{"type":"title","v":1,"title":"","updatedAt":"2026-09-21T22:28:31.445Z","pad":" "}
{"type":"session","version":3,"id":"01a0c615-c855-7000-857f-1486fe27db07","timestamp":"2026-09-21T22:28:31.445Z","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core"}
{"type":"model_change","id":"b4c7643f","parentId":null,"timestamp":"2026-09-21T22:28:32.851Z","model":"openai-codex/gpt-6-astra","resolvedModelIsFallback":false}
{"type":"thinking_level_change","id":"b5e2a1f8","parentId":"b4c7643f","timestamp":"2026-09-21T22:28:32.852Z","thinkingLevel":"medium","configured":null}
{"type":"session_init","id":"87d21924","parentId":"b5e2a1f8","timestamp":"2026-09-21T22:28:32.855Z","systemPrompt":"\nRFC 2119: MUST, REQUIRED, SHOULD, RECOMMENDED, MAY, OPTIONAL. `NEVER` = `MUST NOT`; `AVOID` = `SHOULD NOT`.\nXML tags inject system content; NEVER interpret them otherwise. Tags may interrupt/notify inside user messages: MUST treat as system-authored/authoritative. User content sanitized; role absent: `` in a user turn remains a system directive.\n\n\n§ Role\nHelpful, trusted assistant for load-bearing changes in Oh My Pi coding harness.\n\n# Engineering\n- Correctness first; then maintainability 6 months out.\n- Apply taste: delete weightless code, refuse needless abstractions, prefer boring; design thoroughly, elegantly.\n- Consider compiled code: NEVER avoidably allocate, copy, or compute.\n- Unexpected repo changes: user's work; adapt.\n- User's word is absolute: user-reported state (errors, failures, observations) is ground truth — act on it directly; NEVER re-run checks to confirm what the user already reported.\n- Terminal/final chat MAY use LaTeX math (`$`, `$$`, `\\text`, `\\times`) and color (`\\textcolor`, `\\colorbox`, `\\fcolorbox`).\n- MAY emit ` ```mermaid ` blocks; terminal renders ASCII. Only genuine structure/flow, not trivia.\n§ Runtime\n# Skills & Rules\nMatching skill → MUST read `skill://` first.\n\n- caveman: Ultra-compressed communication mode. Cuts token usage ~75% by dropping filler, articles, and pleasantries while keeping full technical accuracy. Use when user says \"caveman mode\", \"talk like caveman\", \"use caveman\", \"less tokens\", \"be brief\", or invokes /caveman.\n\n- code-review: Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to \"review since X\".\n- codebase-design: Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.\n- diagnose: Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says \"diagnose this\" / \"debug this\", reports a bug, says something is broken/throwing/failing, or describes a performance regression.\n- diagnosing-bugs: Diagnosis loop for hard bugs and performance regressions. Use when the user says \"diagnose\"/\"debug this\", or reports something broken/throwing/failing/slow.\n- domain-modeling: Build and sharpen a project's domain model. Use when the user wants to pin down domain terminology or a ubiquitous language, record an architectural decision, or when another skill needs to maintain the domain model.\n- find-skills: Helps users discover and install agent skills when they ask questions like \"how do I do X\", \"find a skill for X\", \"is there a skill that can...\", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.\n- git-guardrails-claude-code: Set up Claude Code hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute. Use when user wants to prevent destructive git operations, add git safety hooks, or block git push/reset in Claude Code.\n- grilling: Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.\n- gstack: Fast headless browser for QA testing and site dogfooding. Navigate pages, interact with\nelements, verify state, diff before/after, take annotated screenshots, test responsive\nlayouts, forms, uploads, dialogs, and capture bug evidence. Use when asked to open or\ntest a site, verify a deployment, dogfood a user flow, or file a bug with screenshots. (gstack)\n\n- migrate-to-shoehorn: Migrate test files from `as` type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, wants to replace `as` in tests, or needs partial test data.\n- mux-send: Send keystrokes to a psmux terminal session. Use when the user says \"send to\",\n\"type in\", \"send keys to\", \"mux send\", or wants to send input to another terminal\nsession by name.\n\n- open-gstack-browser: Launch GStack Browser — AI-controlled Chromium with the sidebar extension baked in.\nOpens a visible browser window where you can watch every action in real time.\nThe sidebar shows a live activity feed and chat. Anti-bot stealth built in.\nUse when asked to \"open gstack browser\", \"launch browser\", \"connect chrome\",\n\"open chrome\", \"real browser\", \"launch chrome\", \"side panel\", or \"control my browser\".\n\n- propose-issue: Challenge an issue statement before fixing it. Probes scope, root cause, and assumptions\nthrough interactive questioning grounded in the codebase. Use when the user says \"propose issue\",\n\"challenge this bug\", \"question this fix\", \"is this the right problem\", or wants to pressure-test\na problem statement before jumping to implementation.\n\n- prototype: Build a throwaway prototype to answer a design question. Use when the user wants to sanity-check whether a state model or logic feels right, or explore what a UI should look like.\n- research: Investigate a question against high-trust primary sources and capture the findings as a Markdown file in the repo. Use when the user wants a topic researched, docs or API facts gathered, or reading legwork delegated to a background agent.\n- resolving-merge-conflicts: Use when you need to resolve an in-progress git merge/rebase conflict.\n- scaffold-exercises: Create exercise directory structures with sections, problems, solutions, and explainers that pass linting. Use when user wants to scaffold exercises, create exercise stubs, or set up a new course section.\n- screenshot-capture: Capture, process, and analyze screenshots of any running application on Windows 10/11. Use this skill whenever the user asks to take a screenshot, capture what's on screen, grab an app window, extract text from a visible app, annotate a screenshot, read what's on screen, OCR a running application, document a UI state, or visually inspect any running program. Also trigger when the user says things like \"show me what [app] looks like\", \"grab that window\", \"read the text in [app]\", \"mark up a screenshot\", \"capture my desktop\", or any task involving visual inspection of running software. This skill handles full-screen captures, individual window captures by app name, OCR text extraction, and image annotation (highlights, arrows, text labels). Even if the user doesn't say \"screenshot\" explicitly, use this skill if they want to see, capture, read, or annotate anything currently displayed on their screen.\n\n- setup-pre-commit: Set up Husky pre-commit hooks with lint-staged (Prettier), type checking, and tests in the current repo. Use when user wants to add pre-commit hooks, set up Husky, configure lint-staged, or add commit-time formatting/typechecking/testing.\n- spt-endpoint: Hosts an adapterless SPT endpoint perch inside Oh My Pi and reliably surfaces incoming messages through harness background-job completion. Use when asked to run, host, start, or listen as an SPT endpoint in OMP, especially when an adapter-backed endpoint or a never-ending `spt ready` listener is unsuitable.\n- tdd: Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions \"red-green-refactor\", or wants integration tests.\n- to-prd: Turn the current conversation context into a PRD and publish it to the project issue tracker. Use when user wants to create a PRD from the current context.\n- trace: Find old conversations in Codex session history. Use when the user says\n\"find the conversation where\", \"when did we discuss\", \"trace back to\", or wants\nto locate a past session by topic, command, commit, or keyword.\n\n- traceable-reqs: Install or update the traceable-reqs CLI and apply it correctly in host repos: author manifests, place tags near evidence, audit scan roots, interpret findings, and answer coverage questions through the CLI.\n- win-marketplace-add: Add a plugin marketplace on Windows, bypassing the EBUSY rename bug. Use when the user wants to add a marketplace, runs \"/plugin marketplace add\" and gets an EBUSY error, or needs to register a marketplace that was manually cloned. Trigger on: \"add marketplace\", \"plugin marketplace add\", \"EBUSY marketplace\", \"register marketplace\", \"marketplace not found\".\n\n- wizard: Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.\n- write-a-skill: Create new agent skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, or build a new skill.\n- writing-for-agents: Writing documents for agents. Use when creating or editing skills, or modifying AGENTS.md or CLAUDE.md.\n\n# Internal URLs\nMost FS/bash tools auto-resolve these to FS paths.\n- `skill://`: instructions; `/`: its file\n- `rule://`: details\n- `agent://`: output artifact; `/`: nested-subagent output; otherwise `/`: JSON field\n- `history://`: read-only agent transcript (live|parked|released); bare `history://`: all agents. Registered process-wide agents and persisted subagents discoverable from artifact trees; unregistered top-level sessions are not discovered solely from persisted session files.\n- `artifact://`: content\n- `local://.md`: plan artifacts/shared subagent content\n- `mcp://`: MCP resource\n- `issue://` / `issue:////`: GitHub issue; bare: recent; `?state=open|closed|all&limit=&author=&label=`.\n- `pr://` / `pr:////`: same cache; bare: recent; `?comments=0` `?state=open|closed|merged|all&limit=&author=&label=`.\n- `omp://`: harness docs; AVOID unless user asks about harness.\n\n# Tool Inventory\n- Read: `read`\n- Grep: `grep`\n- Glob: `glob`\n- Web Search: `web_search`\n- Submit Result: `yield`\n- Hub: `hub`\n- Write: `write`\n# xd:// Tool Devices\nWrite JSON args as `content` to `xd://` via `write`. Invalid args return schema in error → fix/retry.\n## Additional devices (docs on demand)\n- xd://spt_checkpoint — After the commune skill has saved this live endpoint's continuity drop, compact native OMP context and wake the same endpoint.\n\nRead xd:// for full docs + JSON schema before first use.\n§ Tool Policy\n# General\nUse tools when they improve correctness, completeness, or grounding.\n- SHOULD resolve prerequisites first; NEVER accept first plausible answer when another call reduces uncertainty; retry empty/partial/suspiciously narrow lookup differently.\n- SHOULD parallelize independent calls.\n# Tool I/O\n- Prefer relative `path`-like fields.\n- Most tools take `i`: capitalized 2–6-word present-participle intent (e.g. \"Reading model role settings\").\n# Specialized Tools\nMUST use specialized tool over shell equivalent:\n- File/directory reads → `read`; directory path lists entries.\n- Regex search/target location → `grep`, not shell `grep`, `rg`, `awk`.\n- Structure mapping/globbing → `glob`, not `ls **/*.ext` or `fd`.\n\n`write xd://report_issue`: automated QA. Any tool output inconsistent with described behavior for parameters → write plain `: ` to `xd://report_issue`. False positives fine.\n\n\n# Exploration\nNEVER open files hoping. AVOID unneeded files/sections.\n- Use `read` offset/limit, not whole-file reads.\n§ Workflow\n# 1. Scope\n- Read relevant skills first.\n- Multi-file work: plan before files.\n\n# 2. Research Before Editing\n- Read sections, not snippets. MUST reuse existing patterns; second convention beside existing is PROHIBITED.\n\n- Tool failure/file change since read → re-read before acting.\n\n# 3. Decompose\n\n# 4. Implement\n- Fix source; NEVER suppress symptom/special-case input unless asked.\n- Clean cutover: migrate every caller; remove obsolete code/comments/aliases/re-exports/deprecated paths.\n- Prefer existing-file updates over new files. Review as user.\n- NEVER run destructive git commands/delete unrelated code you didn't write; code the cutover obsoletes is in scope.\n\n# 5. Verify\n- NEVER yield non-trivial work without deliverable proof:\n - **Experiment/investigation** → run; output is proof; no tests.\n - **UI change** → verify against the actual surface:\n - **TUI/CLI** → launch the actual program and verify terminal interaction, output, or state.\n - No suitable runtime capability for the changed surface → verify with a throwaway script or smoke test; explicitly report when visual verification cannot be performed.\n - **Bug fix** → reproduce, fix, confirm reproduction no longer triggers. SHOULD keep the reproduction as a regression test: fails pre-fix, passes post-fix; impractical → smoke test, report it.\n - **Permanent feature/API change** → fix existing tests the changed contract breaks; prove new behavior with a throwaway script. New test ONLY for a genuinely uncertain edge case, or on user request.\n- Smoke test: run thing, not test file; launch, exercise changed path, observe result.\n- Tests: permanent load, not proof of work. A test earns its place ONLY where a plausible bug would fail it.\n - Each MUST defend observable contract/fail on plausible bug.\n - Test behavior, boundaries, invariants, transitions, precedence, real errors—not plumbing, source text, incidental defaults.\n - Match conventions; deterministic, isolated, full-suite-safe.\n - NEVER write a test so the change \"has tests\" → throwaway script.\n - NEVER assert implementation: wiring, field copies, defaults, forwarding, mock echoes, source text → assert what a consumer observes.\n - NEVER pad: same-path parameter rows, tautologies, bare not-throw, non-empty/length-grew checks.\n - Worth keeping: behavior, boundaries, invariants, transitions, precedence, real errors. Match conventions; deterministic, isolated, full-suite-safe.\n - Existing test failing this bar (pins wording, implementation, incidental behavior) → MUST delete; NEVER re-pin it to the new text. In scope regardless of author.\n\n# 6. Cleanup\nLast phase; REQUIRED after smoke test proves work; NEVER pre-plan/pre-allocate cleanup todos.\n- Permanent feature/bug fix → docs, changelog, scaffold + throwaway-script removal; tests only per Verify.\n- Experiment/one-off investigation → no cleanup tests/docs.\n\n§ Delivery\n\nInviolable.\n- NEVER yield before complete deliverable; phase boundary/todo flip/sub-step never yields: same turn.\n- NEVER fabricate output; code/tool/test/doc/source claims MUST be grounded.\n- NEVER substitute easier/familiar problem: don't infer extra scope—retries, validation, telemetry, abstraction “while you're at it”—or solve symptom—suppress warning/exception, special-case input—unless asked. Real ask only.\n- NEVER ask for tool/repo/file-provided information; NEVER punt half-solved work.\n- Default clean cutover: migrate every caller; no shims, aliases, deprecated paths.\n\n\n\n- “Done”: specified end-to-end behavior plus every named acceptance criterion; not compiling scaffold, narrowed test, plausible subset.\n- Reduce scope only with explicit user approval in this conversation; NEVER silently shrink.\n- NEVER deliver unfinished work: stubs, placeholders, mocks, no-ops, fake fallbacks, `TODO: implement`, misleading “scaffold”/“MVP”/“v1”/“foundation”/“follow-up”. Unavailable real-implementation info → state missing prerequisite; finish all reachable work.\n\n\n\n- Format MUST match ask; prose brief; evidence, verification, blocking details complete.\n- Code/tool/test/doc/source claims MUST be grounded; unobserved claims `[INFERENCE]`.\n- Verification claims exactly match exercised work.\n\n\n\nBefore yielding: all affected callsites/tests/docs updated or intentionally unchanged; output/evidence requirements satisfied.\nBefore blocked: ensure info unreachable via tools/context; one failed check ≠ blocked. Finish reachable work; state exactly missing and tried.\n\n\n§ Critical\n\n- NEVER yield while actionable work remains; phase boundary/todo flip/sub-step never stops: same turn.\n- NEVER narrate/consider session limits, token/tool budgets, effort estimates, or possible completion; start unbounded: execute/delegate.\n- NEVER re-audit applied edit or routinely run git subcommands for validation. Tool results are verification.\n\n\n§ Role\nInvestigate the codebase rapidly. Return structured findings another agent can use without re-reading everything. `summary`/`architecture` stay brief; a task that asks for an exhaustive report gets it in full under `report`.\n\n\n- You MUST use tools for broad pattern matching / code search as much as possible.\n- You SHOULD invoke tools in parallel—this is a short investigation, and you are supposed to finish in a few seconds.\n- If a search returns empty results, you MUST try at least one alternate strategy (different pattern, broader path, or AST search) before concluding the target doesn't exist.\n\n\n\nYou MUST infer the thoroughness from the task; default to medium:\n- **Quick**: Targeted lookups, key files only\n- **Medium**: Follow imports, read critical sections\n- **Thorough**: Trace all dependencies, check tests/types.\n\n\n\n1. Locate relevant code using tools.\n2. Read key sections. NEVER read full files unless they're tiny.\n3. Identify types/interfaces/key functions.\n4. Note dependencies between files.\n\n\n\nYou MUST operate as read-only. You NEVER write, edit, or modify files, nor execute any state-changing commands, via git, build system, package manager, etc.\nYou MUST keep going until complete.\n\n\n§ Context\n# Goal\nMilestone releases#318 HANDED-FILE, Doyle JBUW6PP2. H1 first: skip only redundant push-main unit work when the exact SHA has trustworthy successful PR CI proof. H2: real HFENDULEAM endpoint / ENLYZEAM remote-controller FILE_ACCESS_HELPER field acceptance, RED first on b33aedca. Read .spt/preserved/318/JIT-PLAN.md whole and relevant repo rules. Base b33aedcae51fa5ffa840ef1b36c9989a25884bdc.\n# Constraints\nSkip ALL validation/build/lint/tests and formatters; parent runs once after edits. No cargo, fleet lifecycle changes, commits, pushes, PRs or remote mutations by either agent. Do not touch extension-owned hertz lifecycle. Main owns integration, real field actions, validation and publication. SSH decid@enlyzeam is authorized, but read-only research agent must not use it; parent owns node admission. No broad workspace formatter. Every worktree lives under .worktrees/.\n# Contract\nH1 owns ONLY .worktrees/hertz-318-ci-reuse and its registry/docs/workflow/script changes. H2 scout is read-only and owns no files. H1 exposes a separate changes-job output `run-unit` (true by default; false only for proven push refs/heads/main reuse); preserve original `code` classifier and lint/traceability behavior. Trigger PR CI normally; no skips for direct/release-shaped SHA without exact PR proof, workflow_dispatch, non-main push, API failure/unknown. Parent receives changed files, commands to validate, and nonfabricated evidence limitations. H2 must return actual public API/CLI flow and safe isolated-field construction, not a mock test plan.\n§ Coop\nYou are operating on a piece of work assigned to you by the main agent.\n\n# Validation\nProject-wide validation is the main agent's job, run once after all subagents land. NEVER run formatters, linters, or project-wide builds/test suites unless your assignment explicitly instructs it — siblings edit concurrently; mid-flight validation blocks on their half-finished changes and reports phantom failures. Scoped proof of your own change (single test file, targeted repro, smoke run) is fine.\n# Peers\nYou can reach other live agents via the `hub` tool. Your id is `HandedFileFieldMap`. Currently visible peers:\n- `HandedFileCiReuse` — task (sub, running)\n- `Main` — main (main, running)\n40 parked peer(s) omitted.\n\nUse `hub` messaging only for quick coordination, never long-form content. Address peers by id or use `\"all\"` to broadcast.\n- Discovery: the roster above shows live (running+idle) peers and a parked count, never parked names or task labels. `hub` op:\"list\" refreshes the live view; pass status:\"parked\" to inspect parked history.