{ "schemaVersion": 1, "summary": { "requirementCount": 926, "completeCount": 926, "incompleteCount": 0, "findingCount": 0 }, "requirements": [ { "id": "REQ-ACCESS-RETIRED-VERB-REFUSAL", "title": "A RETIRED SUBCOMMAND OF `spt endpoint access` REFUSES BY NAME RATHER THAN FALLING THROUGH ITS OWN OPTIONAL POSITIONAL AND ANSWERING PLAUSIBLY. `access` takes an optional endpoint id positionally, so once `list` and `rules` stopped being subcommands (retired when the roster views replaced them) clap handed those tokens to the POSITIONAL, and the view reported `no access entities ruled for 'list'` at exit 0 -- a well-formed, confident report about an entity nobody has ever created. Found by flynn in the v0.49.0 field verify (releases#67). THE DEFECT IS NOT A MISSING ERROR MESSAGE, IT IS AN ANSWER: the sentence is TRUE of any name nobody has ruled, so it is indistinguishable from the real result for a real endpoint, and an operator or agent s… "requiredStages": [ "impl", "unit" ], "stages": { "doc": { "complete": false, "evidence": [] }, "impl": { "complete": true, "evidence": [ { "path": "crates/spt/src/cli.rs", "line": 20615 }, { "path": "crates/spt/src/cli.rs", "line": 20635 }, { "path": "crates/spt/src/cli.rs", "line": 20646 }, { "path": "crates/spt/src/cli.rs", "line": 20670 } ] }, "int": { "complete": false, "evidence": [] }, "unit": { "complete": true, "evidence": [ { "path": "crates/spt/src/cli.rs", "line": 36193 }, { "path": "crates/spt/src/cli.rs", "line": 36227 }, { "path": "crates/spt/src/cli.rs", "line": 36273 } ] } } }, { "id": "REQ-ACCESS-VERDICT-REASON", "title": "The endpoint access gate reports WHY a pass passed, not merely THAT it passed: the gate's verdict carries, on its allow arm, the reason the chain admitted the interaction — the same-node short-circuit, the reply exemption, an entry whose subject NAMED the peer (a proven sender endpoint or the origin node), an entry that matched only by SUBNET WILDCARD (an entry, but one that never named this peer), or a posture pass (an endpoint / node / captured-subnet mode, or the implicit-open bottom of the chain). The reason is computed AT THE GATE, in the one place that holds the whole chain, and travels with the decision. The alternative — a downstream consumer re-deriving it — means RE-OPENING the access store after the gate has closed it, whi… "requiredStages": [ "impl", "unit" ], "stages": { "doc": { "complete": false, "evidence": [] }, "impl": { "complete": true, "evidence": [ { "path": "crates/spt-store/src/gate.rs", "line": 103 }, { "path": "crates/spt-store/src/gate.rs", "line": 109 }, { "path": "crates/spt-store/src/gate.rs", "line": 116 }, { "path": "crates/spt-store/src/gate.rs", "line": 131 }, { "path": "crates/spt-store/src/gate.rs", "line": 355 } ] }, "int": { "complete": false, "evidence": [] }, "unit": { "complete": true, "evidence": [ { "path": "crates/spt-daemon/src/access.rs", "line": 994 }, { "path": "crates/spt-daemon/src/access.rs", "line": 1127 } ] } } }, { "id": "REQ-ACL-ACCESS-REFRESH-ER-ONLY", "title": "spt api access-refresh stops refusing and becomes real, gated to the engine room, updating ONLY the node's captured subnet-level fallbacks (ADR-0052 decision 6; the W2 refusal REQ-ACL-ACCESS-REFRESH-VERB was minted precisely so this wave changes one behavior rather than adding a surface and its gate). The refresh is the CONSENTED half of advisory gossip: a subnet-mode change reaches a member as a notification, the engine room is briefed with the exact new posture, and a human decides whether this node adopts it — which is why the verb writes the captured fallbacks and never the node's own rules, and why no remote actor can invoke it. Its authentication is the same shared engine-room function empower uses. The W2 refusal test is repinned … "requiredStages": [ "doc", "impl", "unit" ], "stages": { "doc": { "complete": true, "evidence": [ { "path": "docs/adr/0052-engine-room-endpoint-empower.md", "line": 384 } ] }, "impl": { "complete": true, "evidence": [ { "path": "crates/spt-store/src/briefing.rs", "line": 558 }, { "path": "crates/spt-store/src/subnet.rs", "line": 417 }, { "path": "crates/spt/src/api/engineroom.rs", "line": 66 }, { "path": "crates/spt/src/api/engineroom.rs", "line": 83 }, { "path": "crates/spt/src/api/engineroom.rs", "line": 441 }, { "path": "crates/spt/src/api/engineroom.rs", "line": 456 }, { "path": "crates/spt/src/api/engineroom.rs", "line": 548 }, { "path": "crates/spt/src/api/mod.rs", "line": 337 } ] }, "int": { "complete": false, "evidence": [] }, "unit": { "complete": true, "evidence": [ { "path": "crates/spt-store/src/subnet.rs", "line": 611 }, { "path": "crates/spt/src/api/engineroom.rs", "line": 848 }, { "path": "crates/spt/src/api/engineroom.rs", "line": 1019 }, { "path": "crates/spt/src/api/mod.rs", "line": 1255 } ] } } }, { "id": "REQ-ACL-ACCESS-REFRESH-VERB", "title": "`spt api access-refresh` is MINTED THIS WAVE BUT REFUSES — the verb exists, parses and is documented, and its refusal names why: the capture-refresh is engine-room-only, and engine-room enforcement (ADR-0052) does not land until W3. Minting the refusing verb now is deliberate: it fixes the contract adapters and the engine-room brief will be built against, and it makes the wave that implements enforcement a change to ONE behavior rather than a new surface plus its gate. A refusal that merely says 'unknown command' would invite an adapter to route around it. When it does light up it updates ONLY the node's captured subnet-level fallbacks — never the node's own rules, which are the operator's, not the subnet's. Gate: doc — the CONTEXT.m… "requiredStages": [ "doc", "impl", "unit" ], "stages": { "doc": { "complete": true, "evidence": [ { "path": "CONTEXT.md", "line": 947 } ] }, "impl": { "complete": true, "evidence": [ { "path": "crates/spt/src/api/mod.rs", "line": 336 } ] }, "int": { "complete": false, "evidence": [] }, "unit": { "complete": true, "evidence": [ { "path": "crates/spt/src/api/mod.rs", "line": 1255 } ] } } }, { "id": "REQ-ACL-DISCOVER-DEFAULT-ON", "title": "DISCOVER IS ON BY DEFAULT: a `closed` posture at ANY mode tier -- endpoint mode, node mode, or the join-time-captured subnet mode -- no longer implies a DISCOVER deny, and the ONLY thing that closes DISCOVER is a deny that NAMES it: an access rule row, or a `per_surface` mode entry (engine-room-set at the node tier). Operator-ruled 2026-08-17 (releases#180/#181): being findable is what makes a knock -- the ask to be admitted -- possible at all, so a node that closed its posture to say 'do not talk to me' had also silently said 'and you may not ask', which was never the choice being made; the messaging-first majority pays for a discovery decision they never took. THE DEFAULT LIVES IN THE SURFACE VOCABULARY, NOT BESIDE THE CHAIN: the `surfac… "requiredStages": [ "doc", "impl", "unit", "int" ], "stages": { "doc": { "complete": true, "evidence": [ { "path": "CONTEXT.md", "line": 947 } ] }, "impl": { "complete": true, "evidence": [ { "path": "crates/spt-store/src/access.rs", "line": 192 }, { "path": "crates/spt-store/src/access.rs", "line": 206 }, { "path": "crates/spt-store/src/access.rs", "line": 342 }, { "path": "crates/spt-store/src/access.rs", "line": 352 }, { "path": "crates/spt-store/src/access.rs", "line": 369 }, { "path": "crates/spt-store/src/access.rs", "line": 400 }, { "path": "crates/spt-store/src/access.rs", "line": 833 }, { "path": "crates/spt-store/src/access.rs", "line": 1291 }, { "path": "crates/spt-store/src/access.rs", "line": 1786 }, { "path": "crates/spt-store/src/access.rs", "line": 1859 }, { "path": "crates/spt-store/src/access.rs", "line": 1902 }, { "path": "crates/spt-store/src/access.rs", "line": 1942 }, { "path": "crates/spt-store/src/erole.rs", "line": 154 }, { "path": "crates/spt/src/accessview.rs", "line": 90 }, { "path": "crates/spt/src/cli.rs", "line": 20203 }, { "path": "crates/spt/src/cli.rs", "line": 20237 }, { "path": "crates/spt/src/cli.rs", "line": 20260 }, { "path": "crates/spt/src/cli.rs", "line": 20277 } ] }, "int": { "complete": true, "evidence": [ { "path": "crates/spt-daemon/tests/twohost.rs", "line": 2666 }, { "path": "crates/spt-daemon/tests/twohost.rs", "line": 2689 }, { "path": "crates/spt-daemon/tests/twohost.rs", "line": 2713 } ] }, "unit": { "complete": true, "evidence": [ { "path": "crates/spt-daemon/src/access.rs", "line": 418 }, { "path": "crates/spt-daemon/src/access.rs", "line": 567 }, { "path": "crates/spt-daemon/src/access.rs", "line": 617 }, { "path": "crates/spt-daemon/src/pump/registry.rs", "line": 