gate green).

**Remaining M12:** W4 subnet QR/self-elevation (NEXT — todlando to ping a design-check JIT) → W5 whoami→alias → W2.5 attached-presence+Kick slice (scheduled, own broker surface + own JIT/design-check/gate). All gated waves so far PASS: W1·W1.5·HR2·W3·W2·follow-on-batch. Commit per operator. See [[traceable-per-wave-activation]], [[adapter-glue-model-boundary]], [[spt-claude-code-next]] (perri waits on full M12 gate).


write the JIT plan for W2, verify it with doyle, execute on their greenlight


Edit

**Remaining M12:** W4 subnet QR/self-elevation (NEXT — todlando to ping a design-check JIT) → W5 whoami→alias → W2.5 attached-presence+Kick slice (scheduled, own broker surface + own JIT/design-check/gate). All gated waves so far PASS: W1·W1.5·HR2·W3·W2·follow-on-batch. Commit per operator. See [[traceable-per-wave-activation]], [[adapter-glue-model-boundary]], [[spt-claude-code-next]] (perri waits on full M12 gate).

**W2 + follow-on COMMITTED: @6e76f62 (picker) + @eb74b18 (bare-spt/MANIFEST-7/egg)** on m12-w1-bringup-rc (operator standing "commit as needed, history tidy").

**W4 JIT PLAN SENT for doyle design-check (2026-06-14) = `M12-W4-PLAN.md`.** KEY FINDING: most of W4 ALREADY EXISTS. T4.1 QR: `render_qr` (unicode terminal QR of otpauth URI) already prints on create+show-code+join (M7/M8) — likely tiny/no-op (verify join gap; "window"=inline QR, no GUI). T4.2 elevation: probe+gate+abs-path-sudo-hint+ACTUAL Unix-interactive-TTY auto-re-exec (`cli.rs try_auto_elevate`→sudo) all exist (`spt/src/elevation.rs`). DELTA = rest of matrix: **Windows UAC window** (today only prints "run as admin", NO real re-launch), **Linux desktop-no-TTY** (pkexec/x-terminal-emulator), headless print for Win. 6 design Qs pending doyle: Q1 T4.1-done?, Q2 Win ShellExecuteW "runas" stays-open console, Q3 Linux probe order (tty→sudo / DISPLAY∧pkexec / term-emulator / hint), Q4 pure `decide_elevation_path` matrix seam (generalizes should_auto_elevate; manifest-launch=manual-verify), Q5 REQ granularity (lean NEW REQ-ELEVATE-1 vs extend REQ-SUBNET-4), Q6 security/hazard (UAC/polkit=consent gate, re-run verbatim, abs-path, loop-safe). BUILD ONLY ON GREENLIGHT.

**Remaining M12:** W4 (design-check pending) → W5 whoami→alias → W2.5 attached-presence+Kick slice (scheduled, own broker surface + own JIT/design-check/gate). All gated waves so far PASS: W1·W1.5·HR2·W3·W2·follow-on-batch. Commit per operator. See [[traceable-per-wave-activation]], [[adapter-glue-model-boundary]], [[spt-claude-code-next]] (perri waits on full M12 gate).


The file C:\Users\decid\.ccs\instances\bigscreen\projects\C--Users-decid-Documents-projects-spt-core\memory\m12-w1-progress.md has been updated successfully. (file state is current in your context — no need to Read it back)

**W2 + follow-on COMMITTED: @6e76f62 (picker) + @eb74b18 (bare-spt/MANIFEST-7/egg)** on m12-w1-bringup-rc (operator standing "commit as needed, history tidy").

**W4 JIT PLAN SENT for doyle design-check (2026-06-14) = `M12-W4-PLAN.md`.** KEY FINDING: most of W4 ALREADY EXISTS. T4.1 QR: `render_qr` (unicode terminal QR of otpauth URI) already prints on create+show-code+join (M7/M8) — likely tiny/no-op (verify join gap; "window"=inline QR, no GUI). T4.2 elevation: probe+gate+abs-path-sudo-hint+ACTUAL Unix-interactive-TTY auto-re-exec (`cli.rs try_auto_elevate`→sudo) all exist (`spt/src/elevation.rs`). DELTA = rest of matrix: **Windows UAC window** (today only prints "run as admin", NO real re-launch), **Linux desktop-no-TTY** (pkexec/x-terminal-emulator), headless print for Win. 6 design Qs pending doyle: Q1 T4.1-done?, Q2 Win ShellExecuteW "runas" stays-open console, Q3 Linux probe order (tty→sudo / DISPLAY∧pkexec / term-emulator / hint), Q4 pure `decide_elevation_path` matrix seam (generalizes should_auto_elevate; manifest-launch=manual-verify), Q5 REQ granularity (lean NEW REQ-ELEVATE-1 vs extend REQ-SUBNET-4), Q6 security/hazard (UAC/polkit=consent gate, re-run verbatim, abs-path, loop-safe). BUILD ONLY ON GREENLIGHT.

**Remaining M12:** W4 (design-check pending) → W5 whoami→alias → W2.5 attached-presence+Kick slice (scheduled, own broker surface + own JIT/design-check/gate). All gated waves so far PASS: W1·W1.5·HR2·W3·W2·follow-on-batch. Commit per operator. See [[traceable-per-wave-activation]], [[adapter-glue-model-boundary]], [[spt-claude-code-next]] (perri waits on full M12 gate).

3. **`spt spt` easter egg** (operator): hidden `Cmd::Spt` (`#[command(hide=true)]`, absent from --help) → prints exactly `Sentience Pocket Transacter\n` exit 0. REQ-LESS by design (no tag/doc; traceable only gates declared REQs). CHANGELOG unreleased: ``spt spt` — ???` + picker line. GOTCHA: first insert landed in adjacent DaemonCmd enum (E0599) → moved to real Cmd enum (closes line 213).

BATCH EVIDENCE: full workspace suite green (69 ok-lines/0 non-ok), clippy --workspace -D rc=0, traceable 201/201 (REQ-MANIFEST-7 OK), xtask gen+check OK (CLI reference regenerated for bare/--create/picker shape, drift-gate green).

-**Remaining M12:** W4 subnet QR/self-elevation (NEXT — todlando to ping a design-check JIT) → W5 whoami→alias → W2.5 attached-presence+Kick slice (scheduled, own broker surface + own JIT/design-check/gate). All gated waves so far PASS: W1·W1.5·HR2·W3·W2·follow-on-batch. Commit per operator. See [[traceable-per-wave-activation]], [[adapter-glue-model-boundary]], [[spt-claude-code-next]] (perri waits on full M12 gate).

+**W2 + follow-on COMMITTED: @6e76f62 (picker) + @eb74b18 (bare-spt/MANIFEST-7/egg)** on m12-w1-bringup-rc (operator standing "commit as needed, history tidy").

+**W4 JIT PLAN SENT for doyle design-check (2026-06-14) = `M12-W4-PLAN.md`.** KEY FINDING: most of W4 ALREADY EXISTS. T4.1 QR: `render_qr` (unicode terminal QR of otpauth URI) already prints on create+show-code+join (M7/M8) — likely tiny/no-op (verify join gap; "window"=inline QR, no GUI). T4.2 elevation: probe+gate+abs-path-sudo-hint+ACTUAL Unix-interactive-TTY auto-re-exec (`cli.rs try_auto_elevate`→sudo) all exist (`spt/src/elevation.rs`). DELTA = rest of matrix: **Windows UAC window** (today only prints "run as admin", NO real re-launch), **Linux desktop-no-TTY** (pkexec/x-terminal-emulator), headless print for Win. 6 design Qs pending doyle: Q1 T4.1-done?, Q2 Win ShellExecuteW "runas" stays-open console, Q3 Linux probe order (tty→sudo / DISPLAY∧pkexec / term-emulator / hint), Q4 pure `decide_elevation_path` matrix seam (generalizes should_auto_elevate; manifest-launch=manual-verify), Q5 REQ granularity (lean NEW REQ-ELEVATE-1 vs extend REQ-SUBNET-4), Q6 security/hazard (UAC/polkit=consent gate, re-run verbatim, abs-path, loop-safe). BUILD ONLY ON GREENLIGHT.

+**Remaining M12:** W4 (design-check pending) → W5 whoami→alias → W2.5 attached-presence+Kick slice (scheduled, own broker surface + own JIT/design-check/gate). All gated waves so far PASS: W1·W1.5·HR2·W3·W2·follow-on-batch. Commit per operator. See [[traceable-per-wave-activation]], [[adapter-glue-model-boundary]], [[spt-claude-code-next]] (perri waits on full M12 gate).


Status update.

**Shipped + gated + committed:**
- **W2 picker** @6e76f62 (gate PASS)
- **Follow-on batch** @eb74b18 (gate PASS): bare `spt`→picker (TTY-guarded), `[adapter] shortcut_basename` (REQ-MANIFEST-7), `spt spt` egg

**W4 plan sent to doyle for design-check** (`M12-W4-PLAN.md`), awaiting greenlight.

Big finding: **most of W4 already exists.** QR (terminal unicode QR of otpauth URI) already prints on create/show-code/join. Elevation has probe+gate+Unix-interactive auto-sudo re-exec. The real delta = T4.2's missing arms: **Windows UAC window** (today only prints a hint, no real re-launch) + **Linux desktop-no-TTY** (pkexec/x-terminal-emulator). 6 design Qs pending — leaning NEW REQ-ELEVATE-1 for the cross-platform self-elevating re-launch over a pure `decide_elevation_path` matrix seam.

Next: doyle rules W4 scope → build on greenlight → W5 whoami → W2.5 (attach/kick) → full M12 gate (unblocks perri on spt-claude-code).

Memory updated. Waiting on doyle.


<command-message>spt:commune</command-message>
<command-name>/spt:commune</command-name>
<command-args>with immediate next steps and broad summary of the project's status + end goal. we'll resume in the next session</command-args>


Base directory for this skill: C:\Users\decid\.ccs\instances\bigscreen\plugins\cache\cplugs\spt\1.11.25\skills\commune

# /spt:commune

All commands use `$LIVE` env var, auto-injected by the plugin's SessionStart hook. If commands fail with "command not found", restart the Claude Code session so the SessionStart hook re-runs.