\n- Coordination: before you edit a file or start work a sibling may already own, message that peer first — overlapping edits collide. Idle peers are not gone: messaging them wakes them.\n- Follow-up: answer a peer's question with a short reply (set `replyTo`); use `await` only when you genuinely cannot proceed without the answer.\n- Parked history: omitted from this roster. `hub` op:\"list\" status:\"parked\" lists ids; `send` to a known parked id revives it. `history://` and `agent://` stay readable.\n\n§ Completion\nNo TODO tracking, no progress updates. Execute; report results with `yield`.\n\nWhile work remains, you MUST continue with another tool call — investigate, edit, run, verify. Save narrative for a terminal `yield` unless you intentionally record an incremental section.\n\nYield protocol:\n- Omit `type` for the normal single terminal structured result in `data`.\n- Use non-empty `type: string[]` for incremental, non-terminal sections; calls accumulate by section.\n- A data-less terminal `type: \"result\"` only finalizes previously submitted incremental sections; it NEVER substitutes for `data`.\n\nThis is your only way to return a final result. For structured results, you NEVER put JSON in plain text or substitute a text summary for `data`.\n\nYour terminal `yield` MUST use exactly this shape — the schema fields go inside `data`, NEVER at the top level and NEVER as a stringified summary:\n```ts\n{\n data: {\n summary: string;\n files: { path: string; description: string; }[];\n architecture: string;\n report?: string;\n };\n}\n```\n\nGiving up is a last resort. If truly blocked, you MUST terminal-yield `{ error }` describing what you tried and the exact blocker.\nYou NEVER give up due to uncertainty, missing information obtainable via tools or repo context, or needing a design decision you can derive yourself.\n\nYou MUST keep going until this ticket is closed. This matters.\n\nPROJECT\n\n\n- OS: win32 10.0.26200\n- Distro: Windows_NT\n- Kernel: Windows 11 Pro\n- Arch: x64\n- CPU: AMD Ryzen 7 7800X3D 8-Core Processor\n- GPU: AMD Radeon(TM) Graphics\n- Model: openai-codex/gpt-6-astra\n\n\n- Each response MUST advance the task; completion only stopping condition.\n- MUST default to informed action; do not ask for confirmation when tools or repo context can answer.\n- Before yielding, MUST verify significant behavioral changes: run the specific test, command, or scenario covering the change.\n","task":"Complete assignment thoroughly:\n\n# Target\nRead-only reconnaissance for H2: docs-site/src/serving/attachments.md, docs/adr/0058-attachments-are-pull-model.md Amendment2, docs/INPUT-PROVENANCE-CONTRACT.md, core helperline/report_user_input/gather paths and relevant existing field/integration fixtures. Parent has read the plan and RCA and found helper field leg unexecuted. No files changed or commands mutating a node.\n# Change\nMap the REAL interface path for a two-node driver: receiver endpoint on HFENDULEAM, owner/controller rc from ENLYZEAM. Determine minimal safe fixture construction using existing product CLI/protocol (not direct injection of helper records or fabricated controller state). Identify how to submit a session-authenticated user input report and capture prompt-submit poll output, register second audience endpoint, physically deliver a PEER message through core then observe no serve. Identify admission/provenance/binary hashes, private homes/trust isolation or unavoidable fleet prerequisite, teardown ownership, relevant existing scripts/skills/CLI help. Do not propose a mock as field acceptance. Five cells: spaced path, exactly one line, with-prompt delivery, second endpoint own line/audience, core physically delivered PEER path causes no serve. Also point to no-path hook timing and n>=10 owner roundtrip measurement support requested of product W2. Record how each cell distinguishes RED from a missing-precondition/invalid rig.\n# Acceptance\nReturn compact source-grounded mapping with paths/lines/symbols, concrete command/API sequence where known, what can run against existing b33aedca binaries without cargo, and genuinely missing prerequisites. Skip all validation/build/lint/tests/formatters and remote access; no edits, no lifecycle actions. Use LSP if available for symbols.","tools":["read","grep","glob","web_search","yield","hub","spt_checkpoint"],"agent":"scout","modelRole":"smol","resolvedModel":"openai-codex/gpt-6-astra","readOnly":true,"spawns":"","readSummarize":false,"outputSchema":{"properties":{"summary":{"metadata":{"description":"Brief summary of findings and conclusions"},"type":"string"},"files":{"metadata":{"description":"Files examined with relevant code references"},"elements":{"properties":{"path":{"metadata":{"description":"Project-relative path or paths to the most relevant code reference(s), optionally suffixed with line ranges like `:12-34` when relevant"},"type":"string"},"description":{"metadata":{"description":"Section contents"},"type":"string"}}}},"architecture":{"metadata":{"description":"Brief explanation of how pieces connect"},"type":"string"}},"optionalProperties":{"report":{"metadata":{"description":"The complete deliverable when the task asks for a report, table, enumeration, or per-item audit — full markdown at the depth requested (tables, path:line anchors, signatures, code excerpts). Never a summary of it; `summary` already covers that. Omit only for quick lookups."},"type":"string"}}},"outputSchemaMode":"permissive"}
{"type":"message","id":"0d89c902","parentId":"87d21924","timestamp":"2026-09-21T22:28:32.899Z","message":{"role":"user","content":[{"type":"text","text":"Complete assignment thoroughly:\n\n# Target\nRead-only reconnaissance for H2: docs-site/src/serving/attachments.md, docs/adr/0058-attachments-are-pull-model.md Amendment2, docs/INPUT-PROVENANCE-CONTRACT.md, core helperline/report_user_input/gather paths and relevant existing field/integration fixtures. Parent has read the plan and RCA and found helper field leg unexecuted. No files changed or commands mutating a node.\n# Change\nMap the REAL interface path for a two-node driver: receiver endpoint on HFENDULEAM, owner/controller rc from ENLYZEAM. Determine minimal safe fixture construction using existing product CLI/protocol (not direct injection of helper records or fabricated controller state). Identify how to submit a session-authenticated user input report and capture prompt-submit poll output, register second audience endpoint, physically deliver a PEER message through core then observe no serve. Identify admission/provenance/binary hashes, private homes/trust isolation or unavoidable fleet prerequisite, teardown ownership, relevant existing scripts/skills/CLI help. Do not propose a mock as field acceptance. Five cells: spaced path, exactly one line, with-prompt delivery, second endpoint own line/audience, core physically delivered PEER path causes no serve. Also point to no-path hook timing and n>=10 owner roundtrip measurement support requested of product W2. Record how each cell distinguishes RED from a missing-precondition/invalid rig.\n# Acceptance\nReturn compact source-grounded mapping with paths/lines/symbols, concrete command/API sequence where known, what can run against existing b33aedca binaries without cargo, and genuinely missing prerequisites. Skip all validation/build/lint/tests/formatters and remote access; no edits, no lifecycle actions. Use LSP if available for symbols."}],"attribution":"agent","timestamp":1790029712856}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_3gVoYvnoYZyhXFbrjGAYnb8r|fc_0c7d22595484f800016ab1af92f38487d29d74026ce164fa65","toolName":"read","startedAt":"2026-09-21T22:28:35.962Z","args":{"path":".spt/preserved/318/JIT-PLAN.md:raw"},"intent":"Reading preserved execution plan"},"id":"9a6c5e38","parentId":"0d89c902","timestamp":"2026-09-21T22:28:35.962Z"}
{"type":"message","id":"cb0aabe2","parentId":"9a6c5e38","timestamp":"2026-09-21T22:28:35.962Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_3gVoYvnoYZyhXFbrjGAYnb8r|fc_0c7d22595484f800016ab1af92f38487d29d74026ce164fa65","name":"read","arguments":{"i":"Reading preserved execution plan","path":".spt/preserved/318/JIT-PLAN.md:raw"},"intent":"Reading preserved execution plan"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":10522,"output":37,"cacheRead":0,"cacheWrite":0,"totalTokens":10559,"cost":{"input":0.10522000000000001,"output":0.00185,"cacheRead":0,"cacheWrite":0,"total":0.10707000000000001}},"stopReason":"toolUse","timestamp":1790029712897,"responseId":"resp_0c7d22595484f800016ab1af91bc1c87d2817291a5ecb2354c","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0c7d22595484f800016ab1af92f38487d29d74026ce164fa65","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading preserved execution plan\",\"path\":\".spt/preserved/318/JIT-PLAN.md:raw\"}","call_id":"call_3gVoYvnoYZyhXFbrjGAYnb8r","internal_chat_message_metadata_passthrough":{"create_time":1790029713.991286,"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"read","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}}]},"duration":3064.396999999997,"ttft":2077.007799999992,"completedAt":1790029715962,"contextSnapshot":{"promptTokens":10522,"nonMessageTokens":10457,"compactionEpoch":0}}}
{"type":"credential_pin","id":"7cd49b5f","parentId":"cb0aabe2","timestamp":"2026-09-21T22:28:35.963Z","provider":"openai-codex","hash":"1a3c10d7bc41d381cab1511db604bc2637dfcfc63796a890d8b5ee152859e1cb"}
{"type":"message","id":"f56b7813","parentId":"7cd49b5f","timestamp":"2026-09-21T22:28:35.967Z","message":{"role":"toolResult","toolCallId":"call_3gVoYvnoYZyhXFbrjGAYnb8r|fc_0c7d22595484f800016ab1af92f38487d29d74026ce164fa65","toolName":"read","content":[{"type":"text","text":"# Milestone #318 HANDED-FILE — JIT plan (doyle, 2026-09-21)\n\nBase: main b33aedca (v0.71.0 + sync rider). Target: v0.72.0, counter 108. Golden head assembled by doyle, run by deployah.\nMembers: #317 (operator-named), #254, #311, #312. Infra riders: IR-144 (hertz), IR-95 status line (doyle).\nIntake RCA: releases#317 comment 5768362088. Composition: releases#318 comment 5768367416.\n\n## Waves — todlando (product), serial, one thin PR each, branch off CURRENT main\nW1 `fix/317-quoted-span-paths` — #317 defects 1+2.\n - `spt_store::helperline::quoted_path_candidates`: extract quoted spans (\"…\", '…', `…`) BEFORE whitespace tokenising; keep fixed-point trim, anchoring, dedupe, cap 5. Unquoted space-bearing path stays out of contract; docs say so.\n - `report_user_input_with` gate uses the same extractor (it already does; keep ONE extractor).\n - `gather_file_access_helper`: additionally dedupe on the EMITTED line within one gather.\n - RCA (report, do not guess): why ONE prompt wrote TWO helper records 107 ms apart with different msg_id (owlery/webbie/helper-fetch.jsonl, at_ms 1790027897746/…853). Fix at the source if it is core.\n - Units: quoted path with spaces (Windows + POSIX), `~/a b/c.md`, two quoted paths in one line, trailing punctuation after the closing quote, a fragment must NEVER be reported (negative control: the old tokeniser's `C:\\Users\\x\\My` case).\nW2 `fix/317-second-audience-and-prompt-delivery` — #317 defects 4+3.\n - 4 (now its OWN request, see releases board; OPERATOR-RULED CONTRACT 2026-09-21): the helper fires for every endpoint + session + filepath combination it has not already fired on, and RESURFACES THE EXISTING served URL when the path is already served (no second entry, no silence). Read owner-side registration first; state the mechanism before the fix. The existing entry's audience must admit the new endpoint and that widening must show in `spt serve list`. Resurfacing does NOT extend the original 24 h deadline. Doc sentence on repeated payloads becomes per endpoint+session+path.\n - 3: deliver the line WITH the prompt. Bounded wait on the prompt-submit poll ONLY when the payload quoted a path. MEASURE owner round-trip HFENDULEAM<->ENLYZEAM first (n>=10), propose the bound from the measurement, report hook cost added on the common no-path prompt (must be zero: no IPC, no wait). ADR-0058 Amendment 2 + docs-site serving/attachments.md in the same PR.\nW3 `fix/254-boundary-manifest` — resolve the manifest on cmd_bind and cmd_boundary so the compliance gate fires (#254).\nW4 `fix/312-gh-positive-probe` — gate `spt update` fetch on a positive credential probe; name a stale account in the refusal (#312).\nW5 `fix/311-seal-token-to-author` — the in-output ceremony answer carries the minted token (dispatch result line); confirm whether #223's path regressed or never covered this arm (#311).\n\nEvery wave: new REQ ids in traceable-reqs.toml FIRST, tags in the same commit, `traceable-reqs check` exit 0, clippy --workspace, never cargo fmt, pool-claim from the lane's own worktree under .worktrees/, release the pool, co-author trailer `Co-authored by: todlando`.\n\n## hertz (test/CI), parallel\nH1 IR-144: push-main ci re-tests the sha its PR run just greened; ci.yml `changes` job. Thin PR.\nH2 Two-node field acceptance driver for the helper (docs already say this acceptance is PENDING): HFENDULEAM endpoint, controller seated from ENLYZEAM. Cells: spaced path arrives; one line not two; arrives with the prompt; second endpoint gets its own line; a core-delivered path-bearing PEER message causes NO serve. Red on purpose first against b33aedca.\n\n## doyle\nGate every wave in an isolated worktree (targeted suites + compile gate), rule forks, IR-95 status line, assemble golden head, hand to deployah, triage reds, publish close.\nBox rule: hfenduleam is builder box AND golden Windows runner. No local cargo while a runner leg is inside its last 15 min; post-merge ci occupies the box ~35 min after every ff (until H1 lands).\n"}],"details":{"totalLines":30,"displayContent":{"text":"# Milestone #318 HANDED-FILE — JIT plan (doyle, 2026-09-21)\n\nBase: main b33aedca (v0.71.0 + sync rider). Target: v0.72.0, counter 108. Golden head assembled by doyle, run by deployah.\nMembers: #317 (operator-named), #254, #311, #312. Infra riders: IR-144 (hertz), IR-95 status line (doyle).\nIntake RCA: releases#317 comment 5768362088. Composition: releases#318 comment 5768367416.\n\n## Waves — todlando (product), serial, one thin PR each, branch off CURRENT main\nW1 `fix/317-quoted-span-paths` — #317 defects 1+2.\n - `spt_store::helperline::quoted_path_candidates`: extract quoted spans (\"…\", '…', `…`) BEFORE whitespace tokenising; keep fixed-point trim, anchoring, dedupe, cap 5. Unquoted space-bearing path stays out of contract; docs say so.\n - `report_user_input_with` gate uses the same extractor (it already does; keep ONE extractor).\n - `gather_file_access_helper`: additionally dedupe on the EMITTED line within one gather.\n - RCA (report, do not guess): why ONE prompt wrote TWO helper records 107 ms apart with different msg_id (owlery/webbie/helper-fetch.jsonl, at_ms 1790027897746/…853). Fix at the source if it is core.\n - Units: quoted path with spaces (Windows + POSIX), `~/a b/c.md`, two quoted paths in one line, trailing punctuation after the closing quote, a fragment must NEVER be reported (negative control: the old tokeniser's `C:\\Users\\x\\My` case).\nW2 `fix/317-second-audience-and-prompt-delivery` — #317 defects 4+3.\n - 4 (now its OWN request, see releases board; OPERATOR-RULED CONTRACT 2026-09-21): the helper fires for every endpoint + session + filepath combination it has not already fired on, and RESURFACES THE EXISTING served URL when the path is already served (no second entry, no silence). Read owner-side registration first; state the mechanism before the fix. The existing entry's audience must admit the new endpoint and that widening must show in `spt serve list`. Resurfacing does NOT extend the original 24 h deadline. Doc sentence on repeated payloads becomes per endpoint+session+path.\n - 3: deliver the line WITH the prompt. Bounded wait on the prompt-submit poll ONLY when the payload quoted a path. MEASURE owner round-trip HFENDULEAM<->ENLYZEAM first (n>=10), propose the bound from the measurement, report hook cost added on the common no-path prompt (must be zero: no IPC, no wait). ADR-0058 Amendment 2 + docs-site serving/attachments.md in the same PR.\nW3 `fix/254-boundary-manifest` — resolve the manifest on cmd_bind and cmd_boundary so the compliance gate fires (#254).\nW4 `fix/312-gh-positive-probe` — gate `spt update` fetch on a positive credential probe; name a stale account in the refusal (#312).\nW5 `fix/311-seal-token-to-author` — the in-output ceremony answer carries the minted token (dispatch result line); confirm whether #223's path regressed or never covered this arm (#311).\n\nEvery wave: new REQ ids in traceable-reqs.toml FIRST, tags in the same commit, `traceable-reqs check` exit 0, clippy --workspace, never cargo fmt, pool-claim from the lane's own worktree under .worktrees/, release the pool, co-author trailer `Co-authored by: todlando`.\n\n## hertz (test/CI), parallel\nH1 IR-144: push-main ci re-tests the sha its PR run just greened; ci.yml `changes` job. Thin PR.\nH2 Two-node field acceptance driver for the helper (docs already say this acceptance is PENDING): HFENDULEAM endpoint, controller seated from ENLYZEAM. Cells: spaced path arrives; one line not two; arrives with the prompt; second endpoint gets its own line; a core-delivered path-bearing PEER message causes NO serve. Red on purpose first against b33aedca.\n\n## doyle\nGate every wave in an isolated worktree (targeted suites + compile gate), rule forks, IR-95 status line, assemble golden head, hand to deployah, triage reds, publish close.\nBox rule: hfenduleam is builder box AND golden Windows runner. No local cargo while a runner leg is inside its last 15 min; post-merge ci occupies the box ~35 min after every ff (until H1 lands).\n","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30]},"fileSize":4009,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\.spt\\preserved\\318\\JIT-PLAN.md"}}},"isError":false,"timestamp":1790029715967}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_LoWvKf8iVHU1fko4BBnmBG61|fc_0c7d22595484f800016ab1af9c39d887d2ad52b5b42a50ed21","toolName":"glob","startedAt":"2026-09-21T22:28:44.285Z","args":{"path":"**/AGENTS.md;**/CLAUDE.md"},"intent":"Locating repository instructions"},"id":"69d97d12","parentId":"f56b7813","timestamp":"2026-09-21T22:28:44.285Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_zFVdIjQQp1xGx0ePeC3aCfZf|fc_0c7d22595484f800016ab1af9c39e487d29f58dd14fac64681","toolName":"read","startedAt":"2026-09-21T22:28:44.286Z","args":{"path":"docs-site/src/serving/attachments.md"},"intent":"Reading attachment user contract"},"id":"e5241adf","parentId":"69d97d12","timestamp":"2026-09-21T22:28:44.286Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_p8x0W0CN4yGXpAQStW4rghLE|fc_0c7d22595484f800016ab1af9c39ec87d2a7e05245791033ab","toolName":"read","startedAt":"2026-09-21T22:28:44.286Z","args":{"path":"docs/INPUT-PROVENANCE-CONTRACT.md"},"intent":"Reading provenance contract"},"id":"7d09ec30","parentId":"e5241adf","timestamp":"2026-09-21T22:28:44.286Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_SRKDm4vTxcG68wHjBut1pBgk|fc_0c7d22595484f800016ab1af9c39f087d2a6d98b849d844337","toolName":"grep","startedAt":"2026-09-21T22:28:44.286Z","args":{"path":"docs/adr/0058-attachments-are-pull-model.md"},"intent":"Locating attachment amendment"},"id":"f4f01357","parentId":"7d09ec30","timestamp":"2026-09-21T22:28:44.286Z"}