385 }, { "path": "crates/spt-store/src/access.rs", "line": 3206 }, { "path": "crates/spt-store/src/access.rs", "line": 3233 }, { "path": "crates/spt-store/src/access.rs", "line": 3281 }, { "path": "crates/spt-store/src/access.rs", "line": 3325 }, { "path": "crates/spt-store/src/access.rs", "line": 3348 }, { "path": "crates/spt-store/src/access.rs", "line": 3381 }, { "path": "crates/spt-store/src/access.rs", "line": 3425 }, { "path": "crates/spt-store/src/access.rs", "line": 4507 }, { "path": "crates/spt-store/src/access.rs", "line": 5241 }, { "path": "crates/spt/src/accessview.rs", "line": 469 }, { "path": "crates/spt/src/cli.rs", "line": 37027 }, { "path": "crates/spt/src/cli.rs", "line": 37126 } ] } } }, { "id": "REQ-ACL-DISCOVER-GATE", "title": "DISCOVER is a real gated surface: registry resolve/advertise and the resources blurb are filtered per viewer, so discovery leaks nothing a viewer could not reach. ADR-0009 NAMED this leg — 'discovery (resource advertisement) is gated by the first two gates' — and CONTEXT.md's resource-advertisement entry promises that an endpoint whose access rules exclude the viewer's node by naming DISCOVER in a deny never appears in that view; a legacy grant plus blanket-closed posture does not imply that exclusion because DISCOVER is default-on. Only the VISIBILITY half was ever built; the access half has been an unbuilt promise since M4. Un-gated discovery on a shared subnet is an inventory of every agent on every member node, including the ones a… "requiredStages": [ "doc", "impl", "unit" ], "stages": { "doc": { "complete": true, "evidence": [ { "path": "CONTEXT.md", "line": 862 } ] }, "impl": { "complete": true, "evidence": [ { "path": "crates/spt-daemon/src/access.rs", "line": 193 }, { "path": "crates/spt-daemon/src/access.rs", "line": 233 }, { "path": "crates/spt-daemon/src/pump/registry.rs", "line": 172 }, { "path": "crates/spt-daemon/src/pump/registry.rs", "line": 270 }, { "path": "crates/spt-daemon/src/pump/registry.rs", "line": 277 } ] }, "int": { "complete": false, "evidence": [] }, "unit": { "complete": true, "evidence": [ { "path": "crates/spt-daemon/src/access.rs", "line": 542 }, { "path": "crates/spt-daemon/src/access.rs", "line": 600 }, { "path": "crates/spt-daemon/src/pump/registry.rs", "line": 335 }, { "path": "crates/spt-daemon/src/pump/registry.rs", "line": 412 } ] } } }, { "id": "REQ-ACL-ER-DISCOVER-CONJUNCTION-NOTICE", "title": "AN ACCEPTED RULE THAT CANNOT CURRENTLY TAKE EFFECT SAYS SO: an endpoint-scoped access mutation naming the ENGINE ROOM is accepted and, when its `DISCOVER` half cannot presently disclose anything, the accept site prints a LOUD CONJUNCTION NOTICE naming the engine room's advertisement whitelist as the other lever and its current posture. Disclosure of the engine room is an AND across two records: `DiscoverGate` checks the ER advertisement filter BEFORE the access chain (REQ-ER-NOT-ADVERTISED, ratified and unchanged by this requirement), so a rule accepted against an empty whitelist discloses NOTHING while reading as policy in force. Field case: ENLYZEAM's sole `DISCOVER` allow was ER-scoped `any-of SPT_DEV` with an empty whitelist, and every… "requiredStages": [ "doc", "impl", "unit", "int" ], "stages": { "doc": { "complete": true, "evidence": [ { "path": "CONTEXT.md", "line": 953 } ] }, "impl": { "complete": true, "evidence": [ { "path": "crates/spt-store/src/access.rs", "line": 739 }, { "path": "crates/spt/src/cli.rs", "line": 16545 }, { "path": "crates/spt/src/cli.rs", "line": 16584 }, { "path": "crates/spt/src/cli.rs", "line": 16615 }, { "path": "crates/spt/src/cli.rs", "line": 16667 } ] }, "int": { "complete": true, "evidence": [ { "path": "crates/spt-daemon/tests/twohost.rs", "line": 2735 } ] }, "unit": { "complete": true, "evidence": [ { "path": "crates/spt/src/cli.rs", "line": 36850 }, { "path": "crates/spt/src/cli.rs", "line": 37087 } ] } } }, { "id": "REQ-ACL-FAIL-CLOSED", "title": "A corrupt or unreadable access store degrades CLOSED, loudly (ADR-0053 — an ADR-level flip of ADR-0009's deliberate fail-open ruling). ADR-0009 justified fail-open explicitly: the whitelist was 'a same-subnet convenience boundary layered inside subnet membership, not the system's outer wall', because