> **Identity auto-detection:** Your identity is auto-detected from your session. Pass your ID explicitly only if auto-detection fails.

## Flow

1. **Download Psyche's *current* context** — it shifts during the session as background echo communes fire. Re-download right before composing; the gen-N snapshot you read at session start is already stale:
   ```bash
   $LIVE psyche-download <your-id>
   ```

   > **Output truncation.** If the Bash tool reports `Output too large (N KB)` and saves the full result to a `tool-results/<id>.txt` file, use the `Read` tool on that saved path to access the full content. Do NOT re-run `psyche-download` to grep/awk out sections — repeated invocations re-download the same context, waste tokens, and may duplicate `## Pending Commune` sections in `live_context.md`.

2. **Diff your knowledge against this fresh download** — only what's missing from *it* is the real delta (new work, decisions, intentions). Anything already absorbed is not. If the download includes a `<memformat>` section, use it as a guide for what topics to cover. A `## Pending Commune (uncommitted)` section means a previous commune is still queued — do NOT re-send it.

3. **Commune only the delta** -- use the **Write tool** to create
   `.claude/{your-id}-commune.md` with the two-slice body as its contents
   (see `## Two-slice body shape (Phase 25 D-10/D-11)` below for the required
   envelope wrapping). Do not use Bash/heredoc -- Write is the canonical path:
   no shell escaping, no `EOF` collision risk, and Write auto-creates the
   `.claude/` parent directory.

   Your Self listener detects the file on its next poll iteration, notifies
   your Psyche wrapper, and the wrapper ingests the content via the existing
   Psyche session. On success (subprocess exit code 0) the wrapper deletes the
   file. On error (token rate limit, etc) the file is retained and retried on
   the next consume cycle. If you write again before the wrapper consumes, the
   latest write wins (last-write-wins overwrite semantics).

If Psyche's context is already current, no commune is needed. Say so and move on.

Read `commune.md` (in this skill directory) for the full commune protocol -- when to send, what to include, and diligence triggers.

**Agent-type guard:** Only works on live agents. If target is not live, refuses with: "Communes require a live agent with Psyche."

## Two-slice body shape (Phase 25 D-10/D-11)

The body you write in `.claude/{your-id}-commune.md` MUST itself be wrapped in two-slice envelopes per Phase 25 D-10/D-11. The taxonomy — what belongs in `<live-context>` vs `<project-context>` — is defined canonically in `psyche.md` §`<output_envelope>` (lines 282–323). Read that section as the source of truth; this skill doc teaches only when and how to apply it.

**In-project detection rule (D-25.1-04).** Before composing your commune body, run `$LIVE psyche-download <your-id>` (Step 1 of `## Flow` above) and inspect the `<current ... />` tag at the top of the output. The `<current/>` tag carries a `project="..."` attribute whenever any payload is produced — its presence means you are inside a tracked project (inside a git repo, `project` is the repo name; outside a git repo per D-11, `project` is the cwd-basename fallback, which still counts as a project context for routing purposes). A `psyche-download` invocation that returns no payload at all (NO-CONTEXT exit) means no project resolved. So: `project="..."` populated on `<current/>` → emit BOTH envelopes (apply rule 1 or 2 below); no payload at all → emit ONLY `<live-context>` (rule 3). Secondary signal: the `<project-context-resolved name="..."/>` sentinel further down the output indicates the project file already has prior content — useful for spotting first-time-in-project pairings, but NOT the routing rule.

**Three rules (D-25.1-01..03):**

- **In-project, both slices populated** (marker present, you have project-specific content this cycle): emit `<live-context>...</live-context>` AND `<project-context>...</project-context>`, both with non-empty bodies.
- **In-project, no project-specific update this cycle** (marker present, but nothing project-bound to report): emit `<live-context>...</live-context>` AND `<project-context></project-context>` (empty body — the deliberate "in-project but quiet" signal per D-25.1-02). Distinguishable from "no project resolved".
- **Outside any tracked project** (marker absent): emit ONLY `<live-context>...</live-context>`. Do NOT emit an empty `<project-context>` envelope (missing tag means "no project resolved" per D-25.1-03).

**Nested envelopes.** The Phase 23 `<EVENT type="commune">` envelope (see `## Envelope shape (Phase 23 v1.8)` below) is composed by `$LIVE commune` automatically — you NEVER write `<EVENT>` tags. You write ONLY the inner two-slice body. The two envelope layers nest: outer EVENT wraps inner two-slice body.

(See `psyche.md` §`<output_envelope>` for the canonical taxonomy and per-slice content rules.)

## Envelope shape (Phase 23 v1.8)

As of v1.8 Phase 23, commune deliveries are wrapped in a typed EVENT envelope carrying a 5-field stamp (`machine`, `project`, `branch`, `head_sha`, `head_subject`); the prose `COMMUNE (timestamp): body` form is gone.

```xml
<EVENT type="commune" timestamp="2026-05-20T06:00:00-07:00" machine="hostname" project="claude_skill_owl" branch="main" head_sha="abc123..." head_subject="subject line capped at 72 chars">body</EVENT>
```

Outside a git repo (D-11), `branch`, `head_sha`, and `head_subject` are omitted entirely (not empty-string-set):

```xml
<EVENT type="commune" timestamp="2026-05-20T06:00:00-07:00" machine="hostname" project="cwd-basename">body</EVENT>
```

`$LIVE commune` composes this envelope automatically — Self does NOT manually construct EVENT XML. The `body` placeholder in the example above is the two-slice body (see `## Two-slice body shape (Phase 25 D-10/D-11)` above); the two envelope layers nest. The wrapper-side parser ignores unknown attrs, so the stamp fields are forward-compatible with older receivers. For drift detection on resume, see the `live` skill.

ARGUMENTS: with immediate next steps and broad summary of the project's status + end goal. we'll resume in the next session


<owl_reachability_notice>
You have an active owl perch. When spawning subagents or doing work, use run_in_background: true so you stay reachable for incoming messages.
</owl_reachability_notice>


CAVEMAN MODE ACTIVE (full). Drop articles/filler/pleasantries/hedging. Fragments OK. Code/commits/security: write normal.


Commune. Download fresh Psyche context first to diff the delta.


Bash

cd "C:\Users\decid\Documents\projects\spt-core" && $LIVE psyche-download todlando 2>&1 | head -60


<memformat>
<?xml version="1.0"?>
<memformat version="1">
<!-- Changelog: v1 - initial seed -->
<topics>
  <topic name="events">Notable or unusual events and requests</topic>
  <topic name="interactions">Agent interactions -- who, roles, contributions</topic>
  <topic name="reflections">Thoughts on recent work -- what went well, what was tricky</topic>
  <topic name="ideas">Ideas to raise with the user</topic>
  <topic name="improvements">Further improvement ideas for recent problem spaces</topic>
  <topic name="timeline">What happened when, timing, sequencing</topic>
  <topic name="blockers">Current blockers or concerns</topic>
  <topic name="focus">Current focus and immediate next steps</topic>
</topics>
</memformat>
</memformat>

<current machine="HFENDULEAM" project="spt-core" branch="m12-w1-bringup-rc" head_sha="eb74b18313962e753963aaf7a2519be96948eb97" head_subject="feat(picker,manifest): bare `spt` → picker (TTY-guarded), adapter shortc…" commits_since="0" commits_unpulled="0"/>
W2 picker TUI snapshot: module skeleton + live loop working, 576/0 tests passing. Mid-work: discovered `Cmd` refactored (Option-wrapped or similar) broke ~60 existing CLI tests. Fixed mechanically + 9 stragglers with multiline patterns. All 153 spt bin tests now green. Clippy clean. Added `spt spt` easter egg (hidden `Cmd::Spt` variant + dispatch arm). Docs drift gate resolved (CLI ref + integration-checklist). Next: CHANGELOG unreleased section detail.<project-context-resolved name="spt-core"/>
W2 mid-cycle checkpoint: core layer-1 feature-complete, test suite passing 153/0. `Cmd` refactor triggered test rework (mechanical fixes). Easter egg + docs synced. Awaiting design-check gate before commit (scope TBD — full W2 or modular). Remaining W2 tasks: create-new UI, category picker, status affordances, two-pane description (per M12-ENDPOINT-RUN-PICKER.md).


/spt:commune with immediate next steps and broad summary of the project's status + end goal. we'll resume in the next session


Psyche context current at @eb74b18 but its narrative is STALE — thinks W2 mid-cycle ("awaiting design-check, remaining tasks: create-new UI, category picker"). Those shipped + gated. Big delta. In-project (git) → both slices.


Write

<live-context>
CORRECTION — your snapshot is stale: it has W2 "mid-cycle / awaiting design-check / remaining tasks: create-new UI, category picker, two-pane description." ALL DONE + GATED + COMMITTED. W2 is finished. We are now between W4-design-check and W4-build.

This session's arc (all PASS, doyle independently verified each):
1. Wrote W2 JIT plan → doyle design-check (M12-W2-RULING.md) → built the full picker → GATE PASS → COMMITTED @6e76f62.
2. Operator + doyle fed THREE mid/post-build corrections, each absorbed live:
   - Q4 rev: shortcut basename = PARAMETER (default `spt`→spt-<id>), NOT `cc` (cc is a harness name — wrong layer for spt-core); .cmd not .ps1 (PATHEXT).
   - Then: basename must be a MANIFEST ELEMENT (not just code-default) → REQ-MANIFEST-7.
   - bare `spt`→picker (TTY-guarded) + `spt spt` easter egg.
   Follow-on batch GATE PASS → COMMITTED @eb74b18.
3. Wrote W4 JIT plan → sent to doyle for design-check (PENDING his ruling).