{"type":"message","id":"fa3f88b8","parentId":"f4f01357","timestamp":"2026-09-21T22:28:44.286Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_LoWvKf8iVHU1fko4BBnmBG61|fc_0c7d22595484f800016ab1af9c39d887d2ad52b5b42a50ed21","name":"glob","arguments":{"i":"Locating repository instructions","path":"**/AGENTS.md;**/CLAUDE.md","hidden":true,"gitignore":true,"limit":60},"intent":"Locating repository instructions"},{"type":"toolCall","id":"call_zFVdIjQQp1xGx0ePeC3aCfZf|fc_0c7d22595484f800016ab1af9c39e487d29f58dd14fac64681","name":"read","arguments":{"i":"Reading attachment user contract","path":"docs-site/src/serving/attachments.md"},"intent":"Reading attachment user contract"},{"type":"toolCall","id":"call_p8x0W0CN4yGXpAQStW4rghLE|fc_0c7d22595484f800016ab1af9c39ec87d2a7e05245791033ab","name":"read","arguments":{"i":"Reading provenance contract","path":"docs/INPUT-PROVENANCE-CONTRACT.md"},"intent":"Reading provenance contract"},{"type":"toolCall","id":"call_SRKDm4vTxcG68wHjBut1pBgk|fc_0c7d22595484f800016ab1af9c39f087d2a6d98b849d844337","name":"grep","arguments":{"i":"Locating attachment amendment","pattern":"Amendment|helper|poll","path":"docs/adr/0058-attachments-are-pull-model.md","case":false,"gitignore":true,"skip":0},"intent":"Locating attachment amendment"},{"type":"toolCall","id":"call_OsNZJOnvt6duyNA7x07PeoUU|fc_0c7d22595484f800016ab1af9c39f887d284e320e779bdb4a8","name":"grep","arguments":{"i":"Locating helper field interfaces","pattern":"report_user_input_with|gather_file_access_helper|report_user_input|helper-fetch|FILE_ACCESS_HELPER","path":"crates;tests;scripts","case":true,"gitignore":true,"skip":0},"intent":"Locating helper field interfaces"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":1241,"output":242,"cacheRead":10368,"cacheWrite":0,"totalTokens":11851,"cost":{"input":0.012410000000000001,"output":0.012100000000000001,"cacheRead":0.010367999999999999,"cacheWrite":0,"total":0.034878000000000006}},"stopReason":"toolUse","timestamp":1790029715987,"responseId":"resp_0c7d22595484f800016ab1af94347887d28b23a06c2f491586","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0c7d22595484f800016ab1af9c39d887d2ad52b5b42a50ed21","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating repository instructions\",\"path\":\"**/AGENTS.md;**/CLAUDE.md\",\"hidden\":true,\"gitignore\":true,\"limit\":60}","call_id":"call_LoWvKf8iVHU1fko4BBnmBG61","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"glob","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1af9c39e487d29f58dd14fac64681","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading attachment user contract\",\"path\":\"docs-site/src/serving/attachments.md\"}","call_id":"call_zFVdIjQQp1xGx0ePeC3aCfZf","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"read","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1af9c39ec87d2a7e05245791033ab","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading provenance contract\",\"path\":\"docs/INPUT-PROVENANCE-CONTRACT.md\"}","call_id":"call_p8x0W0CN4yGXpAQStW4rghLE","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"read","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1af9c39f087d2a6d98b849d844337","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating attachment amendment\",\"pattern\":\"Amendment|helper|poll\",\"path\":\"docs/adr/0058-attachments-are-pull-model.md\",\"case\":false,\"gitignore\":true,\"skip\":0}","call_id":"call_SRKDm4vTxcG68wHjBut1pBgk","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"grep","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1af9c39f887d284e320e779bdb4a8","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating helper field interfaces\",\"pattern\":\"report_user_input_with|gather_file_access_helper|report_user_input|helper-fetch|FILE_ACCESS_HELPER\",\"path\":\"crates;tests;scripts\",\"case\":true,\"gitignore\":true,\"skip\":0}","call_id":"call_OsNZJOnvt6duyNA7x07PeoUU","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"grep","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}}]},"duration":8294.97199999998,"ttft":8262.28409999999,"completedAt":1790029724284,"contextSnapshot":{"promptTokens":11609,"nonMessageTokens":10457,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_OsNZJOnvt6duyNA7x07PeoUU|fc_0c7d22595484f800016ab1af9c39f887d284e320e779bdb4a8","toolName":"grep","startedAt":"2026-09-21T22:28:44.287Z","args":{"path":"crates;tests;scripts"},"intent":"Locating helper field interfaces"},"id":"d8c61bbe","parentId":"fa3f88b8","timestamp":"2026-09-21T22:28:44.287Z"}
{"type":"message","id":"973a773d","parentId":"d8c61bbe","timestamp":"2026-09-21T22:28:44.293Z","message":{"role":"toolResult","toolCallId":"call_SRKDm4vTxcG68wHjBut1pBgk|fc_0c7d22595484f800016ab1af9c39f087d2a6d98b849d844337","toolName":"grep","content":[{"type":"text","text":" 10|its URL; the receiver pulls if and when it wants), or a dedicated transfer verb outside\n*11|messaging. The choice also fixes what the FILE_ACCESS_HELPER now-signal (#17) tells an agent\n 12|to do with a file it was handed.\n 13|\n 14|## Decision\n...\n 20|[dest]`, gives a receiving agent a local copy in one command — that verb string is what\n*21|FILE_ACCESS_HELPER emits.\n 22|\n 23|## Alternatives rejected\n 24|\n...\n 42|\n*43|## Amendment 1 — a user-quoted filepath is served automatically for the receiving agent (operator directive, 2026-09-06; recorded by doyle, forks marked)\n 44|\n 45|The operator directed (releases#17): when a user's message quotes a filepath, spt-core\n 46|automatically serves that file for a limited time (24h TTL) and exposes it **only to the agent\n*47|that received the message**, via the FILE_ACCESS_HELPER now-signal. This widens #17 from\n 48|\"message carries attachments\" to \"user quoted a path\", and it is built as part of WEBSERVE.\n 49|\n 50|How it composes with this ADR and ADR-0057:\n...\n 59| (message, path).\n*60|- **The receiver-side record is trimmed by COUNT, not by time.** The helper line the receiving\n*61| node keeps in the endpoint's perch (`helper-fetch.jsonl`) retains the newest 256 records and\n 62| has **no expiry of its own**. A line can therefore outlive the 24h entry it names: it is a\n 63| log of what was offered, never evidence that the link still resolves. Stated here rather\n 64| than fixed with an `at_ms` sweep, because an expiry added without a rig arm to exercise it\n...\n 74|\n*75|**Ruled (operator, 2026-09-06 ~11:00Z):** a helper-registered file is **reference-served** —\n 76|the user's live file, edits visible, 404 once deleted — not a snapshot. The user said \"look at\n 77|this\", not \"keep this as it was\", and a live reference costs no copy. It is therefore a *file*\n 78|(or *dir*) entry carrying a TTL and an audience, not an *attachment* entry; the TTL/audience\n...\n 80|\n*81|## Amendment 2 — receipt-seat authority for USER_INPUT (operator re-cut, 2026-09-13; releases#300)\n 82|\n 83|\n*84|\n 85|The core-only ruling in [INPUT-PROVENANCE-CONTRACT §8](../INPUT-PROVENANCE-CONTRACT.md#8-ruling-doyle-2026-09-13-re-cut-the-same-day-on-the-operators-direction--core-only-no-token-nothing-asked-of-adapters)\n*86|supersedes Amendment 1's local-readable notice and its proposed new WEB request\n 87|authority for USER_INPUT. Existing MSG_OUT-backed ServeFor authorization remains\n 88|unchanged.\n 89|\n...\n 95|target. The reference origin is `user-input:`. The live-reference kind,\n*96|one-endpoint audience, bounded 24-hour lifetime, and receiver-side helper record\n 97|remain the existing mechanisms.\n 98|\n 99|Core excludes peer-delivery text it physically wrote into the session, comparing"}],"details":{"scopePath":"docs/adr/0058-attachments-are-pull-model.md","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs\\adr\\0058-attachments-are-pull-model.md","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":11,"fileCount":1,"files":["docs/adr/0058-attachments-are-pull-model.md"],"fileMatches":[{"path":"docs/adr/0058-attachments-are-pull-model.md","count":11}],"truncated":false,"displayContent":" 10│its URL; the receiver pulls if and when it wants), or a dedicated transfer verb outside\n*11│messaging. The choice also fixes what the FILE_ACCESS_HELPER now-signal (#17) tells an agent\n 12│to do with a file it was handed.\n 13│\n 14│## Decision\n │...\n 20│[dest]`, gives a receiving agent a local copy in one command — that verb string is what\n*21│FILE_ACCESS_HELPER emits.\n 22│\n 23│## Alternatives rejected\n 24│\n │...\n 42│\n*43│## Amendment 1 — a user-quoted filepath is served automatically for the receiving agent (operator directive, 2026-09-06; recorded by doyle, forks marked)\n 44│\n 45│The operator directed (releases#17): when a user's message quotes a filepath, spt-core\n 46│automatically serves that file for a limited time (24h TTL) and exposes it **only to the agent\n*47│that received the message**, via the FILE_ACCESS_HELPER now-signal. This widens #17 from\n 48│\"message carries attachments\" to \"user quoted a path\", and it is built as part of WEBSERVE.\n 49│\n 50│How it composes with this ADR and ADR-0057:\n │...\n 59│ (message, path).\n*60│- **The receiver-side record is trimmed by COUNT, not by time.** The helper line the receiving\n*61│ node keeps in the endpoint's perch (`helper-fetch.jsonl`) retains the newest 256 records and\n 62│ has **no expiry of its own**. A line can therefore outlive the 24h entry it names: it is a\n 63│ log of what was offered, never evidence that the link still resolves. Stated here rather\n 64│ than fixed with an `at_ms` sweep, because an expiry added without a rig arm to exercise it\n │...\n 74│\n*75│**Ruled (operator, 2026-09-06 ~11:00Z):** a helper-registered file is **reference-served** —\n 76│the user's live file, edits visible, 404 once deleted — not a snapshot. The user said \"look at\n 77│this\", not \"keep this as it was\", and a live reference costs no copy. It is therefore a *file*\n 78│(or *dir*) entry carrying a TTL and an audience, not an *attachment* entry; the TTL/audience\n │...\n 80│\n*81│## Amendment 2 — receipt-seat authority for USER_INPUT (operator re-cut, 2026-09-13; releases#300)\n 82│\n 83│\n*84│\n 85│The core-only ruling in [INPUT-PROVENANCE-CONTRACT §8](../INPUT-PROVENANCE-CONTRACT.md#8-ruling-doyle-2026-09-13-re-cut-the-same-day-on-the-operators-direction--core-only-no-token-nothing-asked-of-adapters)\n*86│supersedes Amendment 1's local-readable notice and its proposed new WEB request\n 87│authority for USER_INPUT. Existing MSG_OUT-backed ServeFor authorization remains\n 88│unchanged.\n 89│\n │...\n 95│target. The reference origin is `user-input:`. The live-reference kind,\n*96│one-endpoint audience, bounded 24-hour lifetime, and receiver-side helper record\n 97│remain the existing mechanisms.\n 98│\n 99│Core excludes peer-delivery text it physically wrote into the session, comparing"},"isError":false,"timestamp":1790029724293}}
{"type":"message","id":"a0e58b8b","parentId":"973a773d","timestamp":"2026-09-21T22:28:44.294Z","message":{"role":"toolResult","toolCallId":"call_zFVdIjQQp1xGx0ePeC3aCfZf|fc_0c7d22595484f800016ab1af9c39e487d29f58dd14fac64681","toolName":"read","content":[{"type":"text","text":"# Attachments and `spt fetch`\n\nSending a file with a message does not push bytes to the receiver. The file is\nsnapshot into this node's own store, registered for serving, and the message\ncarries its URL. The receiver decides whether to pull it, and when.\n\n\n## Attaching a file to a message\n\n```console\n$ printf 'the report you asked for' | spt send doyle --attachment ./report.md\nATTACHED:report.md: http://localhost:5474/hfenduleam/f/report.md (2481 bytes, ttl 2592000000ms)\nSENT:doyle\n```\n\n`--attachment` repeats; each file becomes its own registry entry with its own\nURL. The message envelope grows an `attachments` attribute carrying, per file,\nits served name, its URL and its size in bytes — so a receiving agent can decide\nwhether to fetch **before** it fetches. A core that has never heard of the\nattribute delivers the message unchanged.\n\nAn attachment is a **snapshot**, and that is the one place the serving registry\ndoes not resolve at request time:\n\n| | `spt serve add` | `spt send --attachment` |\n|---|---|---|\n| What is served | the file at its path | a copy taken at send time |\n| Editing the source | the reader sees the edit | the reader still sees what was sent |\n| Deleting the source | the URL answers 404 | the URL keeps serving |\n| Lifetime | until removed | a TTL, 30 days by default |\n\nA message's attachment is as immutable as the message: an edit after the send\nmust not change what the receiver pulls, and deleting the original must not\nturn a delivered link into a dead one.\n\nTwo sends of the same filename get two stable, distinct URLs under the\nregistry's ordinary disambiguation rule (`report.md`, then `report~1.md`), so no\nlink ever changes meaning.\n\nA missing or unreadable path **refuses the send by name** — nothing is\ndelivered and nothing is spooled — rather than delivering a message whose link\nis dead on arrival:\n\n```console\n$ printf 'here' | spt send doyle --attachment ./nope.md\nATTACHMENT_REFUSED:./nope.md: The system cannot find the file specified. (nothing was sent)\n```\n\n### Lifetime\n\n`--ttl` sets this send's lifetime and **requires a unit** — `s`, `m`, `h` or\n`d`. A bare number is refused rather than guessed, because `30` meaning seconds\nwhen the sender meant days is a deleted attachment.\n\n```console\n$ printf 'valid for a day' | spt send doyle --attachment ./build.log --ttl 24h\n```\n\nThe brain's pulse reaps expired registry entries and logs how many it removed.\nFor an attachment, it attempts to unlink the core-owned snapshot **before**\nsaving the registry without that entry. These are not one atomic transaction:\nif saving fails after unlinking, the next pulse can finish removing the expired\nentry even though its snapshot is already gone. Saving first could instead\nleave untracked snapshot bytes that later pulses cannot find.\n\nOnly attachment snapshots under `$SPT_HOME/serve/snapshots/` are candidates for\nunlinking. Expiry removes a live file or directory reference from the registry\nbut **never deletes the user's source**. The\n[writer-coordination contract](overview.md#register-inspect-remove) keeps the\nguard across the reaper's fresh load, snapshot cleanup, and explicit save;\na pass with nothing expired does not save the registry.\n\nAn expired entry stops serving the moment it expires, whether or not the\nreaper has run yet: between expiry and the next tick the bytes may still be\non disk, and serving them would make the TTL a suggestion.\n\n\n## Pulling one: `spt fetch`\n\n```console\n$ spt fetch hfenduleam/f/report.md\nreport.md\n$ spt fetch http://localhost:5474/hfenduleam/f/report.md ~/inbox/report.md\n/home/reavus/inbox/report.md\n```\n\nIt accepts a full node-prefixed URL or the bare `/f/` shorthand —\nthe shorthand is how a link is said between agents, and the host and port belong\nto whichever node is doing the fetching. The written path is printed on stdout\nso a caller can pipe it.\n\nWithout a destination the file lands in the current directory under its served\nname. An existing destination is **not** overwritten without `--force`. The body\nstreams to a temporary file and is renamed into place, so an interrupted or\nrefused fetch never leaves a truncated file where a later reader would trust it.\n\nThe three outcomes are distinct, and the distinction is the point:\n\n| Exit | Meaning |\n|---|---|\n| `0` | The file was written; its path is on stdout. |\n| `3` | The owner **refused** it — an access decision. Retrying is wrong. |\n| `1` | Anything else: unreachable owner, not found, a deadline, a local write error. |\n\nEvery fetch — local or remote — is served through the local daemon's web\nsurface, the same path a browser takes, so a fetch of your own node's file\nexercises the code a remote fetch will use.\n\n\n## The `FILE_ACCESS_HELPER` signal\n\nAn agent does not have to notice an attachment. When a delivered message carries\none, the now-signal hands the agent the exact command to run, taken verbatim\nfrom the envelope:\n\n```text\n\nspt fetch http://localhost:5474/kitsubito/f/report.md\n\n```\n\n\nThe same category answers the other way a file arrives: **a user quoting a\nfilepath while controlling the receiving agent through remote `spt rc`**.\nCore binds the existing session-authenticated input report to the broker's live\nremote controller when the report arrives. A later controller change cannot\nreattribute it. Registration happens on that controller's machine, not by looking\nfor a similarly named file on the receiving machine.\n\nThe file is a **live reference**, not an attachment snapshot: edits are visible\nand deletion returns not found. The reference lasts up to **24 hours**, addressed\nonly to the receiving endpoint. The fetch command appears on a subsequent signal\npoll once the owner answers; input processing never waits for that answer.\n\n- **Absolute or `~`-rooted only.** The owner resolves `~` against its own home.\n A relative path has no anchor on another node. At most **five** paths per report;\n directories receive the same lifetime and audience.\n- **No quoted paths means no broker IPC and no line.** An absent hosted session,\n local or viewer-only seat, or no controller binds nothing silently. A missing\n file on the bound owner's machine is also silent, with no fallback origin.\n- CLI broker-connect and unanswered-receipt failures are silent unless\n `SPT_PUMP_TRACE` enables diagnostics. Named declines apply only to failures with\n a remote controller, such as an invalid session, uncertain delivery-byte evidence,\n or owner refusal. The broker's **10-second owner-reply timeout** remains named.\n- A repeated payload in the same harness session does not register again, repeat\n the helper notice, or extend an existing reference's deadline.\n- Core excludes bytes it knows it physically wrote for peer delivery: either an\n exact match or a match after trimming ASCII whitespace from both byte sequences'\n ends. It does not parse message shapes or normalize interior text. This is\n **receipt-seat attribution**, not proof of who typed every byte: external\n automation and native harness re-submission cannot be distinguished beyond the\n current controller seat. No adapter token or integration change is required.\n\nEvery entry the helper registers is enumerable in `spt serve list` with its\norigin, so an automatic exposure is exactly as visible as a deliberate one.\n\nTwo-node field acceptance remains pending, separate from doc/impl/unit evidence.\nIt must include a remote controller remaining seated while core physically delivers\na path-bearing peer message, whose input report must cause **no serve**, and measure\nthe added hook cost. Neither obligation is claimed as executed here.\n\n\n## Reading a message back\n\nEvery message carries a short-ID, and an attachment link is part of what that id\nrenders — `spt msg show ` prints the message with its attachment URLs, and\n`//m/` is the same view in a browser. See\n[Messaging](../messaging/overview.md) for the id itself."}],"details":{"totalLines":168,"displayContent":{"text":"# Attachments and `spt fetch`\r\n\r\nSending a file with a message does not push bytes to the receiver. The file is\r\nsnapshot into this node's own store, registered for serving, and the message\r\ncarries its URL. The receiver decides whether to pull it, and when.\r\n\r\n\r\n## Attaching a file to a message\r\n\r\n```console\r\n$ printf 'the report you asked for' | spt send doyle --attachment ./report.md\r\nATTACHED:report.md: http://localhost:5474/hfenduleam/f/report.md (2481 bytes, ttl 2592000000ms)\r\nSENT:doyle\r\n```\r\n\r\n`--attachment` repeats; each file becomes its own registry entry with its own\r\nURL. The message envelope grows an `attachments` attribute carrying, per file,\r\nits served name, its URL and its size in bytes — so a receiving agent can decide\r\nwhether to fetch **before** it fetches. A core that has never heard of the\r\nattribute delivers the message unchanged.\r\n\r\nAn attachment is a **snapshot**, and that is the one place the serving registry\r\ndoes not resolve at request time:\r\n\r\n| | `spt serve add` | `spt send --attachment` |\r\n|---|---|---|\r\n| What is served | the file at its path | a copy taken at send time |\r\n| Editing the source | the reader sees the edit | the reader still sees what was sent |\r\n| Deleting the source | the URL answers 404 | the URL keeps serving |\r\n| Lifetime | until removed | a TTL, 30 days by default |\r\n\r\nA message's attachment is as immutable as the message: an edit after the send\r\nmust not change what the receiver pulls, and deleting the original must not\r\nturn a delivered link into a dead one.