every member node was the one user's own machine. The SHARED SUBNET ruling breaks that premise — member nodes now belong to different human operators and the access layer gates agents — and a boundary that evaporates when its store file corrupts is not a boundary an operator can reason about. So a store that CANNOT BE READ refuses unlisted-subject traffic on every surface rather than admitting it, and says so on the refusing node naming … "requiredStages": [ "doc", "impl", "unit" ], "stages": { "doc": { "complete": true, "evidence": [ { "path": "CONTEXT.md", "line": 947 } ] }, "impl": { "complete": true, "evidence": [ { "path": "crates/spt-daemon/src/access.rs", "line": 194 }, { "path": "crates/spt-store/src/access.rs", "line": 983 }, { "path": "crates/spt-store/src/access.rs", "line": 1549 }, { "path": "crates/spt-store/src/access.rs", "line": 1557 }, { "path": "crates/spt-store/src/access.rs", "line": 1608 } ] }, "int" […67374ln elided…] spt-daemon/src/servehost.rs", "line": 653 }, { "path": "crates/spt-daemon/src/servehost.rs", "line": 727 }, { "path": "crates/spt-daemon/src/servehost.rs", "line": 765 }, { "path": "crates/spt-daemon/src/webserve.rs", "line": 1051 }, { "path": "crates/spt-daemon/src/webserve.rs", "line": 1074 }, { "path": "crates/spt-daemon/src/webserve.rs", "line": 1097 }, { "path": "crates/spt-daemon/src/webserve.rs", "line": 1115 }, { "path": "crates/spt-daemon/src/webserve.rs", "line": 1145 }, { "path": "crates/spt-daemon/src/webserve.rs", "line": 1158 }, { "path": "crates/spt-daemon/src/webserve.rs", "line": 1198 }, { "path": "crates/spt-daemon/src/webserve.rs", "line": 1240 }, { "path": "crates/spt-runtime/src/registry.rs", "line": 939 }, { "path": "crates/spt-runtime/src/registry.rs", "line": 974 }, { "path": "crates/spt-store/src/serving.rs", "line": 896 }, { "path": "crates/spt-store/src/serving.rs", "line": 944 }, { "path": "crates/spt-store/src/serving.rs", "line": 962 }, { "path": "crates/spt-store/src/serving.rs", "line": 977 }, { "path": "crates/spt-store/src/serving.rs", "line": 993 }, { "path": "crates/spt-store/src/serving.rs", "line": 1014 }, { "path": "crates/spt-store/src/serving.rs", "line": 1037 }, { "path": "crates/spt-store/src/serving.rs", "line": 1051 }, { "path": "crates/spt-store/src/serving.rs", "line": 1065 }, { "path": "crates/spt-store/src/serving.rs", "line": 1080 }, { "path": "crates/spt-store/src/serving.rs", "line": 1100 }, { "path": "crates/spt-store/src/serving.rs", "line": 1134 }, { "path": "crates/spt-store/src/serving.rs", "line": 1143 }, { "path": "crates/spt-store/src/serving.rs", "line": 1157 }, { "path": "crates/spt-store/src/serving.rs", "line": 1179 }, { "path": "crates/spt-store/src/serving.rs", "line": 1201 }, { "path": "crates/spt-store/src/serving.rs", "line": 1220 }, { "path": "crates/spt/src/serveverb.rs", "line": 564 } ] } } }, { "id": "REQ-WEB-URL-BOUND-PORT", "title": "Served URLs use the running daemon's actually bound docs-listener port, not the caller's configuration or a default (releases#282, REMOTE-FRICTION #304). The broker exposes that bound port; serve listings, attachment links, docs URLs and fetch shorthand consume the same source. Config/env/default fallback is permitted only when no daemon runs. A running daemon with unavailable or unreported listener state must not mint a guessed URL. Daemon-starting producers resolve the port after startup. The rig-only ephemeral switch overrides fixed bind requests and minted URLs follow the resulting listener, never the co-resident fleet listener. Gate: a fixture daemon binds ephemerally despite conflicting client configuration, and generated URLs fetch … "requiredStages": [ "doc", "impl", "unit", "int" ], "stages": { "doc": { "complete": true, "evidence": [ { "path": "docs-site/src/serving/overview.md", "line": 29 } ] }, "impl": { "complete": true, "evidence": [ { "path": "crates/spt-daemon/src/docshost.rs", "line": 32 }, { "path": "crates/spt-daemon/src/docshost.rs", "line": 520 }, { "path": "crates/spt-daemon/src/servehost.rs", "line": 69 }, { "path": "crates/spt-daemon/src/servehost.rs", "line": 104 }, { "path": "crates/spt-daemon/src/servehost.rs", "line": 135 }, { "path": "crates/spt-daemon/src/servehost.rs", "line": 361 }, { "path": "crates/spt-daemon/src/servehost.rs", "line": 372 }, { "path": "crates/spt-daemon/src/webproxy.rs", "line": 521 }, { "path": "crates/spt/src/cli.rs", "line": 10095 }, { "path": "crates/spt/src/serveverb.rs", "line": 76 }, { "path": "crates/spt/src/serveverb.rs", "line": 101 } ] }, "int": { "complete": true, "evidence": [ { "path": "crates/spt-daemon/tests/docs_server_e2e.rs", "line": 69 }, { "path": "crates/spt-daemon/tests/docs_server_e2e.rs", "line": 95 }, { "path": "crates/spt-daemon/tests/twohost_web.rs", "line": 733 }, { "path": "crates/spt/tests/webserve_cross_node_e2e.rs", "line": 324 }, { "path": "crates/spt/tests/webserve_cross_node_e2e.rs", "line": 722 } ] }, "unit": { "complete": true, "evidence": [ { "path": "crates/spt-daemon/src/docshost.rs", "line": 642 } ] } } }, { "id": "REQ-WEB-URL-NODE-PREFIX", "title": "Every served resource uses the same node-prefixed path locally and across the subnet (ADR-0056, releases#272/#249; node-root behavior amended by releases#301). Bare / redirects with HTTP 302 to //. A node root // redirects with HTTP 302 to //docs/, preserving query parameters, for local and remote nodes. The browser registry index and its ?json twin are retired; spt serve list remains the exposure audit. Node and facet precedence, exact docs root-file exceptions, byte-true docs compatibility aliases, directory redirects, and owner-side proxy authorization remain unchanged. Facets f/, docs/, a/, m/, bin/ and install remain distinct; unknown or unavailable facets never fall through to registry names. Scheme is plain h… "requiredStages": [ "doc", "impl", "unit", "int" ], "stages": { "doc": { "complete": true, "evidence": [ { "path": "docs-site/src/harness-contract/manifest.md", "line": 83 }, { "path": "docs-site/src/serving/overview.md", "line": 13 }, { "path": "docs/MANIFEST.md", "line": 93 }, { "path": "docs/adr/0056-node-prefixed-url-namespace.md", "line": 92 } ] }, "impl": { "complete": true, "evidence": [ { "path": "crates/spt-daemon/src/daemon.rs", "line": 276 }, { "path": "crates/spt-daemon/src/docshost.rs", "line": 127 }, { "path": "crates/spt-daemon/src/docshost.rs", "line": 479 }, { "path": "crates/spt-daemon/src/pairhost.rs", "line": 928 }, { "path": "crates/spt-daemon/src/pairhost.rs", "line": 954 }, { "path": "crates/spt-daemon/src/webserve.rs", "line": 698 }, { "path": "crates/spt-daemon/src/webserve.rs", "line": 714 }, { "path": "crates/spt-store/src/hostlabel.rs", "line": 14 }, { "path": "crates/spt-store/src/serving.rs", "line": 712 }, { "path": "crates/spt-store/src/serving.rs", "line": 745 }, { "path": "crates/spt-store/src/serving.rs", "line": 763 }, { "path": "crates/spt-store/src/serving.rs", "line": 785 }, { "path": "crates/spt/src/serveverb.rs", "line": 75 } ] }, "int": { "complete": true, "evidence": [ { "path": "crates/spt-daemon/tests/docs_server_e2e.rs", "line": 23 }, { "path": "crates/spt-daemon/tests/webserve_e2e.rs", "line": 33 }, { "path": "crates/spt-daemon/tests/webserve_e2e.rs", "line": 128 }, { "path": "crates/spt-daemon/tests/webserve_e2e.rs", "line": 343 }, { "path": "crates/spt/tests/webserve_cross_node_e2e.rs", "line": 446 } ] }, "unit": { "complete": true, "evidence": [ { "path": "crates/spt-daemon/src/docshost.rs", "line": 618 }, { "path": "crates/spt-daemon/src/servehost.rs", "line": 765 }, { "path": "crates/spt-daemon/src/webserve.rs", "line": 995 }, { "path": "crates/spt-daemon/src/webserve.rs", "line": 1021 }, { "path": "crates/spt-daemon/src/webserve.rs", "line": 1187 }, { "path": "crates/spt-store/src/serving.rs", "line": 1179 }, { "path": "crates/spt-store/src/serving.rs", "line": 1250 } ] } } }, { "id": "REQ-WHOAMI-1", "title": "The `endpoint list` SELF pin carries the Self endpoint's authored `endpoint description` (info::read_info(...).resources) when present, inline after the liveness state; whoami stays a top-level hot-path verb (parse unchanged, REQ-MSG-9) and renders the same description-carrying SELF pin. HISTORY: originally minted whoami as a thin ALIAS of `spt endpoint list` — that alias premise is SUPERSEDED by REQ-WHOAMI-IDENTITY-ONLY (PROJECT-INDEX W1, 2026-07-15): the alias inherited the list's O(perches x branches) git fanout onto hook paths (the 2026-07-15 message-delivery incident), so whoami is now identity-only