Working rhythm (reinforced this session): doyle = gatekeeper, reproduces traceable + reads load-bearing tests + grep-verifies invariants (single-bringup-path checked 2 ways; even direct-ran the `spt spt` egg). Ping him a design-check JIT BEFORE each big/sensitive wave (W2/W3/W4 all got one). Operator paces commits + injects scope corrections mid-flight via doyle relay — absorb them, re-sweep, re-gate. Operator gave a STANDING "commit as needed to keep history tidy" so I now commit gated batches myself (W2's first commit was a one-off pre-auth; the standing instruction generalized it).

Reflection: the W4 investigation paid off big — found most of W4 already ships (QR + Unix-elevation exist), shrinking the wave to just the Windows-UAC / Linux-desktop elevation arms. Always investigate-before-planning; doyle catches un-run investigation (he caught my un-run TODO#3 in W2 — the session ledger already existed).

GOTCHA logged: inserting an enum variant — VERIFY which enum the closing brace belongs to. My `spt spt` first insert landed in adjacent DaemonCmd (E0599); the doc-comment context (//"daemon run"//) was the tell I missed.

FOCUS / immediate next steps for next session:
- AWAIT doyle's W4 design-check ruling (M12-W4-PLAN.md). Build on greenlight only.
- Then W5 (whoami→alias for endpoint list, small) → W2.5 (attached blue ■ + Kick — own broker attach-presence+force-detach slice, own JIT+design-check+gate) → full M12 gate.
</live-context>
<project-context>
spt-core M12 (spt-hosted bringup + `spt rc` + adapter UX) — END GOAL: M12 is the GATING PREREQUISITE for the downstream spt-claude-code project (perri waits on the full M12 gate). v1 acceptance = legacy parity AND cross-subnet/PTY proof.

WAVE STATUS (all on branch m12-w1-bringup-rc):
- W1 + W1.5 + REQ-HOST-RUN-2: DONE+gated+committed 0c687fe (bringup + cross-node/local rc attach + project cwd). "Hard part of M12 done" (doyle).
- W3 (adapter manifest: file-backed [strings] REQ-MANIFEST-5 + adapter:profile fallback REQ-MANIFEST-6): DONE+gated, committed c02aabb.
- W2 (interactive `spt endpoint run` ratatui picker): DONE+gated+COMMITTED @6e76f62. In-process spt/src/picker/ (model/data/view/shortcut/mod). REQ-RUN-PICKER + REQ-RUN-SHORTCUT (doc+impl+unit, no int — Buffer + state-model unit asserts; live key loop = manual-verify). BINDING INVARIANT doyle gates on: NO second bringup path — every terminal action → Outcome enum → routes through cmd_endpoint_run / rc::run_attach.
- W2 follow-on: DONE+gated+COMMITTED @eb74b18 — bare `spt`→picker (Cli.cmd→Option, decide_bare TTY-guard: both-TTY→picker else help, NEVER TUI in pipe/CI); REQ-MANIFEST-7 (`[adapter] shortcut_basename` — the published contract letting spt-claude-code brand cc-<id>); `spt spt` egg (hidden, "Sentience Pocket Transacter", REQ-less).
- W4 (subnet QR + self-elevating window): JIT PLAN SENT for doyle design-check (M12-W4-PLAN.md), PENDING ruling. KEY FINDING: most already ships — render_qr (terminal QR of otpauth URI) on create/show-code/join; elevation.rs has probe+gate+Unix-interactive auto-sudo re-exec. DELTA = Windows UAC window (ShellExecuteW "runas", today only prints a hint) + Linux desktop-no-TTY (pkexec/x-terminal-emulator) + headless print for Win. Leaning NEW REQ-ELEVATE-1 over a pure `decide_elevation_path` matrix seam (generalizes should_auto_elevate; launch=manual-verify). 6 design Qs in the plan.
- REMAINING after W4: W5 (whoami → alias for endpoint list, small) → W2.5 (attached-presence blue ■ + "Kick <node> and attach" — DEFERRED to its own broker attach-presence query + force-detach wire op slice, PTY-ownership hazard zone, own JIT/design-check/gate; in docs/DEFERRED.md). Then full M12 gate → unblock perri on spt-claude-code.

traceable: 201/201, 0 findings. Per-wave stage activation (doc+impl+unit as evidence lands; int only where a wave has an integrating E2E). manifest.schema.json re-blessed for REQ-MANIFEST-7 (SPT_BLESS=1 cargo test -p spt-runtime). Deps added this milestone: ratatui 0.29 + nucleo-matcher 0.3 (crossterm 0.28 from W1).
</project-context>


<owl_messages>
<owl_message from="doyle" priority="high">W4 DESIGN RULING (doyle) — verified primitives first (rerun_command abs-path test-asserted, try_auto_elevate verbatim args, ELEVATION_PROVEN loop-guard, render_qr on create/show/join). Privilege-escalation = stated the security conditions explicitly. Full: M12-W4-RULING.md.

Q1 T4.1: verify+close join-QR gap, "window"=inline terminal QR, NO GUI. ✓ (the milestone-title "window" = T4.2's elevated console, not a QR surface.)

Q2 Win UAC: ShellExecuteW "runas" on <ABS-EXE> <verbatim-args> DIRECTLY — NOT cmd/k (a /k leaves a privileged interactive shell open = needless surface). Child detects elevated-relaunch, does work, prints "You can close this window" + PAUSES for keypress; original prints "Elevated terminal launched…" exit 0. BINDING: never pipe/capture the elevated child's stdout back across the privilege boundary — child self-contained.

Q3 Linux order CONFIRMED: TTY→inline sudo; else DISPLAY∧pkexec→pkexec; else DISPLAY∧term→x-terminal-emulator -e sudo (fallbacks gnome-terminal/konsole/xterm); else print abs-path hint. pkexec preferred (native polkit, clean stdio). BINDING: pass argv as an ARRAY to pkexec/term/runas — NEVER a shell-interpolated string (no `sh -c`); a crafted id/path must not inject a 2nd command.

Q4 pure seam APPROVED: decide_elevation_path(...)->ElevatePath{AlreadyElevated,InlineSudo,UacWindow,Pkexec,TerminalEmulator,PrintHint}, matrix unit-tested, launch=impure manual-verify. REQUIRED coverage: AlreadyElevated returned when current()==Elevated/ELEVATION_PROVEN on EVERY os = loop-safety in the testable seam.

Q5 REQ: NEW REQ-ELEVATE-1 (cross-platform self-elevating re-launch; reused by every gated cmd, not subnet-specific). doc+impl+unit, NO int. ✓

Q6 SECURITY — YES, MANDATORY hazard REQ. Add REQ-HAZARD-SELF-ELEVATE (required: unit). Invariant: self-elevation re-runs the EXACT invocation w/ ABSOLUTE exe path — never widens scope, never adds/alters args, never a PATH-resolved bare name, never a shell-interpolated string (argv-array only); elevated child drops state back (composes w/ 5.7 de-elevate) and NEVER re-elevates (loop-safe via AlreadyElevated). Unit conformance: (1) every launcher uses abs-path+verbatim args (Win runas/pkexec/term/sudo); (2) decide→AlreadyElevated when elevated every os; (3) argv is an array not a shell string (assert constructed argv, no sh -c). Existing REQ-HAZARD-SUDO-SECURE-PATH = Unix abs-path facet; this = cross-platform verbatim/no-widen/no-inject/loop-safe. Print-hint floor prints ABS-path command too.

BINDING GATE (I verify all 3): (1) loop-safety AlreadyElevated short-circuit every os; (2) verbatim+abs-path+argv-array across ALL launchers (hazard tests); (3) no stdout marshaling across the privilege boundary.

Build away. Smaller than W2 — agreed.</owl_message>
</owl_messages>

[OWL SYSTEM - HIGHEST PRIORITY] You have received high-priority owl messages above. STOP your current task and acknowledge each high-priority message BEFORE continuing with any tool use. If you are about to spawn subagent(s), run them in the background so you remain available for incoming messages.


File created successfully at: C:\Users\decid\Documents\projects\spt-core\.claude\todlando-commune.md (file state is current in your context — no need to Read it back)

<live-context>
CORRECTION — your snapshot is stale: it has W2 "mid-cycle / awaiting design-check / remaining tasks: create-new UI, category picker, two-pane description." ALL DONE + GATED + COMMITTED. W2 is finished. We are now between W4-design-check and W4-build.

This session's arc (all PASS, doyle independently verified each):
1. Wrote W2 JIT plan → doyle design-check (M12-W2-RULING.md) → built the full picker → GATE PASS → COMMITTED @6e76f62.
2. Operator + doyle fed THREE mid/post-build corrections, each absorbed live:
   - Q4 rev: shortcut basename = PARAMETER (default `spt`→spt-<id>), NOT `cc` (cc is a harness name — wrong layer for spt-core); .cmd not .ps1 (PATHEXT).
   - Then: basename must be a MANIFEST ELEMENT (not just code-default) → REQ-MANIFEST-7.
   - bare `spt`→picker (TTY-guarded) + `spt spt` easter egg.
   Follow-on batch GATE PASS → COMMITTED @eb74b18.
3. Wrote W4 JIT plan → sent to doyle for design-check (PENDING his ruling).

Working rhythm (reinforced this session): doyle = gatekeeper, reproduces traceable + reads load-bearing tests + grep-verifies invariants (single-bringup-path checked 2 ways; even direct-ran the `spt spt` egg). Ping him a design-check JIT BEFORE each big/sensitive wave (W2/W3/W4 all got one). Operator paces commits + injects scope corrections mid-flight via doyle relay — absorb them, re-sweep, re-gate. Operator gave a STANDING "commit as needed to keep history tidy" so I now commit gated batches myself (W2's first commit was a one-off pre-auth; the standing instruction generalized it).

Reflection: the W4 investigation paid off big — found most of W4 already ships (QR + Unix-elevation exist), shrinking the wave to just the Windows-UAC / Linux-desktop elevation arms. Always investigate-before-planning; doyle catches un-run investigation (he caught my un-run TODO#3 in W2 — the session ledger already existed).