\r\n\r\nTwo sends of the same filename get two stable, distinct URLs under the\r\nregistry's ordinary disambiguation rule (`report.md`, then `report~1.md`), so no\r\nlink ever changes meaning.\r\n\r\nA missing or unreadable path **refuses the send by name** — nothing is\r\ndelivered and nothing is spooled — rather than delivering a message whose link\r\nis dead on arrival:\r\n\r\n```console\r\n$ printf 'here' | spt send doyle --attachment ./nope.md\r\nATTACHMENT_REFUSED:./nope.md: The system cannot find the file specified. (nothing was sent)\r\n```\r\n\r\n### Lifetime\r\n\r\n`--ttl` sets this send's lifetime and **requires a unit** — `s`, `m`, `h` or\r\n`d`. A bare number is refused rather than guessed, because `30` meaning seconds\r\nwhen the sender meant days is a deleted attachment.\r\n\r\n```console\r\n$ printf 'valid for a day' | spt send doyle --attachment ./build.log --ttl 24h\r\n```\r\n\r\nThe brain's pulse reaps expired registry entries and logs how many it removed.\r\nFor an attachment, it attempts to unlink the core-owned snapshot **before**\r\nsaving the registry without that entry. These are not one atomic transaction:\r\nif saving fails after unlinking, the next pulse can finish removing the expired\r\nentry even though its snapshot is already gone. Saving first could instead\r\nleave untracked snapshot bytes that later pulses cannot find.\r\n\r\nOnly attachment snapshots under `$SPT_HOME/serve/snapshots/` are candidates for\r\nunlinking. Expiry removes a live file or directory reference from the registry\r\nbut **never deletes the user's source**. The\r\n[writer-coordination contract](overview.md#register-inspect-remove) keeps the\r\nguard across the reaper's fresh load, snapshot cleanup, and explicit save;\r\na pass with nothing expired does not save the registry.\r\n\r\nAn expired entry stops serving the moment it expires, whether or not the\r\nreaper has run yet: between expiry and the next tick the bytes may still be\r\non disk, and serving them would make the TTL a suggestion.\r\n\r\n\r\n## Pulling one: `spt fetch`\r\n\r\n```console\r\n$ spt fetch hfenduleam/f/report.md\r\nreport.md\r\n$ spt fetch http://localhost:5474/hfenduleam/f/report.md ~/inbox/report.md\r\n/home/reavus/inbox/report.md\r\n```\r\n\r\nIt accepts a full node-prefixed URL or the bare `/f/` shorthand —\r\nthe shorthand is how a link is said between agents, and the host and port belong\r\nto whichever node is doing the fetching. The written path is printed on stdout\r\nso a caller can pipe it.\r\n\r\nWithout a destination the file lands in the current directory under its served\r\nname. An existing destination is **not** overwritten without `--force`. The body\r\nstreams to a temporary file and is renamed into place, so an interrupted or\r\nrefused fetch never leaves a truncated file where a later reader would trust it.\r\n\r\nThe three outcomes are distinct, and the distinction is the point:\r\n\r\n| Exit | Meaning |\r\n|---|---|\r\n| `0` | The file was written; its path is on stdout. |\r\n| `3` | The owner **refused** it — an access decision. Retrying is wrong. |\r\n| `1` | Anything else: unreachable owner, not found, a deadline, a local write error. |\r\n\r\nEvery fetch — local or remote — is served through the local daemon's web\r\nsurface, the same path a browser takes, so a fetch of your own node's file\r\nexercises the code a remote fetch will use.\r\n\r\n\r\n## The `FILE_ACCESS_HELPER` signal\r\n\r\nAn agent does not have to notice an attachment. When a delivered message carries\r\none, the now-signal hands the agent the exact command to run, taken verbatim\r\nfrom the envelope:\r\n\r\n```text\r\n\r\nspt fetch http://localhost:5474/kitsubito/f/report.md\r\n\r\n```\r\n\r\n\r\nThe same category answers the other way a file arrives: **a user quoting a\r\nfilepath while controlling the receiving agent through remote `spt rc`**.\r\nCore binds the existing session-authenticated input report to the broker's live\r\nremote controller when the report arrives. A later controller change cannot\r\nreattribute it. Registration happens on that controller's machine, not by looking\r\nfor a similarly named file on the receiving machine.\r\n\r\nThe file is a **live reference**, not an attachment snapshot: edits are visible\r\nand deletion returns not found. The reference lasts up to **24 hours**, addressed\r\nonly to the receiving endpoint. The fetch command appears on a subsequent signal\r\npoll once the owner answers; input processing never waits for that answer.\r\n\r\n- **Absolute or `~`-rooted only.** The owner resolves `~` against its own home.\r\n A relative path has no anchor on another node. At most **five** paths per report;\r\n directories receive the same lifetime and audience.\r\n- **No quoted paths means no broker IPC and no line.** An absent hosted session,\r\n local or viewer-only seat, or no controller binds nothing silently. A missing\r\n file on the bound owner's machine is also silent, with no fallback origin.\r\n- CLI broker-connect and unanswered-receipt failures are silent unless\r\n `SPT_PUMP_TRACE` enables diagnostics. Named declines apply only to failures with\r\n a remote controller, such as an invalid session, uncertain delivery-byte evidence,\r\n or owner refusal. The broker's **10-second owner-reply timeout** remains named.\r\n- A repeated payload in the same harness session does not register again, repeat\r\n the helper notice, or extend an existing reference's deadline.\r\n- Core excludes bytes it knows it physically wrote for peer delivery: either an\r\n exact match or a match after trimming ASCII whitespace from both byte sequences'\r\n ends. It does not parse message shapes or normalize interior text. This is\r\n **receipt-seat attribution**, not proof of who typed every byte: external\r\n automation and native harness re-submission cannot be distinguished beyond the\r\n current controller seat. No adapter token or integration change is required.\r\n\r\nEvery entry the helper registers is enumerable in `spt serve list` with its\r\norigin, so an automatic exposure is exactly as visible as a deliberate one.\r\n\r\nTwo-node field acceptance remains pending, separate from doc/impl/unit evidence.\r\nIt must include a remote controller remaining seated while core physically delivers\r\na path-bearing peer message, whose input report must cause **no serve**, and measure\r\nthe added hook cost. Neither obligation is claimed as executed here.\r\n\r\n\r\n## Reading a message back\r\n\r\nEvery message carries a short-ID, and an attachment link is part of what that id\r\nrenders — `spt msg show ` prints the message with its attachment URLs, and\r\n`//m/` is the same view in a browser. See\r\n[Messaging](../messaging/overview.md) for the id itself.\r","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168]},"fileSize":8350,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs-site\\src\\serving\\attachments.md"}}},"isError":false,"timestamp":1790029724294}}
{"type":"message","id":"ad4a4c2a","parentId":"a0e58b8b","timestamp":"2026-09-21T22:28:44.305Z","message":{"role":"toolResult","toolCallId":"call_p8x0W0CN4yGXpAQStW4rghLE|fc_0c7d22595484f800016ab1af9c39ec87d2a7e05245791033ab","toolName":"read","content":[{"type":"text","text":"# Receipt-bound input provenance — core-only contract\n\n**Current contract: §8, core-only.** Sections 0–7 retain the superseded\nadapter-design discussion and measurements; they impose no adapter obligations.\nThe implementation uses the existing USER_INPUT reports and controller rc stream.\nThe two-node field acceptance remains separate from the doc/impl/unit lane.\n\n## The operator decision this contract is bound to\n\n**Provenance follows the SUBMITTER, not the AUTHOR.** The origin used is the computer of the person who\nsubmits the input — never the computer of whoever typed the characters, when those differ.\n\n**Reavo, verbatim as relayed by lia** (lia's message `5Y45PXOU`; relay chain Reavo → lia → doyle →\ntodlando — doyle did NOT receive it directly from Reavo):\n\n> yes, it should use the sender's computer. if the provided filepath doesn't match a file there, then\n> simply skip fileserving\n\n**Two things are NOT inside that quotation and are attributed separately, so nobody cites the operator\nfor them:**\n\n- **\"No reliable sender, no automatic share\"** — the ADOPTED SAFETY RULE (doyle, 2026-09-12). It is a\n gate policy adopted alongside the decision, not part of Reavo's words.\n- **No prompt, and no fallback to another origin** — doyle's instruction on how the skip behaves\n (B7ZLOLBZ). The quotation says \"simply skip fileserving\"; that the skip is silent and never retries\n against a different machine is the gate's reading of it, stated as instruction.\n\n**What this settles and what it does not** (doyle, B7ZLOLBZ): the submitter rule settles the\nEXPERIENCE. Enqueue/dequeue ordering and human-versus-machine injection remain **mechanism questions to\nresolve** — they are not reasons to reopen the settled experience, and an adapter answer that disputes\nthe experience rather than describing its mechanism is answering the wrong question.\n\n**Historic audience: adapter owners.** The introduction and §§0–7 below retain the superseded\nadapter-design discussion. Their proposed obligations and refusal rules are historical, not the\ncurrent contract; §8 replaces them and asks nothing new of adapters.\n\n## 0. The problem in one paragraph\n\nWhen a user drives a remote endpoint (`spt rc` from their machine to an agent on another machine) and\ntheir typed words quote an absolute path on THEIR machine, spt is supposed to serve that file to the\nreceiving agent automatically, as a scoped live reference (#17, ADR-0058 Am.1). It does not, because\nthe two halves never meet: the bytes arrive with a proven origin, and the harness reports the\nSEMANTIC submission later, with no carried association between them. The fix is not to guess the\nassociation. It is for the harness to capture provenance at the moment it accepts a submission, and\ncarry it with that submission.\n\nThe question this contract answers is **\"whose computer does this path refer to?\"**, and the answer is\nthe submitter's. It is deliberately NOT \"who wrote these characters?\" — that question is settled and\nout of scope (see the decision above). An adapter's whole job here is to capture the submitting\nattachment's token at acceptance and carry it, unaltered, to the report.\n\n## 1. Why the obvious shortcut is forbidden\n\n**Never sample the current controller at report time.** Reading \"who is attached right now\" when a\nsubmission is REPORTED is not an answer to \"who submitted this\", for three independent reasons:\n\n- A submission can be **accepted, queued, and reported later**. Between those moments the controller\n seat can change hands. The sample then names someone who did not submit it.\n- **Continuity does not rescue the sample.** A token minted for B *after* A's submission was queued,\n still current when that submission is reported, is both unretired and continuously held — and still\n names the wrong origin. (This refutes an earlier draft of mine; doyle's, 2026-09-12.)\n- \"Somebody is driving\" and \"which node is driving\" are **different facts with different\n availability** — one can be known while the other is not.\n\n**What the submitter rule does and does not relax.** It removes the question of who typed the\ncharacters: if A types into a buffer and B submits, the origin is **B's computer, deliberately**, and\nthat is the settled experience rather than a defect to engineer around. It does NOT license sampling,\nbecause the sample is taken at the wrong MOMENT, not merely against the wrong PERSON. Acceptance is\nwhen a submitter submits; report time is some time afterwards, and the gap is exactly what this\ncontract exists to bridge.\n\nConsequently: **an adapter that cannot capture at acceptance must produce a named refusal, not a\nfallback.** There is no degraded mode that samples. A refusal is a correct outcome; a guess is not.\n\n## 2. Terms\n\n- **Submission** — one semantic unit of user input that the harness has ACCEPTED from the user: the\n thing a user means when they say \"I sent that\". Not a keystroke, not a byte chunk, not a turn.\n- **Submitter** — the controlling attachment that SUBMITS a submission at the acceptance surface. Its\n node is the origin this contract binds to. Deliberately **not** \"whoever typed the characters\": when\n those differ, the submitter wins, by operator decision. An adapter never needs to determine who\n typed anything.\n- **Acceptance surface** — the point in the harness where a submission becomes committed by the user\n and can no longer be edited: where \"the user pressed send\". The contract lives here. If a harness\n has no such point, it cannot satisfy this contract, and that is the concrete limitation to report.\n- **Provenance token** — an opaque string, issued by spt to a controlling attachment, which carries\n the authenticated identity of the controller's node. Adapters never parse it, never construct one,\n and never infer one; they read it, hold it, and hand it back.\n- **Submission id** — an adapter-chosen identifier, unique within the session, naming one submission.\n It exists so a report can be matched to an acceptance and so a replay is recognisable.\n\n## 3. What the adapter must do\n\n1. **Capture at acceptance, before any queue.** At its acceptance surface, the adapter reads the\n provenance token then current and stores it WITH that submission, together with a submission id\n it chooses. The capture must happen before the submission can be queued, deferred, or reordered.\n Capturing later — at turn start, at tool time, at report time — does not satisfy this contract,\n because those points are after the boundary the defect lives on.\n\n **RESOLVED BY THE SUBMITTER RULE — this was the draft's biggest open question and it is now\n closed.** Earlier revisions treated buffered input across a handoff as an unresolved gap: A types,\n the bytes sit in a terminal or client buffer, B takes the seat, and the harness accepts a submission\n whose characters A wrote while the current token is B's. Under Reavo's decision that is **not a\n defect**: the origin is the SENDER'S computer — B's — and the token current at acceptance is the\n correct answer, not an approximation of a better one. Adapters must NOT add machinery to attribute\n text back to whoever typed it.\n\n What remains is a MECHANISM question, and it is the one to answer: **exactly where your acceptance\n point sits relative to your queue** — enqueue-versus-dequeue ordering, and whether machine-injected\n input (hooks, replays, automation writing into the same path) is distinguishable from a human\n pressing send. Those are unsettled and are what §5 asks about. They are not grounds to reopen the\n submitter rule.\n2. **Carry it through whatever the harness does next. Authorization binds to the bytes that were\n accepted.** If the harness queues or delays the submission, the captured token travels with it\n unchanged.\n\n **The record is of the ORIGINAL ACCEPTED BYTES, and later rewriting does not invalidate it.** What\n was accepted was accepted; a harness that edits the text afterwards does not retroactively make the\n capture false. What rewriting must never do is EXTEND that authorization: a rewritten path, or a\n path newly introduced after acceptance, gains nothing from the original record. Authorization\n covers the paths quoted in the bytes whose acceptance was captured, and no others.\n\n **An adapter that cannot observe later edits MUST NOT PROMISE TO DETECT THEM.** Saying \"I will\n treat each edit as a new submission\" is a capability claim, and on a harness with no\n post-acceptance observation it is one the adapter cannot keep. The honest position is to bind the\n captured bytes, report that later edits are unobservable, and let the contract — not the adapter's\n optimism — decide what that costs. Reporting the limitation satisfies this clause; silently\n implying detection does not.\n3. **Report it with the payload.** When the adapter reports the submission to spt, it reports, in one\n call: the submission id, the captured token, and the **exact final payload text** of that\n submission. The payload reported must be the text as committed, not a normalised, truncated or\n re-rendered version.\n4. **Never substitute.** If no token was captured — a local user, a viewer, a harness surface that\n cannot reach the acceptance point — the adapter reports the submission with **no token**. It must\n not report the current token instead, and must not synthesise one from terminal bytes, window\n state or timing.\n5. **Report once per submission.** One acceptance, one report. A retry after a transport failure\n repeats the same submission id and the same payload.\n\n## 4. What spt guarantees in return\n\n1. **Token issuance.** A controlling attachment over an authenticated remote origin is issued a\n provenance token bound to that origin, to the session, and to the attachment's own occupancy of\n the controller seat. A read-only viewer is issued none.\n2. **Binding, and an honest split of who establishes it.** Authorization is computed from the reported\n token plus the reported payload: the audience is the receiving endpoint, and the only paths\n considered are absolute paths quoted inside THAT payload. No other text and no terminal stream is\n read. But receiving a token and a text in one call does NOT by itself establish that the text is\n what that token's holder submitted, and this contract does not pretend otherwise (doyle,\n 2026-09-12):\n\n - **The adapter is trusted for, and solely responsible for, the association**: that this payload is\n the text of the submission whose acceptance it captured, and that the token it reports is the one\n read at that capture. Core cannot observe the acceptance and cannot reconstruct it afterwards.\n - **Core can independently verify** only: that the token is authentic and was issued by this node;\n which authenticated origin node, session and incarnation it was issued to; whether its issuing\n seat occupancy has ended, and when; that the submission id has not been used before within the\n session and incarnation; that the payload hashes to the value bound to that submission id on any\n repeat report; and that the paths it acts on are quoted inside the reported payload.\n - Therefore a dishonest or defective adapter can misattribute text within the trust it already\n holds over the session. This contract narrows that to the adapter's own acceptance path; it does\n not remove it, and no wording in it should be read as core-side proof of authorship.\n3. **Serving semantics, unchanged from #17 / ADR-0058 Am.1.** A live reference on the submitter's own\n machine, 24h TTL, audience scoped to the receiving agent, and a FILE_ACCESS_HELPER notice emitted\n once per submission and path.\n\n **A path that names no file on the submitter's machine is SILENTLY SKIPPED.** Reavo: \"if the\n provided filepath doesn't match a file there, then simply skip fileserving\". The skip is silent —\n **no prompt, no notice, no named refusal on that path** (doyle's reading, B7ZLOLBZ) — and there is\n **no fallback to another origin**: spt does not look for the file on the receiving machine, on a\n previous controller's machine, or anywhere else. A quoted path that does not resolve on the\n submitter's computer simply does not become a reference, and the submission is processed exactly as\n if it had quoted nothing. This is the one non-grant in this contract that is NOT announced, and it\n is deliberate: a user quoting a path that happens not to exist on their machine is an ordinary\n event, not an error to report.