over the shared render_self_pin. The pin render + parse evidence here stands; the full-roster surface lives solely on `endpoint list`.", "requiredStages": [ "doc", "impl", "unit" ], "stages": { "doc": { "complete": true, "evidence": [ { "path": "CONTEXT.md", "line": 1105 } ] }, "impl": { "complete": true, "evidence": [ { "path": "crates/spt/src/cli.rs", "line": 12685 } ] }, "int": { "complete": false, "evidence": [] }, "unit": { "complete": true, "evidence": [ { "path": "crates/spt/src/cli.rs", "line": 29338 }, { "path": "crates/spt/src/cli.rs", "line": 29621 } ] } } }, { "id": "REQ-WHOAMI-EXPLICIT-SID-REFUSAL", "title": "RULED DESIGN, delivery unowned (doyle 2026-07-26): when a caller hands identity resolution an EXPLICIT non-empty $OWL_SESSION_ID that resolves to NO perch, core must REFUSE identity (unresolved, exit 1, loud distinct diagnostic) rather than fall through to an ambient/inherited one — today `detect_self_id` (roster.rs, legs a→b→b2→c) treats sid-UNMATCHED identically to sid-ABSENT, so the fallback chain re-adopts precisely the identity a sharper claim just failed to prove. MEASURED (perri, this node, 2026-07-26, three read-only whoami calls from a genuine descendant of the perri host process): (1) all SPT_*/OWL_* scrubbed → id null, exit 1 — ancestry resolved nothing (caveat honored from the probe: the perch's recorded pid was not… "requiredStages": [], "stages": { "doc": { "complete": false, "evidence": [] }, "impl": { "complete": false, "evidence": [] }, "int": { "complete": false, "evidence": [] }, "unit": { "complete": false, "evidence": [] } } }, { "id": "REQ-WHOAMI-IDENTITY-ONLY", "title": "PROJECT-INDEX W1 (F-040, perri filing claude-spt docs/SPT-CORE-FINDINGS.md @d775b38; correctness-critical opener — the 2026-07-15 message-bodies incident root): a core IDENTITY-ONLY resolution — session -> endpoint|null — that touches NO list/registry/project/git/network path, and `spt whoami` DE-ALIASED from cmd_endpoint_list (cli.rs ~6609 aliases the full list = 100+ git children under hook deadlines). endpoint-info is DISQUALIFIED as the carrier (runs latest_project_ref). Adapters/hooks get a bounded-time identity verb; the harness-hosted adapter fallback stays deadline-vulnerable until this ships. Gate: impl — the resolver + whoami de-alias; unit — resolver returns endpoint|null with zero project derivation (assert no git spa… "requiredStages": [ "doc", "impl", "unit", "int" ], "stages": { "doc": { "complete": true, "evidence": [ { "path": "docs-site/src/harness-contract/api.md", "line": 642 } ] }, "impl": { "complete": true, "evidence": [ { "path": "crates/spt/src/cli.rs", "line": 12781 } ] }, "int": { "complete": true, "evidence": [ { "path": "crates/spt/tests/whoami_identity_e2e.rs", "line": 14 } ] }, "unit": { "complete": true, "evidence": [ { "path": "crates/spt/src/cli.rs", "line": 29623 }, { "path": "crates/spt/src/roster.rs", "line": 816 } ] } } }, { "id": "REQ-WORKER-LIST-VISIBILITY", "title": "V-1 (WORKER-TRUTH triage, operator rider): worker perches leave the DEFAULT `spt endpoint list` view — they are process-local machinery, not subnet citizens; leaked-or-live worker rows rendering as permanent OFFLINE endpoints is the operator-visible symptom root. A dedicated flag (--workers) reveals them (one command + flag per the --all/--detail precedent, NOT a separate list-working command — sister divergence deliberate). Applies to the human render, --json (additive default-absent filter), and the registry/projection legs; verify-and-stop any worker gossip into the subnet registry as peer endpoints.", "requiredStages": [ "impl", "int" ], "stages": { "doc": { "complete": false, "evidence": [] }, "impl": { "complete": true, "evidence": [ { "path": "crates/spt/src/cli.rs", "line": 6424 }, { "path": "crates/spt/src/cli.rs", "line": 6446 } ] }, "int": { "complete": true, "evidence": [ { "path": "crates/spt/tests/worker_visibility_e2e.rs", "line": 18 }, { "path": "crates/spt/tests/worker_visibility_e2e.rs", "line": 61 } ] }, "unit": { "complete": false, "evidence": [] } } }, { "id": "REQ-WORKER-MINTED-NAME", "title": "N-1 (WORKER-TRUTH triage, operator rider): worker perch identity is CORE-MINTED and parent-derived — `{parent}-w{N}` with a per-parent counter at registration (sister shape: claude_skill_owl hook_subagent_start.rs) — never the adapter-presented agent id (CC Task ids render as random-named rows). worker-start mints + echoes the id (WORKER_STARTED:{parent}-w{N}); the adapter's agent_id/agent_type ride the record as correlation METADATA, not identity. Verb-shape contract change — freeze with W-2 in ONE coordination with perri.", "requiredStages": [ "doc", "impl", "unit", "int" ], "stages": { "doc": { "complete": true, "evidence": [ { "path": "docs-site/src/harness-contract/api.md", "line": 554 } ] }, "impl": { "complete": true, "evidence": [ { "path": "crates/spt-store/src/worker_seq.rs", "line": 31 }, { "path": "crates/spt-store/src/worker_seq.rs", "line": 39 }, { "path": "crates/spt/src/api/worker.rs", "line": 45 } ] }, "int": { "complete": true, "evidence": [ { "path": "crates/spt/tests/worker_lifecycle_e2e.rs", "line": 25 }, { "path": "crates/spt/tests/worker_lifecycle_e2e.rs", "line": 194 } ] }, "unit": { "complete": true, "evidence": [ { "path": "crates/spt-store/src/info.rs", "line": 1235 }, { "path": "crates/spt-store/src/worker_seq.rs", "line": 74 }, { "path": "crates/spt-store/src/worker_seq.rs", "line": 88 }, { "path": "crates/spt-store/src/worker_seq.rs", "line": 111 }, { "path": "crates/spt/src/api/mod.rs", "line": 1388 }, { "path": "crates/spt/src/api/worker.rs", "line": 213 } ] } } }, { "id": "REQ-WORKER-PICKER-EXCLUDED", "title": "V-2 (WORKER-TRUTH triage, operator rider): non-drivable endpoint classes never render as picker rows — a worker perch cannot be driven, instantiated, or controlled; offering it is a lie the picker then fails on. Filter endpoint_type worker (and the psyche class if it ever surfaces — same non-drivable family) at every picker source leg, extend-not-multiply for future non-drivable classes.", "requiredStages": [ "impl", "unit" ], "stages": { "doc": { "complete": false, "evidence": [] }, "impl": { "complete": true, "evidence": [ { "path": "crates/spt/src/picker/data.rs", "line": 204 }, { "path": "crates/spt/src/picker/data.rs", "line": 336 } ] }, "int": { "complete": false, "evidence": [] }, "unit": { "complete": true, "evidence": [ { "path": "crates/spt/src/picker/data.rs", "line": 707 }, { "path": "crates/spt/src/picker/data.rs", "line": 717 } ] } } }, { "id": "REQ-WORKER-REAP", "title": "W-3 (WORKER-TRUTH triage): worker records must not persist indefinitely past their useful life — 6 dead-pid workers leaked OFFLINE on flynn (kill-paths where SubagentStop never fires: parent killed, abort, timeout). The stored rec.pid is the ephemeral worker-start hook process (dead by design — the REQ-HAZARD-DEAD-REC-PID class; NEVER an alive-gate signal). Honest reap signals: (a) parent-session lifecycle — reap the parent's soft-stopped + orphaned workers at parent session-end/boundary and on parent-death detection (a worker cannot outlive its parent's live session); (b) a generous TTL floor since `created` as belt-and-braces. Soft-stop preservation semantics (REQ-HAZARD-SOFT-CLEANUP: results drain before reap) stay honored — rea… "requiredStages": [ "impl", "unit", "int" ], "stages": { "doc": { "complete": false, "evidence": [] }, "impl": { "complete": true, "evidence": [ { "path": "crates/spt-daemon/src/livehost.rs", "line": 276 }, { "path": "crates/spt-store/src/worker_reap.rs", "line": 59 }, { "path": "crates/spt-store/src/worker_reap.rs", "line": 87 }, { "path": "crates/spt/src/api/reporting.rs", "line": 398 } ] }, "int": { "complete": true, "evidence": [ { "path": "crates/spt-daemon/src/livehost.rs", "line": 1990 } ] }, "unit": { "complete": true, "evidence": [ { "path": "crates/spt-store/src/worker_reap.rs", "line": 163 }, { "path": "crates/spt-store/src/worker_reap.rs", "line": 173 }, { "path": "crates/spt-store/src/worker_reap.rs", "line": 191 }, { "path": "crates/spt-store/src/worker_reap.rs", "line": 206 }, { "path": "crates/spt-store/src/worker_reap.rs", "line": 225 }, { "path": "crates/spt-store/src/worker_reap.rs", "line": 241 }, { "path": "crates/spt/src/api/reporting.rs", "line": 1941 } ] } } }, { "id": "REQ-WORKER-SID-SYMMETRIC-AUTH", "title": "W-2 (WORKER-TRUTH triage, operator-ruled 2026-07-06): worker verbs go sid-symmetric with every sibling id-scoped verb — worker-start mints NO token and worker-stop