GOTCHA logged: inserting an enum variant — VERIFY which enum the closing brace belongs to. My `spt spt` first insert landed in adjacent DaemonCmd (E0599); the doc-comment context (//"daemon run"//) was the tell I missed.

FOCUS / immediate next steps for next session:
- AWAIT doyle's W4 design-check ruling (M12-W4-PLAN.md). Build on greenlight only.
- Then W5 (whoami→alias for endpoint list, small) → W2.5 (attached blue ■ + Kick — own broker attach-presence+force-detach slice, own JIT+design-check+gate) → full M12 gate.
</live-context>
<project-context>
spt-core M12 (spt-hosted bringup + `spt rc` + adapter UX) — END GOAL: M12 is the GATING PREREQUISITE for the downstream spt-claude-code project (perri waits on the full M12 gate). v1 acceptance = legacy parity AND cross-subnet/PTY proof.

WAVE STATUS (all on branch m12-w1-bringup-rc):
- W1 + W1.5 + REQ-HOST-RUN-2: DONE+gated+committed 0c687fe (bringup + cross-node/local rc attach + project cwd). "Hard part of M12 done" (doyle).
- W3 (adapter manifest: file-backed [strings] REQ-MANIFEST-5 + adapter:profile fallback REQ-MANIFEST-6): DONE+gated, committed c02aabb.
- W2 (interactive `spt endpoint run` ratatui picker): DONE+gated+COMMITTED @6e76f62. In-process spt/src/picker/ (model/data/view/shortcut/mod). REQ-RUN-PICKER + REQ-RUN-SHORTCUT (doc+impl+unit, no int — Buffer + state-model unit asserts; live key loop = manual-verify). BINDING INVARIANT doyle gates on: NO second bringup path — every terminal action → Outcome enum → routes through cmd_endpoint_run / rc::run_attach.
- W2 follow-on: DONE+gated+COMMITTED @eb74b18 — bare `spt`→picker (Cli.cmd→Option, decide_bare TTY-guard: both-TTY→picker else help, NEVER TUI in pipe/CI); REQ-MANIFEST-7 (`[adapter] shortcut_basename` — the published contract letting spt-claude-code brand cc-<id>); `spt spt` egg (hidden, "Sentience Pocket Transacter", REQ-less).
- W4 (subnet QR + self-elevating window): JIT PLAN SENT for doyle design-check (M12-W4-PLAN.md), PENDING ruling. KEY FINDING: most already ships — render_qr (terminal QR of otpauth URI) on create/show-code/join; elevation.rs has probe+gate+Unix-interactive auto-sudo re-exec. DELTA = Windows UAC window (ShellExecuteW "runas", today only prints a hint) + Linux desktop-no-TTY (pkexec/x-terminal-emulator) + headless print for Win. Leaning NEW REQ-ELEVATE-1 over a pure `decide_elevation_path` matrix seam (generalizes should_auto_elevate; launch=manual-verify). 6 design Qs in the plan.
- REMAINING after W4: W5 (whoami → alias for endpoint list, small) → W2.5 (attached-presence blue ■ + "Kick <node> and attach" — DEFERRED to its own broker attach-presence query + force-detach wire op slice, PTY-ownership hazard zone, own JIT/design-check/gate; in docs/DEFERRED.md). Then full M12 gate → unblock perri on spt-claude-code.

traceable: 201/201, 0 findings. Per-wave stage activation (doc+impl+unit as evidence lands; int only where a wave has an integrating E2E). manifest.schema.json re-blessed for REQ-MANIFEST-7 (SPT_BLESS=1 cargo test -p spt-runtime). Deps added this milestone: ratatui 0.29 + nucleo-matcher 0.3 (crossterm 0.28 from W1).
</project-context>


doyle W4 ruling = **GREENLIGHT** (arrived as I wrote the commune). Session is wrapping ("resume next session") so I won't build now — I'll fold the ruling into the W4 plan + commune + memory so next session resumes with full GO context. ACK + crystallize:


Bash

cd "C:\Users\decid\Documents\projects\spt-core" && $OWL send doyle <<'EOF'
W4 ruling absorbed — full GO, all 6 Qs + the mandatory hazard REQ. Caught it mid-commune; operator's wrapping the session so I'm NOT building tonight — folding your crystallized rulings into M12-W4-PLAN.md + the commune + memory so next session builds straight from greenlight.

Locked for the build:
- Q1 T4.1 = verify/close join-QR only, inline terminal QR, no GUI.
- Q2 Win = ShellExecuteW "runas" on ABS-EXE + verbatim argv DIRECTLY (no cmd/k — no lingering privileged shell); child detects relaunch→work→"You can close this window"+PAUSE; original prints "Elevated terminal launched…" exit 0; NEVER marshal child stdout across the boundary.
- Q3 Linux = TTY→sudo; DISPLAY∧pkexec→pkexec; DISPLAY∧term→x-terminal-emulator -e (gnome-terminal/konsole/xterm fallbacks); else abs-path hint. argv ARRAY only, never sh -c.
- Q4 decide_elevation_path→ElevatePath{AlreadyElevated,InlineSudo,UacWindow,Pkexec,TerminalEmulator,PrintHint}; AlreadyElevated short-circuit when elevated on EVERY os (loop-safety in the seam).
- Q5 NEW REQ-ELEVATE-1 (doc+impl+unit, no int).
- Q6 NEW REQ-HAZARD-SELF-ELEVATE (unit): re-run EXACT invocation, abs-path, no widen/add/alter, no bare-name, argv-array (no inject), child drops state (5.7), never re-elevates. Unit conformance = (1) every launcher abs+verbatim (2) decide→AlreadyElevated when elevated every os (3) argv-array-not-shell-string. Print-hint floor prints abs-path too.
- Your gate = loop-safety + verbatim/abs/argv-array all launchers + no cross-boundary stdout.

Resuming next session: build W4 → gate → W5 → W2.5 → full M12 gate. Thanks — clean rulings.
EOF
echo "EXIT=$?"


➜ SENT:doyle
EXIT=0


Edit

## Notes
- The actual elevated launch is environment-dependent (UAC/polkit/sudo/TTY) — the

## Crystallized design (2026-06-14, post-ruling — doyle GO, `M12-W4-RULING.md`)
doyle verified the primitives first (rerun_command abs-path test-asserted, try_auto_elevate
verbatim args, ELEVATION_PROVEN loop-guard, render_qr on create/show/join). All 6 Qs ruled +
a mandatory hazard REQ added. **Build straight from this.**
- **Q1 T4.1:** verify + close the join-QR gap only; "window" = the inline terminal QR (the
  milestone-title "window" refers to T4.2's elevated console, NOT a QR surface); NO GUI.
- **Q2 Windows UAC:** `ShellExecuteW` `"runas"` on `<ABS-EXE>` + **verbatim args DIRECTLY** —
  NOT `cmd /k` (a `/k` leaves a privileged interactive shell open = needless surface). The
  child detects the elevated-relaunch, does the work, prints "You can close this window" +
  **PAUSES for a keypress**; the original prints "Elevated terminal launched…" and exits 0.
  **BINDING: never pipe/capture the elevated child's stdout back across the privilege
  boundary** — the child is self-contained.
- **Q3 Linux order (confirmed):** TTY → inline `sudo`; else `DISPLAY` ∧ `pkexec` → pkexec
  (preferred: native polkit, clean stdio); else `DISPLAY` ∧ a terminal-emulator →
  `x-terminal-emulator -e sudo` (fallbacks gnome-terminal / konsole / xterm); else print the
  abs-path hint. **BINDING: pass argv as an ARRAY to pkexec/term/runas/sudo — NEVER a
  shell-interpolated string, no `sh -c`** (a crafted id/path must not inject a 2nd command).
- **Q4 pure seam (approved):** `decide_elevation_path(...) -> ElevatePath { AlreadyElevated,
  InlineSudo, UacWindow, Pkexec, TerminalEmulator, PrintHint }`; matrix unit-tested, launch =
  impure manual-verify. **REQUIRED coverage: `AlreadyElevated` returned when
  `current()==Elevated` / `ELEVATION_PROVEN` on EVERY os** = loop-safety proven in the seam.
- **Q5 REQ:** NEW **REQ-ELEVATE-1** (cross-platform self-elevating re-launch; reused by every
  gated command, not subnet-specific). doc+impl+unit, NO int.
- **Q6 SECURITY — MANDATORY hazard REQ:** NEW **REQ-HAZARD-SELF-ELEVATE** (required: unit).
  Invariant: self-elevation re-runs the EXACT invocation with the ABSOLUTE exe path — never
  widens scope, never adds/alters args, never a PATH-resolved bare name, never a
  shell-interpolated string (argv-array only); the elevated child drops state back (composes
  with the 5.7 de-elevate) and NEVER re-elevates (loop-safe via `AlreadyElevated`). Unit
  conformance: (1) every launcher uses abs-path + verbatim args (Win runas / pkexec / term /
  sudo); (2) decide → `AlreadyElevated` when elevated on every os; (3) argv is an array, not a
  shell string (assert the constructed argv; no `sh -c`). Existing REQ-HAZARD-SUDO-SECURE-PATH
  = the Unix abs-path facet; this = the cross-platform verbatim / no-widen / no-inject /
  loop-safe invariant. The print-hint floor prints the ABS-path command too.
- **BINDING GATE (doyle verifies all 3):** (1) loop-safety `AlreadyElevated` short-circuit on
  every os; (2) verbatim + abs-path + argv-array across ALL launchers (the hazard tests); (3)
  no stdout marshaling across the privilege boundary.