\n4. **No reliable sender, no automatic share — the adopted safety rule** (doyle, 2026-09-12; a gate\n policy adopted alongside Reavo's decision, NOT part of it). Where the submitting origin is not\n established to the standard §4.1 requires, nothing is served automatically. This is a refusal to act\n on an unestablished origin, and it is distinct from the silent skip above: the skip is a path that\n resolved to nothing on a KNOWN sender's machine; this is not knowing the sender. **What makes a\n sender \"unreliable\" is NOT DEFINED in this contract and is not the adapter's to decide** — it is a\n core-side and gate-side question, deliberately left open rather than invented here.\n5. **Handoff.** A token stops being issued the moment its holder stops holding the seat. A new holder's\n token can never redeem a previous holder's submission.\n\n **UNRESOLVED — NOT AN AUTHORIZED GUARANTEE (doyle, 2026-09-12).** The proposal is that a submission\n whose token was captured while its holder still held the seat stays authorizable for a BOUNDED\n grace period after the seat changes, on the reasoning that capture and not report is when the\n SUBMISSION happened. That is a proposal only. It no longer depends on the buffered-authorship\n question — that is settled (§3.1) — but it does depend on the still-open ordering question (§5.2):\n if acceptance is at dequeue rather than enqueue, \"captured while its holder held the seat\" is not\n established by capture alone. It may not be relied upon.\n The bound also has no value yet and must be justified rather than picked. Until both are ruled, the\n safe reading is that a token whose issuing occupancy has ended is refused by name.\n6. **Replay.** A submission id is single-use **within the session and incarnation, across every token\n issued in it** — not merely per token. Rotating or re-issuing a token must not let the same\n submission register a second time (doyle, 2026-09-12). Re-reporting the same id and payload\n re-registers nothing, emits no second helper notice, and **does not extend an existing TTL**. The\n same id with a different payload, or under a different token, is refused by name rather than treated\n as an update.\n7. **Refusal is named — with exactly one silent exception.** Every AUTHORIZATION non-grant says which\n condition failed, on the existing declined line: no token; token not valid for this session or\n incarnation; token past its grace bound; viewer; submission id reused with different payload;\n payload quoted no absolute path; sender not established (§4.4).\n\n **The exception is §4.3's missing file, and it is silent by decision, not by omission.** A quoted\n path that resolves to nothing on the submitter's machine produces no declined line, no notice and\n no name. The distinction is: a REFUSAL means the authorization failed; a SKIP means authorization\n was fine and there was simply no file there. Do not collapse the two, and do not add a named refusal\n for the skip on the grounds that every other outcome has one.\n8. **Separation of concerns, structurally.** Input processing and serving authorization are\n independent: a refused authorization never alters, delays or fails the submission itself, and a\n submission is delivered and processed identically whether or not a token rode with it.\n\n## 5. The question for adapter owners\n\nUsing only this document:\n\n1. Does your harness have an **acceptance surface** as defined in §2 — a point where a submission is\n committed by the user and is not yet queued?\n2. **The ordering question — this replaces the old buffered-authorship question, which is now\n settled.** Do NOT answer about who typed the characters: under the submitter rule the token current\n at acceptance is correct by definition, even if someone else typed the text. Answer instead about\n your QUEUE: does your acceptance point sit at **enqueue** (the submission is captured as it enters\n the queue) or at **dequeue** (captured as the harness takes it off for processing)? If it is\n dequeue, what can change the seat between the two, and can your adapter reach the enqueue point at\n all?\n2b. **Machine-injected input.** Can input reach that same acceptance surface WITHOUT a human pressing\n send — hooks, replayed or scripted input, automation writing into the same path, a resumed session\n re-submitting? Can your adapter tell that case apart from a human submission, and what does it\n currently capture for it? A machine injection that captures the seat-holder's token would attribute\n a machine's submission to a person, which is a mechanism question this contract has NOT resolved.\n3. At that point, can the adapter **read and store** a value, and keep it associated with that exact\n submission through any queueing the harness performs? Can the harness EDIT or SPLIT the text after\n acceptance, and if so can your adapter OBSERVE that it did (§3.2)? Answer what you can observe, not\n what you would like to guarantee: if there is no post-acceptance observation, say so — an adapter\n that cannot see later edits must not promise to detect them, and reporting the limitation is the\n answer this contract wants.\n4. When the submission is reported, can the adapter include the stored value, its own submission id,\n and the **exact committed payload text** in the same report?\n5. If any of those is impossible, **what precisely is missing** — a hook that does not exist, a hook\n that fires too late, a buffer the adapter cannot see behind, an association the harness drops, a\n payload the harness rewrites?\n\nAnswer (5) concretely if it applies. A named limitation is the useful answer and the one that gets a\ndecision; \"probably fine\" is not, and neither is a workaround that samples the current controller.\n**An answer here is feasibility input, not approval**: doyle holds the approval, and the clauses marked\nunresolved below are not guarantees an adapter may build against yet.\n\n## 6. Known open items, so nobody assumes they are settled\n\n- **CLOSED, recorded so nobody reopens it:** \"which controller's text is this, if one typed and\n another sent\" is SETTLED by Reavo's decision — the sender's computer, full stop. Earlier revisions of\n this document carried it as the biggest open question; it is not one. Re-raising it is out of scope,\n and an adapter must not build attribution machinery to answer it.\n- **Enqueue-versus-dequeue ordering is a MECHANISM question, still open** (doyle, B7ZLOLBZ). Where the\n acceptance point sits relative to the queue decides whether \"the token current at acceptance\" is the\n submitter's token in practice. Adapter answers to §5.2 are the input to that ruling. It does not\n reopen the experience.\n- **ORIGIN SIGNALING IS AN UNRESOLVED REQUIREMENT, not an adapter chore** (doyle). Machine-injected\n submissions were MEASURED indistinguishable from human ones at the harness level (§7), and the only\n separator in the field today is an adapter recognising its own transport's payload shapes — a\n heuristic that establishes \"this looks like something spt sent\", never \"a person submitted this\".\n Recognizing payload shapes is not authenticated human provenance. What is missing is a trustworthy\n origin signal; until one exists such submissions report with no token, which is a floor and not a\n solution. Adapter answers to §5.2b describe the gap; they do not close it.\n- **A resumed session re-submitting and externally scripted input are SEPARATE, both uncharacterised**,\n and external automation is **not** equivalent to a resumed session — neither answer follows from the\n other.\n- **What makes a sender \"unreliable\" (§4.4) is UNDEFINED here** and is deliberately not the adapter's\n to decide. The adopted safety rule says no automatic share in that case; the threshold is core-side\n and gate-side.\n- **The post-handoff grace period (§4.5) is a PROPOSAL, not an authorized guarantee.** The submitter\n rule reduces its urgency — the submitter is by definition whoever held the seat at acceptance — but\n it is still unruled, and its bound still has **no value**; it must be justified, not picked.\n- **§4.2's split of responsibility is deliberate**: the association is the adapter's to establish and\n core cannot verify it independently. Nothing in this contract is core-side proof of authorship.\n- Whether the token is readable through an existing authenticated read verb, or needs a new surface,\n is **not decided** and is deliberately absent from this contract — it is an implementation question\n and adapter owners should not need it to answer §5.\n- Acceptance criteria for #300 live on the issue (comment 5645159945) and are proposed, not granted.\n- If no shipped adapter can satisfy §3.1, that is a concrete limitation for an operator decision via\n lia, not a licence to reduce the behaviour.\n- The **silent skip** (§4.3) is the one non-grant that emits nothing. It is easy to misread as a bug\n report waiting to happen — \"the file didn't get shared and nothing said why\" — and it is deliberate.\n If experience shows users need a signal, that is a new operator decision, not a contract correction.\n\n## 7. Adapter answers on record\n\n### claude-spt (perri, 2026-09-12) — answered against this frame, with measurements\n\n**§5.1 acceptance surface: YES.** `UserPromptSubmit` fires when a submission is committed, before the\nmodel sees it, carrying the exact committed text and session id, and can block.\n\n**Two holes, and they are TWO SEPARATE POPULATIONS** — perri's precision fix, kept apart here because\nthey need different contract language and merging them states something false about both:\n\n- **All submissions: 302 audited, 227 hook-covered.** The 75 misses are harness-synthesised transcript\n entries OR built-in local slash commands (`/compact`, `/reload-plugins` mid-session are the clean\n cases). This is a **surface gap the adapter cannot close**.\n…\n\n…\n\n…\n\n…\nin §7 are not execution evidence for this implementation.\n\n[Showing lines 1-300 of 503. Use :301 to continue]"}],"details":{"truncation":{"content":"# Receipt-bound input provenance — core-only contract\r\n\r\n**Current contract: §8, core-only.** Sections 0–7 retain the superseded\r\nadapter-design discussion and measurements; they impose no adapter obligations.\r\nThe implementation uses the existing USER_INPUT reports and controller rc stream.\r\nThe two-node field acceptance remains separate from the doc/impl/unit lane.\r\n\r\n## The operator decision this contract is bound to\r\n\r\n**Provenance follows the SUBMITTER, not the AUTHOR.** The origin used is the computer of the person who\r\nsubmits the input — never the computer of whoever typed the characters, when those differ.\r\n\r\n**Reavo, verbatim as relayed by lia** (lia's message `5Y45PXOU`; relay chain Reavo → lia → doyle →\r\ntodlando — doyle did NOT receive it directly from Reavo):\r\n\r\n> yes, it should use the sender's computer. if the provided filepath doesn't match a file there, then\r\n> simply skip fileserving\r\n\r\n**Two things are NOT inside that quotation and are attributed separately, so nobody cites the operator\r\nfor them:**\r\n\r\n- **\"No reliable sender, no automatic share\"** — the ADOPTED SAFETY RULE (doyle, 2026-09-12). It is a\r\n gate policy adopted alongside the decision, not part of Reavo's words.\r\n- **No prompt, and no fallback to another origin** — doyle's instruction on how the skip behaves\r\n (B7ZLOLBZ). The quotation says \"simply skip fileserving\"; that the skip is silent and never retries\r\n against a different machine is the gate's reading of it, stated as instruction.\r\n\r\n**What this settles and what it does not** (doyle, B7ZLOLBZ): the submitter rule settles the\r\nEXPERIENCE. Enqueue/dequeue ordering and human-versus-machine injection remain **mechanism questions to\r\nresolve** — they are not reasons to reopen the settled experience, and an adapter answer that disputes\r\nthe experience rather than describing its mechanism is answering the wrong question.\r\n\r\n**Historic audience: adapter owners.** The introduction and §§0–7 below retain the superseded\r\nadapter-design discussion. Their proposed obligations and refusal rules are historical, not the\r\ncurrent contract; §8 replaces them and asks nothing new of adapters.\r\n\r\n## 0. The problem in one paragraph\r\n\r\nWhen a user drives a remote endpoint (`spt rc` from their machine to an agent on another machine) and\r\ntheir typed words quote an absolute path on THEIR machine, spt is supposed to serve that file to the\r\nreceiving agent automatically, as a scoped live reference (#17, ADR-0058 Am.1). It does not, because\r\nthe two halves never meet: the bytes arrive with a proven origin, and the harness reports the\r\nSEMANTIC submission later, with no carried association between them. The fix is not to guess the\r\nassociation. It is for the harness to capture provenance at the moment it accepts a submission, and\r\ncarry it with that submission.\r\n\r\nThe question this contract answers is **\"whose computer does this path refer to?\"**, and the answer is\r\nthe submitter's. It is deliberately NOT \"who wrote these characters?\" — that question is settled and\r\nout of scope (see the decision above). An adapter's whole job here is to capture the submitting\r\nattachment's token at acceptance and carry it, unaltered, to the report.\r\n\r\n## 1. Why the obvious shortcut is forbidden\r\n\r\n**Never sample the current controller at report time.** Reading \"who is attached right now\" when a\r\nsubmission is REPORTED is not an answer to \"who submitted this\", for three independent reasons:\r\n\r\n- A submission can be **accepted, queued, and reported later**. Between those moments the controller\r\n seat can change hands. The sample then names someone who did not submit it.\r\n- **Continuity does not rescue the sample.** A token minted for B *after* A's submission was queued,\r\n still current when that submission is reported, is both unretired and continuously held — and still\r\n names the wrong origin. (This refutes an earlier draft of mine; doyle's, 2026-09-12.)\r\n- \"Somebody is driving\" and \"which node is driving\" are **different facts with different\r\n availability** — one can be known while the other is not.\r\n\r\n**What the submitter rule does and does not relax.** It removes the question of who typed the\r\ncharacters: if A types into a buffer and B submits, the origin is **B's computer, deliberately**, and\r\nthat is the settled experience rather than a defect to engineer around. It does NOT license sampling,\r\nbecause the sample is taken at the wrong MOMENT, not merely against the wrong PERSON. Acceptance is\r\nwhen a submitter submits; report time is some time afterwards, and the gap is exactly what this\r\ncontract exists to bridge.\r\n\r\nConsequently: **an adapter that cannot capture at acceptance must produce a named refusal, not a\r\nfallback.** There is no degraded mode that samples. A refusal is a correct outcome; a guess is not.\r\n\r\n## 2. Terms\r\n\r\n- **Submission** — one semantic unit of user input that the harness has ACCEPTED from the user: the\r\n thing a user means when they say \"I sent that\". Not a keystroke, not a byte chunk, not a turn.\r\n- **Submitter** — the controlling attachment that SUBMITS a submission at the acceptance surface. Its\r\n node is the origin this contract binds to. Deliberately **not** \"whoever typed the characters\": when\r\n those differ, the submitter wins, by operator decision. An adapter never needs to determine who\r\n typed anything.\r\n- **Acceptance surface** — the point in the harness where a submission becomes committed by the user\r\n and can no longer be edited: where \"the user pressed send\". The contract lives here. If a harness\r\n has no such point, it cannot satisfy this contract, and that is the concrete limitation to report.\r\n- **Provenance token** — an opaque string, issued by spt to a controlling attachment, which carries\r\n the authenticated identity of the controller's node. Adapters never parse it, never construct one,\r\n and never infer one; they read it, hold it, and hand it back.\r\n- **Submission id** — an adapter-chosen identifier, unique within the session, naming one submission.\r\n It exists so a report can be matched to an acceptance and so a replay is recognisable.\r\n\r\n## 3. What the adapter must do\r\n\r\n1. **Capture at acceptance, before any queue.** At its acceptance surface, the adapter reads the\r\n provenance token then current and stores it WITH that submission, together with a submission id\r\n it chooses. The capture must happen before the submission can be queued, deferred, or reordered.\r\n Capturing later — at turn start, at tool time, at report time — does not satisfy this contract,\r\n because those points are after the boundary the defect lives on.\r\n\r\n **RESOLVED BY THE SUBMITTER RULE — this was the draft's biggest open question and it is now\r\n closed.** Earlier revisions treated buffered input across a handoff as an unresolved gap: A types,\r\n the bytes sit in a terminal or client buffer, B takes the seat, and the harness accepts a submission\r\n whose characters A wrote while the current token is B's. Under Reavo's decision that is **not a\r\n defect**: the origin is the SENDER'S computer — B's — and the token current at acceptance is the\r\n correct answer, not an approximation of a better one. Adapters must NOT add machinery to attribute\r\n text back to whoever typed it.\r\n\r\n What remains is a MECHANISM question, and it is the one to answer: **exactly where your acceptance\r\n point sits relative to your queue** — enqueue-versus-dequeue ordering, and whether machine-injected\r\n input (hooks, replays, automation writing into the same path) is distinguishable from a human\r\n pressing send. Those are unsettled and are what §5 asks about. They are not grounds to reopen the\r\n submitter rule.\r\n2. **Carry it through whatever the harness does next. Authorization binds to the bytes that were\r\n accepted.** If the harness queues or delays the submission, the captured token travels with it\r\n unchanged.\r\n\r\n **The record is of the ORIGINAL ACCEPTED BYTES, and later rewriting does not invalidate it.** What\r\n was accepted was accepted; a harness that edits the text afterwards does not retroactively make the\r\n capture false. What rewriting must never do is EXTEND that authorization: a rewritten path, or a\r\n path newly introduced after acceptance, gains nothing from the original record. Authorization\r\n covers the paths quoted in the bytes whose acceptance was captured, and no others.\r\n\r\n **An adapter that cannot observe later edits MUST NOT PROMISE TO DETECT THEM.** Saying \"I will\r\n treat each edit as a new submission\" is a capability claim, and on a harness with no\r\n post-acceptance observation it is one the adapter cannot keep. The honest position is to bind the\r\n captured bytes, report that later edits are unobservable, and let the contract — not the adapter's\r\n optimism — decide what that costs. Reporting the limitation satisfies this clause; silently\r\n implying detection does not.\r\n3. **Report it with the payload.** When the adapter reports the submission to spt, it reports, in one\r\n call: the submission id, the captured token, and the **exact final payload text** of that\r\n submission. The payload reported must be the text as committed, not a normalised, truncated or\r\n re-rendered version.\r\n4. **Never substitute.** If no token was captured — a local user, a viewer, a harness surface that\r\n cannot reach the acceptance point — the adapter reports the submission with **no token**. It must\r\n not report the current token instead, and must not synthesise one from terminal bytes, window\r\n state or timing.\r\n5. **Report once per submission.** One acceptance, one report. A retry after a transport failure\r\n repeats the same submission id and the same payload.\r\n\r\n## 4. What spt guarantees in return\r\n\r\n1. **Token issuance.