takes NONE (token custody is undue adapter burden, ruling via perri). Registration STORES the sid it authenticated (the parent's sid at start; today cmd_worker_start hardcodes session_id=\"\" — worker.rs:44 — so a sid-authed stop compares against empty and refuses 100%). Stop accepts the parent's CURRENT sid OR the stored registration sid (a /clear between start and stop rotates the parent's sid; either rotation endpoint is honest custody — the REQ-PSYCHE-SID-CUSTODY rotation reasoning). Under the ruling the field adapter's existing emission (worker-stop --session-i… "requiredStages": [ "doc", "impl", "unit", "int" ], "stages": { "doc": { "complete": true, "evidence": [ { "path": "docs-site/src/harness-contract/api.md", "line": 575 } ] }, "impl": { "complete": true, "evidence": [ { "path": "crates/spt/src/api/auth.rs", "line": 236 }, { "path": "crates/spt/src/api/mod.rs", "line": 1056 }, { "path": "crates/spt/src/api/worker.rs", "line": 46 } ] }, "int": { "complete": true, "evidence": [ { "path": "crates/spt/tests/worker_lifecycle_e2e.rs", "line": 26 }, { "path": "crates/spt/tests/worker_lifecycle_e2e.rs", "line": 194 } ] }, "unit": { "complete": true, "evidence": [ { "path": "crates/spt/src/api/auth.rs", "line": 543 }, { "path": "crates/spt/src/api/auth.rs", "line": 553 }, { "path": "crates/spt/src/api/auth.rs", "line": 576 }, { "path": "crates/spt/src/api/auth.rs", "line": 594 }, { "path": "crates/spt/src/api/worker.rs", "line": 213 }, { "path": "crates/spt/src/api/worker.rs", "line": 245 } ] } } }, { "id": "REQ-XFER-RETIRED", "title": "XFER IS RETIRED FROM THE CONTROL-SURFACE VOCABULARY AND ITS TRANSFER MACHINERY LEAVES THE TREE WITH IT (ADR-0060, releases#272/#246, close rider on the WEBSERVE milestone). MEASURED BEFORE THE RULING (main 8a21a3b0): the transfer INITIATORS `fetch_file` and `push_file` have ZERO production callers -- no verb opens the Xfer stream -- while the SERVE side was live: the daemon gated the inbound Xfer stream on `XFER`, knock codes were mintable for it, rules could name it; zero grant rows named it on the measuring node. The pull-model attachment (ADR-0058) supersedes the machinery, so the Xfer stream family, its serve gate, its tests and the surface row leave TOGETHER -- a row left behind would gate traffic that no longer exists, which is a pro… "requiredStages": [ "doc", "impl", "unit" ], "stages": { "doc": { "complete": true, "evidence": [ { "path": "docs-site/src/serving/overview.md", "line": 236 } ] }, "impl": { "complete": true, "evidence": [ { "path": "crates/spt-store/src/access.rs", "line": 236 }, { "path": "crates/spt-store/src/access.rs", "line": 249 }, { "path": "crates/spt-store/src/access.rs", "line": 262 }, { "path": "crates/spt-store/src/access.rs", "line": 1001 }, { "path": "crates/spt-store/src/access.rs", "line": 1576 } ] }, "int": { "complete": false, "evidence": [] }, "unit": { "complete": true, "evidence": [ { "path": "crates/spt-daemon/src/dispatch.rs", "line": 2308 }, { "path": "crates/spt-store/src/access.rs", "line": 3100 } ] } } }, { "id": "REQ-XTASK-SPT-BIN-TARGET-DIR", "title": "#13 (F026 micro, tooling): xtask `spt_bin()` (crates/xtask/src/main.rs) BUILDS `spt` via cargo (which honors CARGO_TARGET_DIR) but returns a HARDCODED `/target/debug/spt` path — so under a redirected target dir (CI / isolated-gate rigs that set CARGO_TARGET_DIR to a throwaway) the binary lands in `$CARGO_TARGET_DIR/debug` while xtask looks in `/target/debug` -> NotFound -> `xtask check` (docs-drift gate) spuriously fails. Workaround was running `xtask check` with CARGO_TARGET_DIR unset. FIX: a pure `target_debug_dir(root, CARGO_TARGET_DIR)` seam mirroring cargo's resolution — absolute override as-is, relative resolved against `root` (the dir cargo is invoked in), default `/target` — join `debug`; `spt_bin` returns f… "requiredStages": [ "impl", "unit" ], "stages": { "doc": { "complete": false, "evidence": [] }, "impl": { "complete": true, "evidence": [ { "path": "crates/xtask/src/main.rs", "line": 410 }, { "path": "crates/xtask/src/main.rs", "line": 436 } ] }, "int": { "complete": false, "evidence": [] }, "unit": { "complete": true, "evidence": [ { "path": "crates/xtask/src/main.rs", "line": 2914 } ] } } } ], "findings": [] } Wall time: 9.30 seconds