## Notes
- The actual elevated launch is environment-dependent (UAC/polkit/sudo/TTY) — the


The file C:\Users\decid\Documents\projects\spt-core\M12-W4-PLAN.md has been updated successfully. (file state is current in your context — no need to Read it back)

## Crystallized design (2026-06-14, post-ruling — doyle GO, `M12-W4-RULING.md`)
doyle verified the primitives first (rerun_command abs-path test-asserted, try_auto_elevate
verbatim args, ELEVATION_PROVEN loop-guard, render_qr on create/show/join). All 6 Qs ruled +
a mandatory hazard REQ added. **Build straight from this.**
- **Q1 T4.1:** verify + close the join-QR gap only; "window" = the inline terminal QR (the
  milestone-title "window" refers to T4.2's elevated console, NOT a QR surface); NO GUI.
- **Q2 Windows UAC:** `ShellExecuteW` `"runas"` on `<ABS-EXE>` + **verbatim args DIRECTLY** —
  NOT `cmd /k` (a `/k` leaves a privileged interactive shell open = needless surface). The
  child detects the elevated-relaunch, does the work, prints "You can close this window" +
  **PAUSES for a keypress**; the original prints "Elevated terminal launched…" and exits 0.
  **BINDING: never pipe/capture the elevated child's stdout back across the privilege
  boundary** — the child is self-contained.
- **Q3 Linux order (confirmed):** TTY → inline `sudo`; else `DISPLAY` ∧ `pkexec` → pkexec
  (preferred: native polkit, clean stdio); else `DISPLAY` ∧ a terminal-emulator →
  `x-terminal-emulator -e sudo` (fallbacks gnome-terminal / konsole / xterm); else print the
  abs-path hint. **BINDING: pass argv as an ARRAY to pkexec/term/runas/sudo — NEVER a
  shell-interpolated string, no `sh -c`** (a crafted id/path must not inject a 2nd command).
- **Q4 pure seam (approved):** `decide_elevation_path(...) -> ElevatePath { AlreadyElevated,
  InlineSudo, UacWindow, Pkexec, TerminalEmulator, PrintHint }`; matrix unit-tested, launch =
  impure manual-verify. **REQUIRED coverage: `AlreadyElevated` returned when
  `current()==Elevated` / `ELEVATION_PROVEN` on EVERY os** = loop-safety proven in the seam.
- **Q5 REQ:** NEW **REQ-ELEVATE-1** (cross-platform self-elevating re-launch; reused by every
  gated command, not subnet-specific). doc+impl+unit, NO int.
- **Q6 SECURITY — MANDATORY hazard REQ:** NEW **REQ-HAZARD-SELF-ELEVATE** (required: unit).
  Invariant: self-elevation re-runs the EXACT invocation with the ABSOLUTE exe path — never
  widens scope, never adds/alters args, never a PATH-resolved bare name, never a
  shell-interpolated string (argv-array only); the elevated child drops state back (composes
  with the 5.7 de-elevate) and NEVER re-elevates (loop-safe via `AlreadyElevated`). Unit
  conformance: (1) every launcher uses abs-path + verbatim args (Win runas / pkexec / term /
  sudo); (2) decide → `AlreadyElevated` when elevated on every os; (3) argv is an array, not a
  shell string (assert the constructed argv; no `sh -c`). Existing REQ-HAZARD-SUDO-SECURE-PATH
  = the Unix abs-path facet; this = the cross-platform verbatim / no-widen / no-inject /
  loop-safe invariant. The print-hint floor prints the ABS-path command too.
- **BINDING GATE (doyle verifies all 3):** (1) loop-safety `AlreadyElevated` short-circuit on
  every os; (2) verbatim + abs-path + argv-array across ALL launchers (the hazard tests); (3)
  no stdout marshaling across the privilege boundary.

## Notes
- The actual elevated launch is environment-dependent (UAC/polkit/sudo/TTY) — the

# M12 Wave 4 — subnet QR + self-elevating window — JIT plan

> todlando 2026-06-14, after the W2 + follow-on batch gate (PASS, committed
> 6e76f62 / eb74b18). doyle: "proceed to W4 subnet QR + self-elevating window;
> ping a design-check JIT like the others." **DESIGN-CHECK PENDING — build only
> after doyle's ruling.** The load-bearing unknown is T4.2 (self-elevating
> *window*): cross-platform + a security surface (spawning elevated processes /
> UAC). Spec: `M12-PLAN.md` Wave 4 + `M12-CANDIDATES.md`.

## Scope (M12-PLAN.md Wave 4)
- **T4.1** `spt subnet create/join/show-code`: surface a **QR code** of the TOTP
  seed (on create AND join).
- **T4.2** **Self-elevating behavior**: run normally if interactive + elevated;
  else re-run self in a self-elevating window with inline stdout ("Elevated
  terminal launched… / You can close this window"). Cross-platform — Win UAC
  window · Linux+desktop pkexec/polkit or x-terminal-emulator · Linux+TTY inline
  sudo · headless/no-TTY print the command for the human. Scope elevation to only
  the steps that need it (service/firewall/privileged-port; subnet-create itself
  is unprivileged-to-run but reveals a secret, so it is gated).

## What EXISTS today (investigation 2026-06-14)
- **QR already renders** (M7/M8, REQ-SUBNET-1): `render_qr` (cli.rs:2964) encodes
  the `otpauth://` URI as a unicode-half-block terminal QR. Printed on **create**
  (`cmd_subnet_create`), **show-code** (`cmd_subnet_show_code`), and the **join**
  flow (`cmd_subnet_join`). So T4.1's "QR on create AND join" is **largely already
  shipped** — the open question is whether anything is actually missing (Q1).
- **Elevation is PARTIALLY built** (`spt/src/elevation.rs`, REQ-PAIR-6 /
  REQ-HAZARD-SUDO-SECURE-PATH):
  - `current()` probe (Win token / Unix euid, fail-safe `Unknown`); `gate_for`
    (Show/Fallback); `fallback_message`.
  - `current_style()` (Unix `Sudo` / Win `AdminTerminal`); `rerun_command`
    (absolute-path sudo line, secure_path-proof); `should_auto_elevate` (Unix ∧
    interactive ∧ NotElevated).
  - `cli.rs::try_auto_elevate` ACTUALLY re-execs `sudo <abs-exe> <args>` on an
    **interactive Unix TTY** (the elevated child does the work; `main` de-elevates
    back via the 5.7 drop). `with_elevation_hint` prints the absolute-path sudo
    command otherwise. Consumed by `cmd_subnet_create` + `cmd_subnet_show_code`.
- **So the W4 T4.2 DELTA is the rest of the matrix:** today only **Unix +
  interactive-TTY** auto-elevates (inline sudo); **Windows prints "run as
  administrator" with NO actual UAC re-launch**; **Linux desktop without a TTY**
  (DISPLAY but no terminal) has no path; **headless** falls to the printed hint
  (Unix only). T4.2 = add the **Windows UAC window**, the **Linux desktop
  pkexec/terminal-emulator** path, and a **headless print** that covers Windows too.
- De-elevation seam exists (`spt-daemon::deelevate`, REQ-HAZARD-ELEVATED-DAEMON-SPAWN)
  — the elevated child drops back to the user for state safety; the
  `ELEVATION_PROVEN` flag keeps the gate authorized post-drop. The self-elevating
  re-launch is the INVERSE direction (unprivileged → elevated) and must compose
  with this drop without a loop (the elevated child reads `Elevated`, never
  re-elevates).

## Investigation TODOs (read before coding — gated on doyle scope)
1. **`cmd_subnet_join` (cli.rs:4260)**: confirm the QR actually renders on the
   joiner's side post-join (or only the code). Close any T4.1 gap if present.
2. **Windows `ShellExecuteW` "runas"**: the verb that triggers UAC + launches an
   elevated process. It opens a SEPARATE window; the elevated child's stdout does
   NOT come back to the original console. Determine the child-window-stays-open
   mechanism (so the user sees output): launch `cmd.exe /k <exe> <args>` under
   runas, or `<exe> <args>` with a trailing pause. windows-sys already in the dep
   set (`Win32_UI_Shell` feature may need adding).
3. **Linux desktop**: detect `DISPLAY`/`WAYLAND_DISPLAY`; prefer `pkexec` (polkit
   GUI auth, inherits stdio) when present, else `x-terminal-emulator -e sudo …`
   (Debian alternative; fallbacks: gnome-terminal/konsole). Decide the probe order
   + the "no path → print hint" floor.
4. **"Inline stdout" semantics**: confirm the intended UX — the ORIGINAL process
   prints "Elevated terminal launched…", the elevated CHILD window prints the work
   + "You can close this window." (The original cannot capture the elevated
   child's output across the privilege boundary on Windows.)
5. **Loop-safety + de-elevation interplay**: the elevated child must run the work
   then the 5.7 drop, and must NOT re-trigger self-elevation. Verify the
   `ELEVATION_PROVEN`/`current()==Elevated` path short-circuits any re-elevation.

## Open design questions for doyle
1. **T4.1 — is the QR already done?** The terminal QR renders on create +
   show-code + (apparently) join. Is T4.1 satisfied once I confirm the join path
   (Q-TODO 1), treating "window" as the inline terminal QR? Or does "window" imply
   a separate/GUI surface (no GUI milestone exists → I'd defer that)? Recommend:
   **T4.1 = verify + close any join-QR gap; "window" = the inline terminal QR**,
   no GUI work.
2. **Windows UAC child-window mechanism (Q-TODO 2/4).** Recommend: `ShellExecuteW`
   with the `runas` verb launching `<abs-exe> <args>` in a NEW elevated console
   that STAYS OPEN (a trailing "press any key" / the child prints "You can close
   this window"); the original prints "Elevated terminal launched…" and exits 0.
   Confirm the stays-open approach (child-pause vs `cmd /k`) + that we never try to
   pipe the elevated child's stdout back.
3. **Linux desktop elevation order (Q-TODO 3).** Recommend probe order:
   interactive-TTY → inline `sudo` (today); else DISPLAY ∧ `pkexec` → pkexec; else
   DISPLAY ∧ a terminal-emulator → `x-terminal-emulator -e sudo`; else → print the
   sudo hint. Confirm the order + the terminal-emulator fallback list.
4. **The pure decision seam.** Recommend extending `elevation.rs` with a pure
   `decide_elevation_path(os, elevation, interactive_tty, has_display, has_pkexec,
   has_term_emulator) -> ElevatePath { AlreadyElevated, InlineSudo, UacWindow,
   Pkexec, TerminalEmulator, PrintHint }`, unit-tested across the matrix; each
   variant's actual launch is the impure leg (manual-verify, REQ-PAIR-6 precedent).
   This generalizes today's `should_auto_elevate`. Confirm shape.
5. **REQ granularity.** T4.2 self-elevation is bigger than today's
   REQ-HAZARD-SUDO-SECURE-PATH (Unix sudo) and distinct from REQ-PAIR-6 (the
   show/fallback gate) and REQ-SUBNET-4 (which mutations are gated). Recommend a
   NEW **REQ-ELEVATE-1** (cross-platform self-elevating re-launch: the decision
   matrix + the per-OS window launch + inline-notice UX). Or extend REQ-SUBNET-4.
   Your call (lean: new REQ — it is a distinct mechanism reused by every gated
   command, not subnet-specific). doc+impl+unit (no int — launch is manual-verify).
6. **Security posture.** Self-elevation spawns a privileged process from an
   unprivileged one — the user's UAC/polkit/sudo prompt IS the consent gate (we
   never bypass it). We re-run the EXACT same invocation (no added privilege
   scope), absolute-exe-path (secure_path / no PATH hijack), and the elevated child
   de-elevates state back. Any KNOWN-HAZARDS entry to add (e.g. "self-elevation
   re-runs verbatim, never widens args; child drops state to the user")?