** A controlling attachment over an authenticated remote origin is issued a\r\n provenance token bound to that origin, to the session, and to the attachment's own occupancy of\r\n the controller seat. A read-only viewer is issued none.\r\n2. **Binding, and an honest split of who establishes it.** Authorization is computed from the reported\r\n token plus the reported payload: the audience is the receiving endpoint, and the only paths\r\n considered are absolute paths quoted inside THAT payload. No other text and no terminal stream is\r\n read. But receiving a token and a text in one call does NOT by itself establish that the text is\r\n what that token's holder submitted, and this contract does not pretend otherwise (doyle,\r\n 2026-09-12):\r\n\r\n - **The adapter is trusted for, and solely responsible for, the association**: that this payload is\r\n the text of the submission whose acceptance it captured, and that the token it reports is the one\r\n read at that capture. Core cannot observe the acceptance and cannot reconstruct it afterwards.\r\n - **Core can independently verify** only: that the token is authentic and was issued by this node;\r\n which authenticated origin node, session and incarnation it was issued to; whether its issuing\r\n seat occupancy has ended, and when; that the submission id has not been used before within the\r\n session and incarnation; that the payload hashes to the value bound to that submission id on any\r\n repeat report; and that the paths it acts on are quoted inside the reported payload.\r\n - Therefore a dishonest or defective adapter can misattribute text within the trust it already\r\n holds over the session. This contract narrows that to the adapter's own acceptance path; it does\r\n not remove it, and no wording in it should be read as core-side proof of authorship.\r\n3. **Serving semantics, unchanged from #17 / ADR-0058 Am.1.** A live reference on the submitter's own\r\n machine, 24h TTL, audience scoped to the receiving agent, and a FILE_ACCESS_HELPER notice emitted\r\n once per submission and path.\r\n\r\n **A path that names no file on the submitter's machine is SILENTLY SKIPPED.** Reavo: \"if the\r\n provided filepath doesn't match a file there, then simply skip fileserving\". The skip is silent —\r\n **no prompt, no notice, no named refusal on that path** (doyle's reading, B7ZLOLBZ) — and there is\r\n **no fallback to another origin**: spt does not look for the file on the receiving machine, on a\r\n previous controller's machine, or anywhere else. A quoted path that does not resolve on the\r\n submitter's computer simply does not become a reference, and the submission is processed exactly as\r\n if it had quoted nothing. This is the one non-grant in this contract that is NOT announced, and it\r\n is deliberate: a user quoting a path that happens not to exist on their machine is an ordinary\r\n event, not an error to report.\r\n4. **No reliable sender, no automatic share — the adopted safety rule** (doyle, 2026-09-12; a gate\r\n policy adopted alongside Reavo's decision, NOT part of it). Where the submitting origin is not\r\n established to the standard §4.1 requires, nothing is served automatically. This is a refusal to act\r\n on an unestablished origin, and it is distinct from the silent skip above: the skip is a path that\r\n resolved to nothing on a KNOWN sender's machine; this is not knowing the sender. **What makes a\r\n sender \"unreliable\" is NOT DEFINED in this contract and is not the adapter's to decide** — it is a\r\n core-side and gate-side question, deliberately left open rather than invented here.\r\n5. **Handoff.** A token stops being issued the moment its holder stops holding the seat. A new holder's\r\n token can never redeem a previous holder's submission.\r\n\r\n **UNRESOLVED — NOT AN AUTHORIZED GUARANTEE (doyle, 2026-09-12).** The proposal is that a submission\r\n whose token was captured while its holder still held the seat stays authorizable for a BOUNDED\r\n grace period after the seat changes, on the reasoning that capture and not report is when the\r\n SUBMISSION happened. That is a proposal only. It no longer depends on the buffered-authorship\r\n question — that is settled (§3.1) — but it does depend on the still-open ordering question (§5.2):\r\n if acceptance is at dequeue rather than enqueue, \"captured while its holder held the seat\" is not\r\n established by capture alone. It may not be relied upon.\r\n The bound also has no value yet and must be justified rather than picked. Until both are ruled, the\r\n safe reading is that a token whose issuing occupancy has ended is refused by name.\r\n6. **Replay.** A submission id is single-use **within the session and incarnation, across every token\r\n issued in it** — not merely per token. Rotating or re-issuing a token must not let the same\r\n submission register a second time (doyle, 2026-09-12). Re-reporting the same id and payload\r\n re-registers nothing, emits no second helper notice, and **does not extend an existing TTL**. The\r\n same id with a different payload, or under a different token, is refused by name rather than treated\r\n as an update.\r\n7. **Refusal is named — with exactly one silent exception.** Every AUTHORIZATION non-grant says which\r\n condition failed, on the existing declined line: no token; token not valid for this session or\r\n incarnation; token past its grace bound; viewer; submission id reused with different payload;\r\n payload quoted no absolute path; sender not established (§4.4).\r\n\r\n **The exception is §4.3's missing file, and it is silent by decision, not by omission.** A quoted\r\n path that resolves to nothing on the submitter's machine produces no declined line, no notice and\r\n no name. The distinction is: a REFUSAL means the authorization failed; a SKIP means authorization\r\n was fine and there was simply no file there. Do not collapse the two, and do not add a named refusal\r\n for the skip on the grounds that every other outcome has one.\r\n8. **Separation of concerns, structurally.** Input processing and serving authorization are\r\n independent: a refused authorization never alters, delays or fails the submission itself, and a\r\n submission is delivered and processed identically whether or not a token rode with it.\r\n\r\n## 5. The question for adapter owners\r\n\r\nUsing only this document:\r\n\r\n1. Does your harness have an **acceptance surface** as defined in §2 — a point where a submission is\r\n committed by the user and is not yet queued?\r\n2. **The ordering question — this replaces the old buffered-authorship question, which is now\r\n settled.** Do NOT answer about who typed the characters: under the submitter rule the token current\r\n at acceptance is correct by definition, even if someone else typed the text. Answer instead about\r\n your QUEUE: does your acceptance point sit at **enqueue** (the submission is captured as it enters\r\n the queue) or at **dequeue** (captured as the harness takes it off for processing)? If it is\r\n dequeue, what can change the seat between the two, and can your adapter reach the enqueue point at\r\n all?\r\n2b. **Machine-injected input.** Can input reach that same acceptance surface WITHOUT a human pressing\r\n send — hooks, replayed or scripted input, automation writing into the same path, a resumed session\r\n re-submitting? Can your adapter tell that case apart from a human submission, and what does it\r\n currently capture for it? A machine injection that captures the seat-holder's token would attribute\r\n a machine's submission to a person, which is a mechanism question this contract has NOT resolved.\r\n3. At that point, can the adapter **read and store** a value, and keep it associated with that exact\r\n submission through any queueing the harness performs? Can the harness EDIT or SPLIT the text after\r\n acceptance, and if so can your adapter OBSERVE that it did (§3.2)? Answer what you can observe, not\r\n what you would like to guarantee: if there is no post-acceptance observation, say so — an adapter\r\n that cannot see later edits must not promise to detect them, and reporting the limitation is the\r\n answer this contract wants.\r\n4. When the submission is reported, can the adapter include the stored value, its own submission id,\r\n and the **exact committed payload text** in the same report?\r\n5. If any of those is impossible, **what precisely is missing** — a hook that does not exist, a hook\r\n that fires too late, a buffer the adapter cannot see behind, an association the harness drops, a\r\n payload the harness rewrites?\r\n\r\nAnswer (5) concretely if it applies. A named limitation is the useful answer and the one that gets a\r\ndecision; \"probably fine\" is not, and neither is a workaround that samples the current controller.\r\n**An answer here is feasibility input, not approval**: doyle holds the approval, and the clauses marked\r\nunresolved below are not guarantees an adapter may build against yet.\r\n\r\n## 6. Known open items, so nobody assumes they are settled\r\n\r\n- **CLOSED, recorded so nobody reopens it:** \"which controller's text is this, if one typed and\r\n another sent\" is SETTLED by Reavo's decision — the sender's computer, full stop. Earlier revisions of\r\n this document carried it as the biggest open question; it is not one. Re-raising it is out of scope,\r\n and an adapter must not build attribution machinery to answer it.\r\n- **Enqueue-versus-dequeue ordering is a MECHANISM question, still open** (doyle, B7ZLOLBZ). Where the\r\n acceptance point sits relative to the queue decides whether \"the token current at acceptance\" is the\r\n submitter's token in practice. Adapter answers to §5.2 are the input to that ruling. It does not\r\n reopen the experience.\r\n- **ORIGIN SIGNALING IS AN UNRESOLVED REQUIREMENT, not an adapter chore** (doyle). Machine-injected\r\n submissions were MEASURED indistinguishable from human ones at the harness level (§7), and the only\r\n separator in the field today is an adapter recognising its own transport's payload shapes — a\r\n heuristic that establishes \"this looks like something spt sent\", never \"a person submitted this\".\r\n Recognizing payload shapes is not authenticated human provenance. What is missing is a trustworthy\r\n origin signal; until one exists such submissions report with no token, which is a floor and not a\r\n solution. Adapter answers to §5.2b describe the gap; they do not close it.\r\n- **A resumed session re-submitting and externally scripted input are SEPARATE, both uncharacterised**,\r\n and external automation is **not** equivalent to a resumed session — neither answer follows from the\r\n other.\r\n- **What makes a sender \"unreliable\" (§4.4) is UNDEFINED here** and is deliberately not the adapter's\r\n to decide. The adopted safety rule says no automatic share in that case; the threshold is core-side\r\n and gate-side.\r\n- **The post-handoff grace period (§4.5) is a PROPOSAL, not an authorized guarantee.** The submitter\r\n rule reduces its urgency — the submitter is by definition whoever held the seat at acceptance — but\r\n it is still unruled, and its bound still has **no value**; it must be justified, not picked.\r\n- **§4.2's split of responsibility is deliberate**: the association is the adapter's to establish and\r\n core cannot verify it independently. Nothing in this contract is core-side proof of authorship.\r\n- Whether the token is readable through an existing authenticated read verb, or needs a new surface,\r\n is **not decided** and is deliberately absent from this contract — it is an implementation question\r\n and adapter owners should not need it to answer §5.\r\n- Acceptance criteria for #300 live on the issue (comment 5645159945) and are proposed, not granted.\r\n- If no shipped adapter can satisfy §3.1, that is a concrete limitation for an operator decision via\r\n lia, not a licence to reduce the behaviour.\r\n- The **silent skip** (§4.3) is the one non-grant that emits nothing. It is easy to misread as a bug\r\n report waiting to happen — \"the file didn't get shared and nothing said why\" — and it is deliberate.\r\n If experience shows users need a signal, that is a new operator decision, not a contract correction.\r\n\r\n## 7. Adapter answers on record\r\n\r\n### claude-spt (perri, 2026-09-12) — answered against this frame, with measurements\r\n\r\n**§5.1 acceptance surface: YES.** `UserPromptSubmit` fires when a submission is committed, before the\r\nmodel sees it, carrying the exact committed text and session id, and can block.\r\n\r\n**Two holes, and they are TWO SEPARATE POPULATIONS** — perri's precision fix, kept apart here because\r\nthey need different contract language and merging them states something false about both:\r\n\r\n- **All submissions: 302 audited, 227 hook-covered.** The 75 misses are harness-synthesised transcript\r\n entries OR built-in local slash commands (`/compact`, `/reload-plugins` mid-session are the clean\r\n cases). This is a **surface gap the adapter cannot close**.\r","truncated":true,"truncatedBy":"lines","totalLines":503,"totalBytes":22888,"outputLines":300,"outputBytes":22888,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":503,"displayContent":{"text":"# Receipt-bound input provenance — core-only contract\r\n\r\n**Current contract: §8, core-only.** Sections 0–7 retain the superseded\r\nadapter-design discussion and measurements; they impose no adapter obligations.\r\nThe implementation uses the existing USER_INPUT reports and controller rc stream.\r\nThe two-node field acceptance remains separate from the doc/impl/unit lane.\r\n\r\n## The operator decision this contract is bound to\r\n\r\n**Provenance follows the SUBMITTER, not the AUTHOR.** The origin used is the computer of the person who\r\nsubmits the input — never the computer of whoever typed the characters, when those differ.\r\n\r\n**Reavo, verbatim as relayed by lia** (lia's message `5Y45PXOU`; relay chain Reavo → lia → doyle →\r\ntodlando — doyle did NOT receive it directly from Reavo):\r\n\r\n> yes, it should use the sender's computer. if the provided filepath doesn't match a file there, then\r\n> simply skip fileserving\r\n\r\n**Two things are NOT inside that quotation and are attributed separately, so nobody cites the operator\r\nfor them:**\r\n\r\n- **\"No reliable sender, no automatic share\"** — the ADOPTED SAFETY RULE (doyle, 2026-09-12). It is a\r\n gate policy adopted alongside the decision, not part of Reavo's words.\r\n- **No prompt, and no fallback to another origin** — doyle's instruction on how the skip behaves\r\n (B7ZLOLBZ). The quotation says \"simply skip fileserving\"; that the skip is silent and never retries\r\n against a different machine is the gate's reading of it, stated as instruction.\r\n\r\n**What this settles and what it does not** (doyle, B7ZLOLBZ): the submitter rule settles the\r\nEXPERIENCE. Enqueue/dequeue ordering and human-versus-machine injection remain **mechanism questions to\r\nresolve** — they are not reasons to reopen the settled experience, and an adapter answer that disputes\r\nthe experience rather than describing its mechanism is answering the wrong question.\r\n\r\n**Historic audience: adapter owners.** The introduction and §§0–7 below retain the superseded\r\nadapter-design discussion. Their proposed obligations and refusal rules are historical, not the\r\ncurrent contract; §8 replaces them and asks nothing new of adapters.\r\n\r\n## 0. The problem in one paragraph\r\n\r\nWhen a user drives a remote endpoint (`spt rc` from their machine to an agent on another machine) and\r\ntheir typed words quote an absolute path on THEIR machine, spt is supposed to serve that file to the\r\nreceiving agent automatically, as a scoped live reference (#17, ADR-0058 Am.1). It does not, because\r\nthe two halves never meet: the bytes arrive with a proven origin, and the harness reports the\r\nSEMANTIC submission later, with no carried association between them. The fix is not to guess the\r\nassociation. It is for the harness to capture provenance at the moment it accepts a submission, and\r\ncarry it with that submission.\r\n\r\nThe question this contract answers is **\"whose computer does this path refer to?\"**, and the answer is\r\nthe submitter's. It is deliberately NOT \"who wrote these characters?\" — that question is settled and\r\nout of scope (see the decision above). An adapter's whole job here is to capture the submitting\r\nattachment's token at acceptance and carry it, unaltered, to the report.\r\n\r\n## 1. Why the obvious shortcut is forbidden\r\n\r\n**Never sample the current controller at report time.** Reading \"who is attached right now\" when a\r\nsubmission is REPORTED is not an answer to \"who submitted this\", for three independent reasons:\r\n\r\n- A submission can be **accepted, queued, and reported later**. Between those moments the controller\r\n seat can change hands. The sample then names someone who did not submit it.\r\n- **Continuity does not rescue the sample.** A token minted for B *after* A's submission was queued,\r\n still current when that submission is reported, is both unretired and continuously held — and still\r\n names the wrong origin. (This refutes an earlier draft of mine; doyle's, 2026-09-12.)\r\n- \"Somebody is driving\" and \"which node is driving\" are **different facts with different\r\n availability** — one can be known while the other is not.\r\n\r\n**What the submitter rule does and does not relax.** It removes the question of who typed the\r\ncharacters: if A types into a buffer and B submits, the origin is **B's computer, deliberately**, and\r\nthat is the settled experience rather than a defect to engineer around. It does NOT license sampling,\r\nbecause the sample is taken at the wrong MOMENT, not merely against the wrong PERSON. Acceptance is\r\nwhen a submitter submits; report time is some time afterwards, and the gap is exactly what this\r\ncontract exists to bridge.\r\n\r\nConsequently: **an adapter that cannot capture at acceptance must produce a named refusal, not a\r\nfallback.** There is no degraded mode that samples. A refusal is a correct outcome; a guess is not.\r\n\r\n## 2. Terms\r\n\r\n- **Submission** — one semantic unit of user input that the harness has ACCEPTED from the user: the\r\n thing a user means when they say \"I sent that\". Not a keystroke, not a byte chunk, not a turn.\r\n- **Submitter** — the controlling attachment that SUBMITS a submission at the acceptance surface. Its\r\n node is the origin this contract binds to. Deliberately **not** \"whoever typed the characters\": when\r\n those differ, the submitter wins, by operator decision. An adapter never needs to determine who\r\n typed anything.\r\n- **Acceptance surface** — the point in the harness where a submission becomes committed by the user\r\n and can no longer be edited: where \"the user pressed send\". The contract lives here. If a harness\r\n has no such point, it cannot satisfy this contract, and that is the concrete limitation to report.\r\n- **Provenance token** — an opaque string, issued by spt to a controlling attachment, which carries\r\n the authenticated identity of the controller's node. Adapters never parse it, never construct one,\r\n and never infer one; they read it, hold it, and hand it back.\r\n- **Submission id** — an adapter-chosen identifier, unique within the session, naming one submission.\r\n It exists so a report can be matched to an acceptance and so a replay is recognisable.\r\n\r\n## 3. What the adapter must do\r\n\r\n1. **Capture at acceptance, before any queue.** At its acceptance surface, the adapter reads the\r\n provenance token then current and stores it WITH that submission, together with a submission id\r\n it chooses. The capture must happen before the submission can be queued, deferred, or reordered.\r\n Capturing later — at turn start, at tool time, at report time — does not satisfy this contract,\r\n because those points are after the boundary the defect lives on.