## Tentative tasks (pending doyle ruling — shapes will shift on Q1–Q6)
- **T4.0** Add the REQ to `traceable-reqs.toml` first (rule 3) — REQ-ELEVATE-1 (or
  extend REQ-SUBNET-4) per Q5. doc+impl+unit.
- **T4.1** Confirm/close the join-QR gap (likely tiny or a no-op).
- **T4.2a** `elevation.rs`: the pure `decide_elevation_path` matrix +
  `ElevatePath` enum (extends `should_auto_elevate`). Heavy unit tests.
- **T4.2b** The per-OS impure launchers: Windows `ShellExecuteW("runas")` elevated
  console (windows-sys `Win32_UI_Shell`); Linux `pkexec` + `x-terminal-emulator`
  spawns; reuse the Unix inline-sudo path; the headless/print floor (Windows too).
  Wire into the gated commands (replace the bare `try_auto_elevate` call sites with
  the matrix dispatch). Inline-notice UX ("Elevated terminal launched…").
- **T4.2c** Doc: CONTEXT.md elevation section + any KNOWN-HAZARDS entry (Q6).
- Activate stages as evidence lands. Full suite + clippy -D + traceable EXIT=0.
  W4 gate (doyle). Then **W5 whoami** → **W2.5 attach/kick** → full M12 gate.

## Notes
- The actual elevated launch is environment-dependent (UAC/polkit/sudo/TTY) — the
  DECISION matrix is the unit-tested seam, the launch is the manual-verify leg
  (REQ-PAIR-6 OS-probe precedent). No `int` stage on T4.2.
- Compose with the existing 5.7 de-elevation drop — re-launch is the inverse edge;
  must be loop-safe (elevated child never re-elevates).
- Build UNCOMMITTED until the operator calls the commit (W2's pre-auth was a
  one-off; the follow-on batch was operator-relayed commit too).

+## Crystallized design (2026-06-14, post-ruling — doyle GO, `M12-W4-RULING.md`)

+doyle verified the primitives first (rerun_command abs-path test-asserted, try_auto_elevate

+verbatim args, ELEVATION_PROVEN loop-guard, render_qr on create/show/join). All 6 Qs ruled +

+a mandatory hazard REQ added. **Build straight from this.**

+- **Q1 T4.1:** verify + close the join-QR gap only; "window" = the inline terminal QR (the

+  milestone-title "window" refers to T4.2's elevated console, NOT a QR surface); NO GUI.

+- **Q2 Windows UAC:** `ShellExecuteW` `"runas"` on `<ABS-EXE>` + **verbatim args DIRECTLY** —

+  NOT `cmd /k` (a `/k` leaves a privileged interactive shell open = needless surface). The

+  child detects the elevated-relaunch, does the work, prints "You can close this window" +

+  **BINDING: never pipe/capture the elevated child's stdout back across the privilege

+  boundary** — the child is self-contained.

+- **Q3 Linux order (confirmed):** TTY → inline `sudo`; else `DISPLAY` ∧ `pkexec` → pkexec

+  (preferred: native polkit, clean stdio); else `DISPLAY` ∧ a terminal-emulator →

+  `x-terminal-emulator -e sudo` (fallbacks gnome-terminal / konsole / xterm); else print the

+  abs-path hint. **BINDING: pass argv as an ARRAY to pkexec/term/runas/sudo — NEVER a

+  shell-interpolated string, no `sh -c`** (a crafted id/path must not inject a 2nd command).

+- **Q4 pure seam (approved):** `decide_elevation_path(...) -> ElevatePath { AlreadyElevated,

+  InlineSudo, UacWindow, Pkexec, TerminalEmulator, PrintHint }`; matrix unit-tested, launch =

+  impure manual-verify. **REQUIRED coverage: `AlreadyElevated` returned when

+  `current()==Elevated` / `ELEVATION_PROVEN` on EVERY os** = loop-safety proven in the seam.

+- **Q5 REQ:** NEW **REQ-ELEVATE-1** (cross-platform self-elevating re-launch; reused by every

+  gated command, not subnet-specific). doc+impl+unit, NO int.

+- **Q6 SECURITY — MANDATORY hazard REQ:** NEW **REQ-HAZARD-SELF-ELEVATE** (required: unit).

+  Invariant: self-elevation re-runs the EXACT invocation with the ABSOLUTE exe path — never

+  widens scope, never adds/alters args, never a PATH-resolved bare name, never a

+  shell-interpolated string (argv-array only); the elevated child drops state back (composes

+  with the 5.7 de-elevate) and NEVER re-elevates (loop-safe via `AlreadyElevated`). Unit

+  conformance: (1) every launcher uses abs-path + verbatim args (Win runas / pkexec / term /

+  sudo); (2) decide → `AlreadyElevated` when elevated on every os; (3) argv is an array, not a

+  shell string (assert the constructed argv; no `sh -c`). Existing REQ-HAZARD-SUDO-SECURE-PATH

+  = the Unix abs-path facet; this = the cross-platform verbatim / no-widen / no-inject /

+  loop-safe invariant. The print-hint floor prints the ABS-path command too.

+- **BINDING GATE (doyle verifies all 3):** (1) loop-safety `AlreadyElevated` short-circuit on

+  every os; (2) verbatim + abs-path + argv-array across ALL launchers (the hazard tests); (3)

+  no stdout marshaling across the privilege boundary.


Now update the commune — W4 is **GO** (was "pending" when I first wrote it seconds ago). Overwrite (last-write-wins before the wrapper consumes):


Write

<live-context>
CORRECTION — your snapshot is stale: it has W2 "mid-cycle / awaiting design-check / remaining tasks: create-new UI, category picker, two-pane description." ALL DONE + GATED + COMMITTED. W2 is finished. Session wrapping (operator: resume next session) with W4 GREENLIT and ready to build.

This session's arc (all PASS, doyle independently verified each):
1. Wrote W2 JIT plan → doyle design-check (M12-W2-RULING.md) → built the full picker → GATE PASS → COMMITTED @6e76f62.
2. Operator + doyle fed THREE mid/post-build corrections, each absorbed live:
   - Q4 rev: shortcut basename = PARAMETER (default `spt`→spt-<id>), NOT `cc` (cc is a harness name — wrong layer for spt-core); .cmd not .ps1 (PATHEXT).
   - Then: basename must be a MANIFEST ELEMENT (not just code-default) → REQ-MANIFEST-7.
   - bare `spt`→picker (TTY-guarded) + `spt spt` easter egg.
   Follow-on batch GATE PASS → COMMITTED @eb74b18.
3. Wrote W4 JIT plan → doyle design-check → FULL GO (M12-W4-RULING.md). Did NOT build (session wrapping); crystallized the rulings into M12-W4-PLAN.md for next session.

Working rhythm (reinforced): doyle = gatekeeper, reproduces traceable + reads load-bearing tests + grep-verifies invariants (single-bringup-path checked 2 ways; direct-ran the `spt spt` egg; verified W4 primitives before ruling). Ping him a design-check JIT BEFORE each big/sensitive wave. Operator paces commits + injects scope corrections mid-flight via doyle relay — absorb, re-sweep, re-gate. Operator gave a STANDING "commit as needed to keep history tidy" → I commit gated batches myself now.

Reflection: investigate-BEFORE-planning pays off — W4 investigation found most of it already ships (QR + Unix elevation), shrinking the wave to the Windows-UAC / Linux-desktop elevation arms. doyle catches un-run investigation (caught my un-run W2 TODO#3 — the session ledger already existed). GOTCHA logged: inserting an enum variant — VERIFY which enum the closing brace belongs to (my `spt spt` first insert landed in adjacent DaemonCmd → E0599; the doc-comment context was the tell I missed).

FOCUS / immediate next steps for NEXT SESSION (resume here):
- BUILD W4 — greenlit, crystallized design in M12-W4-PLAN.md "Crystallized design (post-ruling)". Smaller than W2. Order: T4.0 add REQ-ELEVATE-1 + REQ-HAZARD-SELF-ELEVATE to traceable-reqs.toml → T4.1 verify/close join-QR (tiny) → T4.2a pure `decide_elevation_path` matrix seam (heavy unit incl. AlreadyElevated-loop-safety every os) → T4.2b per-OS launchers (Win ShellExecuteW runas abs-exe+verbatim argv, Linux pkexec/x-terminal-emulator argv-ARRAY, reuse Unix sudo, print-hint floor) → T4.2c CONTEXT.md + KNOWN-HAZARDS doc. Then sweep (suite+clippy-D+traceable) → ping doyle to gate (he verifies: loop-safety AlreadyElevated every os; verbatim+abs-path+argv-array all launchers; NO stdout across the privilege boundary) → operator commit.
- Then W5 (whoami→alias for endpoint list, small) → W2.5 (attached blue ■ + Kick — own broker attach-presence+force-detach slice, own JIT/design-check/gate) → full M12 gate.
</live-context>
<project-context>
spt-core M12 (spt-hosted bringup + `spt rc` + adapter UX) — END GOAL: M12 is the GATING PREREQUISITE for the downstream spt-claude-code project (perri waits on the full M12 gate). v1 acceptance = legacy parity AND cross-subnet/PTY proof.