\r\n\r\n **RESOLVED BY THE SUBMITTER RULE — this was the draft's biggest open question and it is now\r\n closed.** Earlier revisions treated buffered input across a handoff as an unresolved gap: A types,\r\n the bytes sit in a terminal or client buffer, B takes the seat, and the harness accepts a submission\r\n whose characters A wrote while the current token is B's. Under Reavo's decision that is **not a\r\n defect**: the origin is the SENDER'S computer — B's — and the token current at acceptance is the\r\n correct answer, not an approximation of a better one. Adapters must NOT add machinery to attribute\r\n text back to whoever typed it.\r\n\r\n What remains is a MECHANISM question, and it is the one to answer: **exactly where your acceptance\r\n point sits relative to your queue** — enqueue-versus-dequeue ordering, and whether machine-injected\r\n input (hooks, replays, automation writing into the same path) is distinguishable from a human\r\n pressing send. Those are unsettled and are what §5 asks about. They are not grounds to reopen the\r\n submitter rule.\r\n2. **Carry it through whatever the harness does next. Authorization binds to the bytes that were\r\n accepted.** If the harness queues or delays the submission, the captured token travels with it\r\n unchanged.\r\n\r\n **The record is of the ORIGINAL ACCEPTED BYTES, and later rewriting does not invalidate it.** What\r\n was accepted was accepted; a harness that edits the text afterwards does not retroactively make the\r\n capture false. What rewriting must never do is EXTEND that authorization: a rewritten path, or a\r\n path newly introduced after acceptance, gains nothing from the original record. Authorization\r\n covers the paths quoted in the bytes whose acceptance was captured, and no others.\r\n\r\n **An adapter that cannot observe later edits MUST NOT PROMISE TO DETECT THEM.** Saying \"I will\r\n treat each edit as a new submission\" is a capability claim, and on a harness with no\r\n post-acceptance observation it is one the adapter cannot keep. The honest position is to bind the\r\n captured bytes, report that later edits are unobservable, and let the contract — not the adapter's\r\n optimism — decide what that costs. Reporting the limitation satisfies this clause; silently\r\n implying detection does not.\r\n3. **Report it with the payload.** When the adapter reports the submission to spt, it reports, in one\r\n call: the submission id, the captured token, and the **exact final payload text** of that\r\n submission. The payload reported must be the text as committed, not a normalised, truncated or\r\n re-rendered version.\r\n4. **Never substitute.** If no token was captured — a local user, a viewer, a harness surface that\r\n cannot reach the acceptance point — the adapter reports the submission with **no token**. It must\r\n not report the current token instead, and must not synthesise one from terminal bytes, window\r\n state or timing.\r\n5. **Report once per submission.** One acceptance, one report. A retry after a transport failure\r\n repeats the same submission id and the same payload.\r\n\r\n## 4. What spt guarantees in return\r\n\r\n1. **Token issuance.** A controlling attachment over an authenticated remote origin is issued a\r\n provenance token bound to that origin, to the session, and to the attachment's own occupancy of\r\n the controller seat. A read-only viewer is issued none.\r\n2. **Binding, and an honest split of who establishes it.** Authorization is computed from the reported\r\n token plus the reported payload: the audience is the receiving endpoint, and the only paths\r\n considered are absolute paths quoted inside THAT payload. No other text and no terminal stream is\r\n read. But receiving a token and a text in one call does NOT by itself establish that the text is\r\n what that token's holder submitted, and this contract does not pretend otherwise (doyle,\r\n 2026-09-12):\r\n\r\n - **The adapter is trusted for, and solely responsible for, the association**: that this payload is\r\n the text of the submission whose acceptance it captured, and that the token it reports is the one\r\n read at that capture. Core cannot observe the acceptance and cannot reconstruct it afterwards.\r\n - **Core can independently verify** only: that the token is authentic and was issued by this node;\r\n which authenticated origin node, session and incarnation it was issued to; whether its issuing\r\n seat occupancy has ended, and when; that the submission id has not been used before within the\r\n session and incarnation; that the payload hashes to the value bound to that submission id on any\r\n repeat report; and that the paths it acts on are quoted inside the reported payload.\r\n - Therefore a dishonest or defective adapter can misattribute text within the trust it already\r\n holds over the session. This contract narrows that to the adapter's own acceptance path; it does\r\n not remove it, and no wording in it should be read as core-side proof of authorship.\r\n3. **Serving semantics, unchanged from #17 / ADR-0058 Am.1.** A live reference on the submitter's own\r\n machine, 24h TTL, audience scoped to the receiving agent, and a FILE_ACCESS_HELPER notice emitted\r\n once per submission and path.\r\n\r\n **A path that names no file on the submitter's machine is SILENTLY SKIPPED.** Reavo: \"if the\r\n provided filepath doesn't match a file there, then simply skip fileserving\". The skip is silent —\r\n **no prompt, no notice, no named refusal on that path** (doyle's reading, B7ZLOLBZ) — and there is\r\n **no fallback to another origin**: spt does not look for the file on the receiving machine, on a\r\n previous controller's machine, or anywhere else. A quoted path that does not resolve on the\r\n submitter's computer simply does not become a reference, and the submission is processed exactly as\r\n if it had quoted nothing. This is the one non-grant in this contract that is NOT announced, and it\r\n is deliberate: a user quoting a path that happens not to exist on their machine is an ordinary\r\n event, not an error to report.\r\n4. **No reliable sender, no automatic share — the adopted safety rule** (doyle, 2026-09-12; a gate\r\n policy adopted alongside Reavo's decision, NOT part of it). Where the submitting origin is not\r\n established to the standard §4.1 requires, nothing is served automatically. This is a refusal to act\r\n on an unestablished origin, and it is distinct from the silent skip above: the skip is a path that\r\n resolved to nothing on a KNOWN sender's machine; this is not knowing the sender. **What makes a\r\n sender \"unreliable\" is NOT DEFINED in this contract and is not the adapter's to decide** — it is a\r\n core-side and gate-side question, deliberately left open rather than invented here.\r\n5. **Handoff.** A token stops being issued the moment its holder stops holding the seat. A new holder's\r\n token can never redeem a previous holder's submission.\r\n\r\n **UNRESOLVED — NOT AN AUTHORIZED GUARANTEE (doyle, 2026-09-12).** The proposal is that a submission\r\n whose token was captured while its holder still held the seat stays authorizable for a BOUNDED\r\n grace period after the seat changes, on the reasoning that capture and not report is when the\r\n SUBMISSION happened. That is a proposal only. It no longer depends on the buffered-authorship\r\n question — that is settled (§3.1) — but it does depend on the still-open ordering question (§5.2):\r\n if acceptance is at dequeue rather than enqueue, \"captured while its holder held the seat\" is not\r\n established by capture alone. It may not be relied upon.\r\n The bound also has no value yet and must be justified rather than picked. Until both are ruled, the\r\n safe reading is that a token whose issuing occupancy has ended is refused by name.\r\n6. **Replay.** A submission id is single-use **within the session and incarnation, across every token\r\n issued in it** — not merely per token. Rotating or re-issuing a token must not let the same\r\n submission register a second time (doyle, 2026-09-12). Re-reporting the same id and payload\r\n re-registers nothing, emits no second helper notice, and **does not extend an existing TTL**. The\r\n same id with a different payload, or under a different token, is refused by name rather than treated\r\n as an update.\r\n7. **Refusal is named — with exactly one silent exception.** Every AUTHORIZATION non-grant says which\r\n condition failed, on the existing declined line: no token; token not valid for this session or\r\n incarnation; token past its grace bound; viewer; submission id reused with different payload;\r\n payload quoted no absolute path; sender not established (§4.4).\r\n\r\n **The exception is §4.3's missing file, and it is silent by decision, not by omission.** A quoted\r\n path that resolves to nothing on the submitter's machine produces no declined line, no notice and\r\n no name. The distinction is: a REFUSAL means the authorization failed; a SKIP means authorization\r\n was fine and there was simply no file there. Do not collapse the two, and do not add a named refusal\r\n for the skip on the grounds that every other outcome has one.\r\n8. **Separation of concerns, structurally.** Input processing and serving authorization are\r\n independent: a refused authorization never alters, delays or fails the submission itself, and a\r\n submission is delivered and processed identically whether or not a token rode with it.\r\n\r\n## 5. The question for adapter owners\r\n\r\nUsing only this document:\r\n\r\n1. Does your harness have an **acceptance surface** as defined in §2 — a point where a submission is\r\n committed by the user and is not yet queued?\r\n2. **The ordering question — this replaces the old buffered-authorship question, which is now\r\n settled.** Do NOT answer about who typed the characters: under the submitter rule the token current\r\n at acceptance is correct by definition, even if someone else typed the text. Answer instead about\r\n your QUEUE: does your acceptance point sit at **enqueue** (the submission is captured as it enters\r\n the queue) or at **dequeue** (captured as the harness takes it off for processing)? If it is\r\n dequeue, what can change the seat between the two, and can your adapter reach the enqueue point at\r\n all?\r\n2b. **Machine-injected input.** Can input reach that same acceptance surface WITHOUT a human pressing\r\n send — hooks, replayed or scripted input, automation writing into the same path, a resumed session\r\n re-submitting? Can your adapter tell that case apart from a human submission, and what does it\r\n currently capture for it? A machine injection that captures the seat-holder's token would attribute\r\n a machine's submission to a person, which is a mechanism question this contract has NOT resolved.\r\n3. At that point, can the adapter **read and store** a value, and keep it associated with that exact\r\n submission through any queueing the harness performs? Can the harness EDIT or SPLIT the text after\r\n acceptance, and if so can your adapter OBSERVE that it did (§3.2)? Answer what you can observe, not\r\n what you would like to guarantee: if there is no post-acceptance observation, say so — an adapter\r\n that cannot see later edits must not promise to detect them, and reporting the limitation is the\r\n answer this contract wants.\r\n4. When the submission is reported, can the adapter include the stored value, its own submission id,\r\n and the **exact committed payload text** in the same report?\r\n5. If any of those is impossible, **what precisely is missing** — a hook that does not exist, a hook\r\n that fires too late, a buffer the adapter cannot see behind, an association the harness drops, a\r\n payload the harness rewrites?\r\n\r\nAnswer (5) concretely if it applies. A named limitation is the useful answer and the one that gets a\r\ndecision; \"probably fine\" is not, and neither is a workaround that samples the current controller.\r\n**An answer here is feasibility input, not approval**: doyle holds the approval, and the clauses marked\r\nunresolved below are not guarantees an adapter may build against yet.\r\n\r\n## 6. Known open items, so nobody assumes they are settled\r\n\r\n- **CLOSED, recorded so nobody reopens it:** \"which controller's text is this, if one typed and\r\n another sent\" is SETTLED by Reavo's decision — the sender's computer, full stop. Earlier revisions of\r\n this document carried it as the biggest open question; it is not one. Re-raising it is out of scope,\r\n and an adapter must not build attribution machinery to answer it.\r\n- **Enqueue-versus-dequeue ordering is a MECHANISM question, still open** (doyle, B7ZLOLBZ). Where the\r\n acceptance point sits relative to the queue decides whether \"the token current at acceptance\" is the\r\n submitter's token in practice. Adapter answers to §5.2 are the input to that ruling. It does not\r\n reopen the experience.\r\n- **ORIGIN SIGNALING IS AN UNRESOLVED REQUIREMENT, not an adapter chore** (doyle). Machine-injected\r\n submissions were MEASURED indistinguishable from human ones at the harness level (§7), and the only\r\n separator in the field today is an adapter recognising its own transport's payload shapes — a\r\n heuristic that establishes \"this looks like something spt sent\", never \"a person submitted this\".\r\n Recognizing payload shapes is not authenticated human provenance. What is missing is a trustworthy\r\n origin signal; until one exists such submissions report with no token, which is a floor and not a\r\n solution. Adapter answers to §5.2b describe the gap; they do not close it.\r\n- **A resumed session re-submitting and externally scripted input are SEPARATE, both uncharacterised**,\r\n and external automation is **not** equivalent to a resumed session — neither answer follows from the\r\n other.\r\n- **What makes a sender \"unreliable\" (§4.4) is UNDEFINED here** and is deliberately not the adapter's\r\n to decide. The adopted safety rule says no automatic share in that case; the threshold is core-side\r\n and gate-side.\r\n- **The post-handoff grace period (§4.5) is a PROPOSAL, not an authorized guarantee.** The submitter\r\n rule reduces its urgency — the submitter is by definition whoever held the seat at acceptance — but\r\n it is still unruled, and its bound still has **no value**; it must be justified, not picked.\r\n- **§4.2's split of responsibility is deliberate**: the association is the adapter's to establish and\r\n core cannot verify it independently. Nothing in this contract is core-side proof of authorship.\r\n- Whether the token is readable through an existing authenticated read verb, or needs a new surface,\r\n is **not decided** and is deliberately absent from this contract — it is an implementation question\r\n and adapter owners should not need it to answer §5.\r\n- Acceptance criteria for #300 live on the issue (comment 5645159945) and are proposed, not granted.\r\n- If no shipped adapter can satisfy §3.1, that is a concrete limitation for an operator decision via\r\n lia, not a licence to reduce the behaviour.\r\n- The **silent skip** (§4.3) is the one non-grant that emits nothing. It is easy to misread as a bug\r\n report waiting to happen — \"the file didn't get shared and nothing said why\" — and it is deliberate.\r\n If experience shows users need a signal, that is a new operator decision, not a contract correction.\r\n\r\n## 7. Adapter answers on record\r\n\r\n### claude-spt (perri, 2026-09-12) — answered against this frame, with measurements\r\n\r\n**§5.1 acceptance surface: YES.** `UserPromptSubmit` fires when a submission is committed, before the\r\nmodel sees it, carrying the exact committed text and session id, and can block.\r\n\r\n**Two holes, and they are TWO SEPARATE POPULATIONS** — perri's precision fix, kept apart here because\r\nthey need different contract language and merging them states something false about both:\r\n\r\n- **All submissions: 302 audited, 227 hook-covered.** The 75 misses are harness-synthesised transcript\r\n entries OR built-in local slash commands (`/compact`, `/reload-plugins` mid-session are the clean\r\n cases). This is a **surface gap the adapter cannot close**.\r\n…\n\n…\n\n…\n\n…\nin §7 are not execution evidence for this implementation.","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,null,304,null,381,null,398,null,503]},"fileSize":38531,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs\\INPUT-PROVENANCE-CONTRACT.md"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":503,"totalBytes":22888,"outputLines":300,"outputBytes":22888,"shownRange":{"start":1,"end":300},"nextOffset":301}}},"isError":false,"timestamp":1790029724304}}
{"type":"message","id":"e69a0d31","parentId":"ad4a4c2a","timestamp":"2026-09-21T22:28:44.306Z","message":{"role":"toolResult","toolCallId":"call_LoWvKf8iVHU1fko4BBnmBG61|fc_0c7d22595484f800016ab1af9c39d887d2ad52b5b42a50ed21","toolName":"glob","content":[{"type":"text","text":"AGENTS.md\nCLAUDE.md"}],"details":{"scopePath":"**/AGENTS.md, **/CLAUDE.md","fileCount":2,"files":["AGENTS.md","CLAUDE.md"],"truncated":false,"cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core"},"isError":false,"timestamp":1790029724306}}