WAVE STATUS (all on branch m12-w1-bringup-rc):
- W1 + W1.5 + REQ-HOST-RUN-2: DONE+gated+committed 0c687fe (bringup + cross-node/local rc attach + project cwd). "Hard part of M12 done" (doyle).
- W3 (adapter manifest: file-backed [strings] REQ-MANIFEST-5 + adapter:profile fallback REQ-MANIFEST-6): DONE+gated, committed c02aabb.
- W2 (interactive `spt endpoint run` ratatui picker): DONE+gated+COMMITTED @6e76f62. In-process spt/src/picker/ (model/data/view/shortcut/mod). REQ-RUN-PICKER + REQ-RUN-SHORTCUT (doc+impl+unit, no int — Buffer + state-model unit asserts; live key loop = manual-verify). BINDING INVARIANT doyle gates on: NO second bringup path — every terminal action → Outcome enum → routes through cmd_endpoint_run / rc::run_attach.
- W2 follow-on: DONE+gated+COMMITTED @eb74b18 — bare `spt`→picker (Cli.cmd→Option, decide_bare TTY-guard: both-TTY→picker else help, NEVER TUI in pipe/CI); REQ-MANIFEST-7 (`[adapter] shortcut_basename` — the published contract letting spt-claude-code brand cc-<id>); `spt spt` egg (hidden, "Sentience Pocket Transacter", REQ-less).
- W4 (subnet QR + self-elevating window): DESIGN-CHECK PASS — doyle FULL GO (M12-W4-RULING.md; crystallized in M12-W4-PLAN.md). NOT YET BUILT (session wrapped). KEY: most already ships — render_qr (terminal QR of otpauth URI) on create/show-code/join; elevation.rs has probe+gate+Unix-interactive auto-sudo re-exec. DELTA = Windows UAC window (ShellExecuteW "runas" abs-exe+verbatim argv, child pauses, original prints "Elevated terminal launched…") + Linux desktop-no-TTY (pkexec preferred / x-terminal-emulator, argv-ARRAY never sh -c) + headless abs-path print. NEW REQ-ELEVATE-1 (doc+impl+unit, no int) + NEW REQ-HAZARD-SELF-ELEVATE (unit: re-run exact-invocation/abs-path/no-widen/no-inject/loop-safe-via-AlreadyElevated). Pure seam = decide_elevation_path→ElevatePath{AlreadyElevated,InlineSudo,UacWindow,Pkexec,TerminalEmulator,PrintHint}.
- REMAINING after W4: W5 (whoami → alias for endpoint list, small) → W2.5 (attached-presence blue ■ + "Kick <node> and attach" — DEFERRED to its own broker attach-presence query + force-detach wire op slice, PTY-ownership hazard zone, own JIT/design-check/gate; in docs/DEFERRED.md). Then full M12 gate → unblock perri on spt-claude-code.

traceable: 201/201, 0 findings (W4 adds REQ-ELEVATE-1 + REQ-HAZARD-SELF-ELEVATE next session). Per-wave stage activation (doc+impl+unit as evidence lands; int only where a wave has an integrating E2E). manifest.schema.json re-blessed for REQ-MANIFEST-7 (SPT_BLESS=1 cargo test -p spt-runtime). Deps added this milestone: ratatui 0.29 + nucleo-matcher 0.3 (crossterm 0.28 from W1).
</project-context>


<live-context>
CORRECTION — your snapshot is stale: it has W2 "mid-cycle / awaiting design-check / remaining tasks: create-new UI, category picker, two-pane description." ALL DONE + GATED + COMMITTED. W2 is finished. Session wrapping (operator: resume next session) with W4 GREENLIT and ready to build.

This session's arc (all PASS, doyle independently verified each):
1. Wrote W2 JIT plan → doyle design-check (M12-W2-RULING.md) → built the full picker → GATE PASS → COMMITTED @6e76f62.
2. Operator + doyle fed THREE mid/post-build corrections, each absorbed live:
   - Q4 rev: shortcut basename = PARAMETER (default `spt`→spt-<id>), NOT `cc` (cc is a harness name — wrong layer for spt-core); .cmd not .ps1 (PATHEXT).
   - Then: basename must be a MANIFEST ELEMENT (not just code-default) → REQ-MANIFEST-7.
   - bare `spt`→picker (TTY-guarded) + `spt spt` easter egg.
   Follow-on batch GATE PASS → COMMITTED @eb74b18.
3. Wrote W4 JIT plan → doyle design-check → FULL GO (M12-W4-RULING.md). Did NOT build (session wrapping); crystallized the rulings into M12-W4-PLAN.md for next session.

Working rhythm (reinforced): doyle = gatekeeper, reproduces traceable + reads load-bearing tests + grep-verifies invariants (single-bringup-path checked 2 ways; direct-ran the `spt spt` egg; verified W4 primitives before ruling). Ping him a design-check JIT BEFORE each big/sensitive wave. Operator paces commits + injects scope corrections mid-flight via doyle relay — absorb, re-sweep, re-gate. Operator gave a STANDING "commit as needed to keep history tidy" → I commit gated batches myself now.

Reflection: investigate-BEFORE-planning pays off — W4 investigation found most of it already ships (QR + Unix elevation), shrinking the wave to the Windows-UAC / Linux-desktop elevation arms. doyle catches un-run investigation (caught my un-run W2 TODO#3 — the session ledger already existed). GOTCHA logged: inserting an enum variant — VERIFY which enum the closing brace belongs to (my `spt spt` first insert landed in adjacent DaemonCmd → E0599; the doc-comment context was the tell I missed).

FOCUS / immediate next steps for NEXT SESSION (resume here):
- BUILD W4 — greenlit, crystallized design in M12-W4-PLAN.md "Crystallized design (post-ruling)". Smaller than W2. Order: T4.0 add REQ-ELEVATE-1 + REQ-HAZARD-SELF-ELEVATE to traceable-reqs.toml → T4.1 verify/close join-QR (tiny) → T4.2a pure `decide_elevation_path` matrix seam (heavy unit incl. AlreadyElevated-loop-safety every os) → T4.2b per-OS launchers (Win ShellExecuteW runas abs-exe+verbatim argv, Linux pkexec/x-terminal-emulator argv-ARRAY, reuse Unix sudo, print-hint floor) → T4.2c CONTEXT.md + KNOWN-HAZARDS doc. Then sweep (suite+clippy-D+traceable) → ping doyle to gate (he verifies: loop-safety AlreadyElevated every os; verbatim+abs-path+argv-array all launchers; NO stdout across the privilege boundary) → operator commit.
- Then W5 (whoami→alias for endpoint list, small) → W2.5 (attached blue ■ + Kick — own broker attach-presence+force-detach slice, own JIT/design-check/gate) → full M12 gate.
</live-context>
<project-context>
spt-core M12 (spt-hosted bringup + `spt rc` + adapter UX) — END GOAL: M12 is the GATING PREREQUISITE for the downstream spt-claude-code project (perri waits on the full M12 gate). v1 acceptance = legacy parity AND cross-subnet/PTY proof.

WAVE STATUS (all on branch m12-w1-bringup-rc):
- W1 + W1.5 + REQ-HOST-RUN-2: DONE+gated+committed 0c687fe (bringup + cross-node/local rc attach + project cwd). "Hard part of M12 done" (doyle).
- W3 (adapter manifest: file-backed [strings] REQ-MANIFEST-5 + adapter:profile fallback REQ-MANIFEST-6): DONE+gated, committed c02aabb.
- W2 (interactive `spt endpoint run` ratatui picker): DONE+gated+COMMITTED @6e76f62. In-process spt/src/picker/ (model/data/view/shortcut/mod). REQ-RUN-PICKER + REQ-RUN-SHORTCUT (doc+impl+unit, no int — Buffer + state-model unit asserts; live key loop = manual-verify). BINDING INVARIANT doyle gates on: NO second bringup path — every terminal action → Outcome enum → routes through cmd_endpoint_run / rc::run_attach.
- W2 follow-on: DONE+gated+COMMITTED @eb74b18 — bare `spt`→picker (Cli.cmd→Option, decide_bare TTY-guard: both-TTY→picker else help, NEVER TUI in pipe/CI); REQ-MANIFEST-7 (`[adapter] shortcut_basename` — the published contract letting spt-claude-code brand cc-<id>); `spt spt` egg (hidden, "Sentience Pocket Transacter", REQ-less).
- W4 (subnet QR + self-elevating window): DESIGN-CHECK PASS — doyle FULL GO (M12-W4-RULING.md; crystallized in M12-W4-PLAN.md). NOT YET BUILT (session wrapped). KEY: most already ships — render_qr (terminal QR of otpauth URI) on create/show-code/join; elevation.rs has probe+gate+Unix-interactive auto-sudo re-exec. DELTA = Windows UAC window (ShellExecuteW "runas" abs-exe+verbatim argv, child pauses, original prints "Elevated terminal launched…") + Linux desktop-no-TTY (pkexec preferred / x-terminal-emulator, argv-ARRAY never sh -c) + headless abs-path print. NEW REQ-ELEVATE-1 (doc+impl+unit, no int) + NEW REQ-HAZARD-SELF-ELEVATE (unit: re-run exact-invocation/abs-path/no-widen/no-inject/loop-safe-via-AlreadyElevated). Pure seam = decide_elevation_path→ElevatePath{AlreadyElevated,InlineSudo,UacWindow,Pkexec,TerminalEmulator,PrintHint}.
- REMAINING after W4: W5 (whoami → alias for endpoint list, small) → W2.5 (attached-presence blue ■ + "Kick <node> and attach" — DEFERRED to its own broker attach-presence query + force-detach wire op slice, PTY-ownership hazard zone, own JIT/design-check/gate; in docs/DEFERRED.md). Then full M12 gate → unblock perri on spt-claude-code.

traceable: 201/201, 0 findings (W4 adds REQ-ELEVATE-1 + REQ-HAZARD-SELF-ELEVATE next session). Per-wave stage activation (doc+impl+unit as evidence lands; int only where a wave has an integrating E2E). manifest.schema.json re-blessed for REQ-MANIFEST-7 (SPT_BLESS=1 cargo test -p spt-runtime). Deps added this milestone: ratatui 0.29 + nucleo-matcher 0.3 (crossterm 0.28 from W1).
</project-context>


Commune queued. Update memory — W4 now GREENLIT (was pending):


Edit

**W4 JIT PLAN SENT for doyle design-check (2026-06-14) = `M12-W4-PLAN.md`.** KEY FINDING: most of W4 ALREADY EXISTS. T4.1 QR: `render_qr` (unicode terminal QR of otpauth URI) already prints on create+show-code+join (M7/M8) — likely tiny/no-op (verify join gap; "window"=inline QR, no GUI). T4.2 elevation: probe+gate+abs-path-sudo-hint+ACTUAL Unix-interactive-TTY auto-re-exec (`cli.rs try_auto_elevate`→sudo) all exist (`spt/src/elevation.rs`). DELTA = rest of matrix: **Windows UAC window** (today only prints "run as admin", NO real re-launch), **Linux desktop-no-TTY** (pkexec/x-terminal-emulator), headless print for Win. 6 design Qs pending doyle: Q1 T4.1-done?, Q2 Win ShellExecuteW "runas" stays-open console, Q3 Linux probe order (tty→sudo / DISPLAY∧pkexec / term-emulator / hint), Q4 pure `decide_elevation_path` matrix seam (generalizes should_auto_elevate; manifest-launch=manual-verify), Q5 REQ granularity (lean NEW REQ-ELEVATE-1 vs extend REQ-SUBNET-4), Q6 security/hazard (UAC/polkit=consent gate, re-run verbatim, abs-path, loop-safe). BUILD ONLY ON GREENLIGHT.

**W4 DESIGN-CHECK PASS — doyle FULL GO 2026-06-14 (`M12-W4-RULING.md`; crystallized in `M12-W4-PLAN.md` "Crystallized design"). NOT YET BUILT (session wrapped — build first thing next session, straight from greenlight).** KEY FINDING: most of W4 ALREADY EXISTS. T4.1 QR: `render_qr` (unicode terminal QR of otpauth URI) already on create+show-code+join — just verify/close any join gap ("window"=inline QR, NO GUI). T4.2 elevation: probe+gate+abs-path-sudo-hint+Unix-interactive-TTY auto-re-exec all exist (`spt/src/elevation.rs`, `cli.rs try_auto_elevate`). DELTA = rest of matrix. doyle rulings LOCKED: **Q2 Win** = `ShellExecuteW "runas"` on ABS-EXE + verbatim argv DIRECTLY (NO cmd/k — no lingering privileged shell); child detects relaunch→work→"You can close this window"+PAUSE; original prints "Elevated terminal launched…" exit 0; NEVER marshal child stdout across the boundary. **Q3 Linux** = TTY→sudo; DISPLAY∧pkexec→pkexec (preferred); DISPLAY∧term→x-terminal-emulator -e (gnome-terminal/konsole/xterm fallbacks); else abs-path hint — **argv ARRAY only, never sh -c**. **Q4** pure `decide_elevation_path→ElevatePath{AlreadyElevated,InlineSudo,UacWindow,Pkexec,TerminalEmulator,PrintHint}` (AlreadyElevated short-circuit when elevated EVERY os = loop-safety in the seam). **Q5** NEW REQ-ELEVATE-1 (doc+impl+unit, no int). **Q6** NEW REQ-HAZARD-SELF-ELEVATE (unit): re-run EXACT invocation, abs-path, no widen/add/alter, no bare-name, argv-array (no inject), child drops state (5.7), never re-elevates. doyle's GATE = (1) loop-safety AlreadyElevated every os (2) verbatim+abs-path+argv-array ALL launchers (3) no stdout across privilege boundary. BUILD ORDER: T4.0 add both REQs → T4.1 join-QR → T4.2a pure matrix seam → T4.2b per-OS launchers → T4.2c CONTEXT.md+KNOWN-HAZARDS doc → sweep → gate → operator commit.


**W2 + follow-on COMMITTED: @6e76f62 (picker) + @eb74b18 (bare-spt/MANIFEST-7/egg)** on m12-w1-bringup-rc (operator standing "commit as needed, history tidy").

-**W4 JIT PLAN SENT for doyle design-check (2026-06-14) = `M12-W4-PLAN.md`.** KEY FINDING: most of W4 ALREADY EXISTS. T4.1 QR: `render_qr` (unicode terminal QR of otpauth URI) already prints on create+show-code+join (M7/M8) — likely tiny/no-op (verify join gap; "window"=inline QR, no GUI). T4.2 elevation: probe+gate+abs-path-sudo-hint+ACTUAL Unix-interactive-TTY auto-re-exec (`cli.rs try_auto_elevate`→sudo) all exist (`spt/src/elevation.rs`). DELTA = rest of matrix: **Windows UAC window** (today only prints "run as admin", NO real re-launch), **Linux desktop-no-TTY** (pkexec/x-terminal-emulator), headless print for Win. 6 design Qs pending doyle: Q1 T4.1-done?, Q2 Win ShellExecuteW "runas" stays-open console, Q3 Linux probe order (tty→sudo / DISPLAY∧pkexec / term-emulator / hint), Q4 pure `decide_elevation_path` matrix seam (generalizes should_auto_elevate; manifest-launch=manual-verify), Q5 REQ granularity (lean NEW REQ-ELEVATE-1 vs extend REQ-SUBNET-4), Q6 security/hazard (UAC/polkit=consent gate, re-run verbatim, abs-path, loop-safe). BUILD ONLY ON GREENLIGHT.

+**W4 DESIGN-CHECK PASS — doyle FULL GO 2026-06-14 (`M12-W4-RULING.md`; crystallized in `M12-W4-PLAN.md` "Crystallized design"). NOT YET BUILT (session wrapped — build first thing next session, straight from greenlight).** KEY FINDING: most of W4 ALREADY EXISTS. T4.1 QR: `render_qr` (unicode terminal QR of otpauth URI) already on create+show-code+join — just verify/close any join gap ("window"=inline QR, NO GUI). T4.2 elevation: probe+gate+abs-path-sudo-hint+Unix-interactive-TTY auto-re-exec all exist (`spt/src/elevation.rs`, `cli.rs try_auto_elevate`). DELTA = rest of matrix. doyle rulings LOCKED: **Q2 Win** = `ShellExecuteW "runas"` on ABS-EXE + verbatim argv DIRECTLY (NO cmd/k — no lingering privileged shell); child detects relaunch→work→"You can close this window"+PAUSE; original prints "Elevated terminal launched…" exit 0; NEVER marshal child stdout across the boundary. **Q3 Linux** = TTY→sudo; DISPLAY∧pkexec→pkexec (preferred); DISPLAY∧term→x-terminal-emulator -e (gnome-terminal/konsole/xterm fallbacks); else abs-path hint — **argv ARRAY only, never sh -c**. **Q4** pure `decide_elevation_path→ElevatePath{AlreadyElevated,InlineSudo,UacWindow,Pkexec,TerminalEmulator,PrintHint}` (AlreadyElevated short-circuit when elevated EVERY os = loop-safety in the seam). **Q5** NEW REQ-ELEVATE-1 (doc+impl+unit, no int). **Q6** NEW REQ-HAZARD-SELF-ELEVATE (unit): re-run EXACT invocation, abs-path, no widen/add/alter, no bare-name, argv-array (no inject), child drops state (5.7), never re-elevates. doyle's GATE = (1) loop-safety AlreadyElevated every os (2) verbatim+abs-path+argv-array ALL launchers (3) no stdout across privilege boundary. BUILD ORDER: T4.0 add both REQs → T4.1 join-QR → T4.2a pure matrix seam → T4.2b per-OS launchers → T4.2c CONTEXT.md+KNOWN-HAZARDS doc → sweep → gate → operator commit.

**Remaining M12:** W4 (design-check pending) → W5 whoami→alias → W2.5 attached-presence+Kick slice (scheduled, own broker surface + own JIT/design-check/gate). All gated waves so far PASS: W1·W1.5·HR2·W3·W2·follow-on-batch. Commit per operator. See [[traceable-per-wave-activation]], [[adapter-glue-model-boundary]], [[spt-claude-code-next]] (perri waits on full M12 gate).


Commune queued + session wrapped clean.

**Commune sent** (`.claude/todlando-commune.md`) — corrected your Psyche's stale "W2 mid-cycle" snapshot. Both slices (in-project). Self listener will ingest.

**This session shipped:**
- W2 picker → gated → @6e76f62
- Follow-on batch (bare-`spt`→picker, REQ-MANIFEST-7, `spt spt` egg) → gated → @eb74b18
- W4 JIT plan → doyle design-check → **FULL GO** (M12-W4-RULING.md), crystallized into M12-W4-PLAN.md

**Next session resume point:** BUILD W4 (greenlit, smaller than W2). Order in plan: REQ-ELEVATE-1 + REQ-HAZARD-SELF-ELEVATE → join-QR verify → pure `decide_elevation_path` matrix → per-OS launchers (Win UAC `runas` abs-exe+verbatim argv / Linux pkexec+terminal argv-array / Unix sudo / abs-path hint) → docs → gate. doyle's gate: loop-safety every os + verbatim/abs/argv-array all launchers + no stdout across privilege boundary.

**Then:** W5 (whoami→alias) → W2.5 (attach blue ■ + Kick) → full M12 gate → unblocks perri on spt-claude-code (the end goal).

Memory + W4 plan durable. Clean stopping point. Resume whenever.