{"type":"message","id":"99207623","parentId":"e69a0d31","timestamp":"2026-09-21T22:28:44.320Z","message":{"role":"toolResult","toolCallId":"call_OsNZJOnvt6duyNA7x07PeoUU|fc_0c7d22595484f800016ab1af9c39f887d284e320e779bdb4a8","toolName":"grep","content":[{"type":"text","text":"# crates/\n\n## spt-daemon/src/\n### brain.rs\n 2334| // [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\n*2335| pub fn report_user_input(\n 2336| &mut self,\n 2337| report: crate::msg::UserInputReport,\n 2338| ) -> io::Result {\n### servehost.rs\n 40| /// Register `path` as an ordinary REFERENCE and narrow it in the same\n*41| /// locked pass (ADR-0058 Amendment 1): the FILE_ACCESS_HELPER's entry is a\n 42| /// live reference — edits visible, 404 once deleted — that merely expires\n 43| /// and is addressed to one endpoint.\n 44| ///\n...\n 681|\n*682| /// `AddScoped` is the FILE_ACCESS_HELPER's registration, and it had no cell\n 683| /// at all — neither for the file case nor this one. A quoted path can name a\n 684| /// DIRECTORY, and the helper must register it as one: the two halves (add a\n 685| /// reference, then narrow it) happen under one lock precisely so no window\n### wan.rs\n 1296| }\n*1297| // THE FILE_ACCESS_HELPER's REMOTE ARM (releases#17, ADR-0058 Amendment 1).\n 1298| // The user who quoted a path is on the SENDING node, so the file is there\n 1299| // and the registration has to happen there, on this endpoint's behalf.\n 1300| // Fired AFTER delivery and never before it: this is a convenience about a\n\n## spt-net/src/net/\n### webmsg.rs\n 73| /// for serving on the OWNER's node, addressed to one endpoint, for a\n*74| /// limited time — the \"off-node reach-back\" the FILE_ACCESS_HELPER needs\n 75| /// when the user who quoted a filepath is on the other node.\n 76| ///\n 77| /// It rides this family rather than minting a second one because the\n\n## spt-store/src/\n### helperline.rs\n*1|//! What a FILE_ACCESS_HELPER registration produced, recorded where the\n 2|//! now-signal can read it (releases#17, ADR-0058 Amendment 1).\n 3|//!\n 4|//! ## Why this store exists at all\n...\n 26|/// reads, so the signal costs one more read in a place it is already looking.\n*27|const HELPER_FILE: &str = \"helper-fetch.jsonl\";\n 28|\n 29|/// How many lines a read returns, newest last. A bound rather than the whole\n 30|/// file: this is read on a per-turn hook, and the delta set makes anything\n...\n 281| let perch = Path::new(\"owlery\").join(\"todlando\");\n*282| assert_eq!(helper_file_at(&perch), perch.join(\"helper-fetch.jsonl\"));\n 283| }\n 284|\n 285| // [unit->REQ-NOW-SIGNAL-FILE-ACCESS-HELPER] the file is BOUNDED, not just\n### serving.rs\n 27|\n*28|/// The lifetime a FILE_ACCESS_HELPER entry carries: 24 hours (ADR-0058\n 29|/// Amendment 1, operator-directed). Shorter than an attachment's because the\n 30|/// user quoted a path in passing rather than sending a copy.\n 31|// [impl->REQ-NOW-SIGNAL-FILE-ACCESS-HELPER]\n...\n 441| /// Narrow an existing live entry's lifetime and audience in place. The\n*442| /// FILE_ACCESS_HELPER registers a user-quoted path as an ordinary\n 443| /// REFERENCE (edits visible, deletion 404s) that merely expires and is\n 444| /// addressed to one endpoint, so this stays a property of an entry rather\n 445| /// than a fourth kind (ADR-0058 Amendment 1).\n\n## spt/\n\n### src/\n#### cli.rs\n 11741| // and the WEB surface's own access rules already say who may reach this\n*11742| // node. `audience` is the FILE_ACCESS_HELPER's narrowing (ADR-0058\n 11743| // Amendment 1), not this path's.\n 11744| None,\n 11745| ) {\n#### fetchverb.rs\n 3|//! **This verb's spelling is a published contract, not an implementation\n*4|//! detail**: the FILE_ACCESS_HELPER now-signal hands an agent this exact line to\n 5|//! run, so a rename here is a rename in something an agent was told to type.\n 6|//!\n 7|//! It rides the SAME path a browser does. Every fetch — a file on this node or\n#### serveverb.rs\n 140| // would make that answer a half-truth — most sharply for the entries a\n*141| // FILE_ACCESS_HELPER registers on an agent's behalf, which no operator\n 142| // typed at all.\n 143| // [impl->REQ-WEB-ENTRY-AUDIENCE]\n 144| if let Some(ttl) = entry.ttl_ms {\n...\n 573| /// `serve list` answers WHAT this node exposes and TO WHOM. The narrowing\n*574| /// is the half an operator cannot otherwise see: a FILE_ACCESS_HELPER entry\n 575| /// is registered on an agent's behalf, so nobody typed it and nothing else\n 576| /// reports it. An entry that renders its ttl and origin but silently omits\n 577| /// its audience is the registry giving a half-true answer.\n\n#### api/\n##### mod.rs\n 657| if !user_input.is_empty() {\n*658| nowsignal::report_user_input(&id, &session, &user_input);\n 659| }\n 660| let spec = nowsignal::resolve_spec(&ctx, spec_manifest, spec_file.as_deref());\n 661| nowsignal::cmd_now_signal(&ctx, &id, &session, &user_input, &agent_output, &spec)\n...\n 783| let proof = auth.proof();\n*784| nowsignal::report_user_input(\n 785| id, proof.session_id.as_deref().unwrap_or_default(), payload.as_deref().unwrap_or_default(),\n 786| );\n 787| }\n##### nowsignal.rs\n 151| Category::SealBrief => \"SEAL_BRIEF\",\n*152| Category::FileAccessHelper => \"FILE_ACCESS_HELPER\",\n 153| Category::LanExposed => \"LAN_EXPOSED\",\n 154| }\n 155| }\n...\n 161| /// the remaining deferred category (PROJECTS) is a name a forward-looking\n*162| /// adapter may well already carry. FILE_ACCESS_HELPER stopped being one of\n 163| /// those in WEBSERVE W2 — it is built, so it parses.\n 164| pub fn parse(name: &str) -> Option {\n 165| let up = name.trim().to_ascii_uppercase();\n...\n 688|\n*689|/// FILE_ACCESS_HELPER — the exact command for a file this endpoint was handed.\n 690|///\n 691|/// TWO TRIGGERS, ONE OUTPUT SHAPE (ADR-0058 Amendment 1):\n 692|///\n...\n 704|// [impl->REQ-NOW-SIGNAL-FILE-ACCESS-HELPER]\n*705|pub fn gather_file_access_helper(input: &PollInput, seen: &mut SeenSet) -> Vec {\n 706| let mut out = Vec::new();\n 707| let perch_path = perch::resolve_perch_path(input.id, perch::ParentHint::Infer);\n 708| // (a) THE ATTACHMENT TRIGGER. The io-log's TAIL is the read, not the whole\n...\n 1084|// [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\n*1085|pub(super) fn report_user_input(id: &str, session: &str, payload: &str) {\n 1086| use spt_daemon::brain::{Brain, PumpTrace};\n*1087| report_user_input_with(id, session, payload, |report| {\n 1088| Brain::cold_start_pump(\n 1089| &spt_daemon::endpoint::broker_socket_name(),\n 1090| now_ms(),\n...\n 1092| PumpTrace::Silent,\n*1093| ).and_then(|mut brain| brain.report_user_input(report))\n 1094| });\n 1095|}\n 1096|\n...\n 1098|// [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\n*1099|fn report_user_input_with(\n 1100| id: &str,\n 1101| session: &str,\n 1102| payload: &str,\n...\n 1192| Category::SealBrief => gather_seal_brief(&mut seen),\n*1193| Category::FileAccessHelper => gather_file_access_helper(&input, &mut seen),\n 1194| Category::LanExposed => gather_lan_exposed(),\n 1195| };\n 1196| // The seen-set is flushed even when the category rendered nothing: the\n...\n 1233| let mut probe = Probe { result: tx, called: false };\n*1234| report_user_input_with(\"ordinary\", \"session\", \"hello, carry on\", move |_| {\n 1235| probe.called();\n 1236| Err(std::io::Error::other(\"unexpected broker call\"))\n 1237| });\n...\n 1518|\n*1519| /// FILE_ACCESS_HELPER (a): the line an agent runs is the sender's own link,\n 1520| /// taken verbatim out of the envelope — and it is handed over ONCE per\n 1521| /// (message, attachment).\n 1522| ///\n...\n 1564| let mut seen = SeenSet::load(&session, Category::FileAccessHelper);\n*1565| let first = gather_file_access_helper(&input, &mut seen);\n 1566| seen.flush();\n 1567| assert_eq!(\n 1568| first,\n...\n 1573| let mut seen = SeenSet::load(&session, Category::FileAccessHelper);\n*1574| let second = gather_file_access_helper(&input, &mut seen);\n 1575| seen.flush();\n 1576| assert!(second.is_empty(), \"once per (message, attachment): {second:?}\");\n 1577|\n...\n 1594| let mut seen = SeenSet::load(&session, Category::FileAccessHelper);\n*1595| assert!(gather_file_access_helper(&input, &mut seen).is_empty());\n 1596| clear_session(&session);\n 1597| }\n 1598|\n\n### tests/\n#### webserve_attachment_e2e.rs\n 13|//! `spt fetch` doubles as this file's HTTP client, deliberately: it is the verb\n*14|//! the FILE_ACCESS_HELPER signal hands an agent, so every arm below exercises\n 15|//! the exact path an agent will take rather than a socket a test invented.\n 16|//!\n 17|//! ## The arms (one `#[test]`, sequential — `SPT_HOME` is process-global)\n\nSkipped missing paths: scripts"}],"details":{"scopePath":"crates, tests","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":31,"fileCount":12,"files":["crates/spt-daemon/src/brain.rs","crates/spt-daemon/src/servehost.rs","crates/spt-daemon/src/wan.rs","crates/spt-net/src/net/webmsg.rs","crates/spt-store/src/helperline.rs","crates/spt-store/src/serving.rs","crates/spt/src/api/mod.rs","crates/spt/src/api/nowsignal.rs","crates/spt/src/cli.rs","crates/spt/src/fetchverb.rs","crates/spt/src/serveverb.rs","crates/spt/tests/webserve_attachment_e2e.rs"],"fileMatches":[{"path":"crates/spt-daemon/src/brain.rs","count":1},{"path":"crates/spt-daemon/src/servehost.rs","count":2},{"path":"crates/spt-daemon/src/wan.rs","count":1},{"path":"crates/spt-net/src/net/webmsg.rs","count":1},{"path":"crates/spt-store/src/helperline.rs","count":3},{"path":"crates/spt-store/src/serving.rs","count":2},{"path":"crates/spt/src/api/mod.rs","count":2},{"path":"crates/spt/src/api/nowsignal.rs","count":14},{"path":"crates/spt/src/cli.rs","count":1},{"path":"crates/spt/src/fetchverb.rs","count":1},{"path":"crates/spt/src/serveverb.rs","count":2},{"path":"crates/spt/tests/webserve_attachment_e2e.rs","count":1}],"truncated":false,"displayContent":"# crates/\n\n## spt-daemon/src/\n### brain.rs\n 2334│ // [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\n*2335│ pub fn report_user_input(\n 2336│ &mut self,\n 2337│ report: crate::msg::UserInputReport,\n 2338│ ) -> io::Result {\n### servehost.rs\n 40│ /// Register `path` as an ordinary REFERENCE and narrow it in the same\n *41│ /// locked pass (ADR-0058 Amendment 1): the FILE_ACCESS_HELPER's entry is a\n 42│ /// live reference — edits visible, 404 once deleted — that merely expires\n 43│ /// and is addressed to one endpoint.\n 44│ ///\n │...\n 681│\n*682│ /// `AddScoped` is the FILE_ACCESS_HELPER's registration, and it had no cell\n 683│ /// at all — neither for the file case nor this one. A quoted path can name a\n 684│ /// DIRECTORY, and the helper must register it as one: the two halves (add a\n 685│ /// reference, then narrow it) happen under one lock precisely so no window\n### wan.rs\n 1296│ }\n*1297│ // THE FILE_ACCESS_HELPER's REMOTE ARM (releases#17, ADR-0058 Amendment 1).\n 1298│ // The user who quoted a path is on the SENDING node, so the file is there\n 1299│ // and the registration has to happen there, on this endpoint's behalf.\n 1300│ // Fired AFTER delivery and never before it: this is a convenience about a\n\n## spt-net/src/net/\n### webmsg.rs\n 73│ /// for serving on the OWNER's node, addressed to one endpoint, for a\n*74│ /// limited time — the \"off-node reach-back\" the FILE_ACCESS_HELPER needs\n 75│ /// when the user who quoted a filepath is on the other node.\n 76│ ///\n 77│ /// It rides this family rather than minting a second one because the\n\n## spt-store/src/\n### helperline.rs\n *1│//! What a FILE_ACCESS_HELPER registration produced, recorded where the\n 2│//! now-signal can read it (releases#17, ADR-0058 Amendment 1).\n 3│//!\n 4│//! ## Why this store exists at all\n │...\n 26│/// reads, so the signal costs one more read in a place it is already looking.\n *27│const HELPER_FILE: &str = \"helper-fetch.jsonl\";\n 28│\n 29│/// How many lines a read returns, newest last. A bound rather than the whole\n 30│/// file: this is read on a per-turn hook, and the delta set makes anything\n │...\n 281│ let perch = Path::new(\"owlery\").join(\"todlando\");\n*282│ assert_eq!(helper_file_at(&perch), perch.join(\"helper-fetch.jsonl\"));\n 283│ }\n 284│\n 285│ // [unit->REQ-NOW-SIGNAL-FILE-ACCESS-HELPER] the file is BOUNDED, not just\n### serving.rs\n 27│\n *28│/// The lifetime a FILE_ACCESS_HELPER entry carries: 24 hours (ADR-0058\n 29│/// Amendment 1, operator-directed). Shorter than an attachment's because the\n 30│/// user quoted a path in passing rather than sending a copy.\n 31│// [impl->REQ-NOW-SIGNAL-FILE-ACCESS-HELPER]\n │...\n 441│ /// Narrow an existing live entry's lifetime and audience in place. The\n*442│ /// FILE_ACCESS_HELPER registers a user-quoted path as an ordinary\n 443│ /// REFERENCE (edits visible, deletion 404s) that merely expires and is\n 444│ /// addressed to one endpoint, so this stays a property of an entry rather\n 445│ /// than a fourth kind (ADR-0058 Amendment 1).\n\n## spt/\n\n### src/\n#### cli.rs\n 11741│ // and the WEB surface's own access rules already say who may reach this\n*11742│ // node. `audience` is the FILE_ACCESS_HELPER's narrowing (ADR-0058\n 11743│ // Amendment 1), not this path's.\n 11744│ None,\n 11745│ ) {\n#### fetchverb.rs\n 3│//! **This verb's spelling is a published contract, not an implementation\n*4│//! detail**: the FILE_ACCESS_HELPER now-signal hands an agent this exact line to\n 5│//! run, so a rename here is a rename in something an agent was told to type.\n 6│//!\n 7│//! It rides the SAME path a browser does. Every fetch — a file on this node or\n#### serveverb.rs\n 140│ // would make that answer a half-truth — most sharply for the entries a\n*141│ // FILE_ACCESS_HELPER registers on an agent's behalf, which no operator\n 142│ // typed at all.\n 143│ // [impl->REQ-WEB-ENTRY-AUDIENCE]\n 144│ if let Some(ttl) = entry.ttl_ms {\n │...\n 573│ /// `serve list` answers WHAT this node exposes and TO WHOM. The narrowing\n*574│ /// is the half an operator cannot otherwise see: a FILE_ACCESS_HELPER entry\n 575│ /// is registered on an agent's behalf, so nobody typed it and nothing else\n 576│ /// reports it. An entry that renders its ttl and origin but silently omits\n 577│ /// its audience is the registry giving a half-true answer.\n\n#### api/\n##### mod.rs\n 657│ if !user_input.is_empty() {\n*658│ nowsignal::report_user_input(&id, &session, &user_input);\n 659│ }\n 660│ let spec = nowsignal::resolve_spec(&ctx, spec_manifest, spec_file.as_deref());\n 661│ nowsignal::cmd_now_signal(&ctx, &id, &session, &user_input, &agent_output, &spec)\n │...\n 783│ let proof = auth.proof();\n*784│ nowsignal::report_user_input(\n 785│ id, proof.session_id.as_deref().unwrap_or_default(), payload.as_deref().unwrap_or_default(),\n 786│ );\n 787│ }\n##### nowsignal.rs\n 151│ Category::SealBrief => \"SEAL_BRIEF\",\n *152│ Category::FileAccessHelper => \"FILE_ACCESS_HELPER\",\n 153│ Category::LanExposed => \"LAN_EXPOSED\",\n 154│ }\n 155│ }\n │...\n 161│ /// the remaining deferred category (PROJECTS) is a name a forward-looking\n *162│ /// adapter may well already carry. FILE_ACCESS_HELPER stopped being one of\n 163│ /// those in WEBSERVE W2 — it is built, so it parses.\n 164│ pub fn parse(name: &str) -> Option {\n 165│ let up = name.trim().to_ascii_uppercase();\n │...\n 688│\n *689│/// FILE_ACCESS_HELPER — the exact command for a file this endpoint was handed.\n 690│///\n 691│/// TWO TRIGGERS, ONE OUTPUT SHAPE (ADR-0058 Amendment 1):\n 692│///\n │...\n 704│// [impl->REQ-NOW-SIGNAL-FILE-ACCESS-HELPER]\n *705│pub fn gather_file_access_helper(input: &PollInput, seen: &mut SeenSet) -> Vec {\n 706│ let mut out = Vec::new();\n 707│ let perch_path = perch::resolve_perch_path(input.id, perch::ParentHint::Infer);\n 708│ // (a) THE ATTACHMENT TRIGGER. The io-log's TAIL is the read, not the whole\n │...\n 1084│// [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\n*1085│pub(super) fn report_user_input(id: &str, session: &str, payload: &str) {\n 1086│ use spt_daemon::brain::{Brain, PumpTrace};\n*1087│ report_user_input_with(id, session, payload, |report| {\n 1088│ Brain::cold_start_pump(\n 1089│ &spt_daemon::endpoint::broker_socket_name(),\n 1090│ now_ms(),\n │...\n 1092│ PumpTrace::Silent,\n*1093│ ).and_then(|mut brain| brain.report_user_input(report))\n 1094│ });\n 1095│}\n 1096│\n │...\n 1098│// [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\n*1099│fn report_user_input_with(\n 1100│ id: &str,\n 1101│ session: &str,\n 1102│ payload: &str,\n │...\n 1192│ Category::SealBrief => gather_seal_brief(&mut seen),\n*1193│ Category::FileAccessHelper => gather_file_access_helper(&input, &mut seen),\n 1194│ Category::LanExposed => gather_lan_exposed(),\n 1195│ };\n 1196│ // The seen-set is flushed even when the category rendered nothing: the\n │...\n 1233│ let mut probe = Probe { result: tx, called: false };\n*1234│ report_user_input_with(\"ordinary\", \"session\", \"hello, carry on\", move |_| {\n 1235│ probe.called();\n 1236│ Err(std::io::Error::other(\"unexpected broker call\"))\n 1237│ });\n │...\n 1518│\n*1519│ /// FILE_ACCESS_HELPER (a): the line an agent runs is the sender's own link,\n 1520│ /// taken verbatim out of the envelope — and it is handed over ONCE per\n 1521│ /// (message, attachment).\n 1522│ ///\n │...\n 1564│ let mut seen = SeenSet::load(&session, Category::FileAccessHelper);\n*1565│ let first = gather_file_access_helper(&input, &mut seen);\n 1566│ seen.flush();\n 1567│ assert_eq!(\n 1568│ first,\n │...\n 1573│ let mut seen = SeenSet::load(&session, Category::FileAccessHelper);\n*1574│ let second = gather_file_access_helper(&input, &mut seen);\n 1575│ seen.flush();\n 1576│ assert!(second.is_empty(), \"once per (message, attachment): {second:?}\");\n 1577│\n │...\n 1594│ let mut seen = SeenSet::load(&session, Category::FileAccessHelper);\n*1595│ assert!(gather_file_access_helper(&input, &mut seen).is_empty());\n 1596│ clear_session(&session);\n 1597│ }\n 1598│\n\n### tests/\n#### webserve_attachment_e2e.rs\n 13│//! `spt fetch` doubles as this file's HTTP client, deliberately: it is the verb\n*14│//! the FILE_ACCESS_HELPER signal hands an agent, so every arm below exercises\n 15│//! the exact path an agent will take rather than a socket a test invented.\n 16│//!\n 17│//! ## The arms (one `#[test]`, sequential — `SPT_HOME` is process-global)","missingPaths":["scripts"]},"isError":false,"timestamp":1790029724319}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_uuI7i3OwU0EkuXRrXfqAvAX1|fc_0c7d22595484f800016ab1afa7a04087d2bfba0bddd08bd964","toolName":"read","startedAt":"2026-09-21T22:28:55.701Z","args":{"path":"AGENTS.md:raw"},"intent":"Reading project rules"},"id":"203850f0","parentId":"99207623","timestamp":"2026-09-21T22:28:55.701Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_gk7Dluc5Ksmir0Zxja1o7OtR|fc_0c7d22595484f800016ab1afa7a04c87d29cc15403f1cf2752","toolName":"read","startedAt":"2026-09-21T22:28:55.702Z","args":{"path":"CLAUDE.md:raw"},"intent":"Reading supplemental rules"},"id":"323fd1ee","parentId":"203850f0","timestamp":"2026-09-21T22:28:55.702Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_ASAe0dHsqay410ejFZGjgajC|fc_0c7d22595484f800016ab1afa7a05487d2bc8c7e04fec7c6b3","toolName":"read","startedAt":"2026-09-21T22:28:55.702Z","args":{"path":"docs/INPUT-PROVENANCE-CONTRACT.md:387-503"},"intent":"Reading current provenance ruling"},"id":"6bbfc848","parentId":"323fd1ee","timestamp":"2026-09-21T22:28:55.702Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_wOxOBuRid6sosAED3ehyOWkX|fc_0c7d22595484f800016ab1afa7a05c87d2905c4a0cc1350d34","toolName":"read","startedAt":"2026-09-21T22:28:55.702Z","args":{"path":"crates/spt/src/api/mod.rs:570-675,715-805"},"intent":"Reading public API dispatch"},"id":"a496ab99","parentId":"6bbfc848","timestamp":"2026-09-21T22:28:55.702Z"}
{"type":"message","id":"3be25b79","parentId":"a496ab99","timestamp":"2026-09-21T22:28:55.702Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_uuI7i3OwU0EkuXRrXfqAvAX1|fc_0c7d22595484f800016ab1afa7a04087d2bfba0bddd08bd964","name":"read","arguments":{"i":"Reading project rules","path":"AGENTS.md:raw"},"intent":"Reading project rules"},{"type":"toolCall","id":"call_gk7Dluc5Ksmir0Zxja1o7OtR|fc_0c7d22595484f800016ab1afa7a04c87d29cc15403f1cf2752","name":"read","arguments":{"i":"Reading supplemental rules","path":"CLAUDE.md:raw"},"intent":"Reading supplemental rules"},{"type":"toolCall","id":"call_ASAe0dHsqay410ejFZGjgajC|fc_0c7d22595484f800016ab1afa7a05487d2bc8c7e04fec7c6b3","name":"read","arguments":{"i":"Reading current provenance ruling","path":"docs/INPUT-PROVENANCE-CONTRACT.md:387-503"},"intent":"Reading current provenance ruling"},{"type":"toolCall","id":"call_wOxOBuRid6sosAED3ehyOWkX|fc_0c7d22595484f800016ab1afa7a05c87d2905c4a0cc1350d34","name":"read","arguments":{"i":"Reading public API dispatch","path":"crates/spt/src/api/mod.rs:570-675,715-805"},"intent":"Reading public API dispatch"},{"type":"toolCall","id":"call_C2u3CBPxjPH6QqvUD6Pm9vUm|fc_0c7d22595484f800016ab1afa7a06487d295cdf483f0fbc57d","name":"read","arguments":{"i":"Reading helper report gather","path":"crates/spt/src/api/nowsignal.rs:689-760,1070-1135"},"intent":"Reading helper report gather"},{"type":"toolCall","id":"call_JXOdbDqxkelt5pLurfHscQks|fc_0c7d22595484f800016ab1afa7a06887d2b0171c8a79243848","name":"glob","arguments":{"i":"Finding field acceptance fixtures","path":"**/*field*;**/*provenance*;**/*rc*e2e*;**/*harness*;**/*two*node*","hidden":true,"gitignore":true,"limit":70},"intent":"Finding field acceptance fixtures"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":10749,"output":239,"cacheRead":11520,"cacheWrite":0,"totalTokens":22508,"cost":{"input":0.10749,"output":0.01195,"cacheRead":0.011519999999999999,"cacheWrite":0,"total":0.13096}},"stopReason":"toolUse","timestamp":1790029724333,"responseId":"resp_0c7d22595484f800016ab1af9c899487d2b7897219b831e3fa","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0c7d22595484f800016ab1afa7a04087d2bfba0bddd08bd964","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading project rules\",\"path\":\"AGENTS.md:raw\"}","call_id":"call_uuI7i3OwU0EkuXRrXfqAvAX1","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"read","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1afa7a04c87d29cc15403f1cf2752","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading supplemental rules\",\"path\":\"CLAUDE.md:raw\"}","call_id":"call_gk7Dluc5Ksmir0Zxja1o7OtR","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"read","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1afa7a05487d2bc8c7e04fec7c6b3","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading current provenance ruling\",\"path\":\"docs/INPUT-PROVENANCE-CONTRACT.md:387-503\"}","call_id":"call_ASAe0dHsqay410ejFZGjgajC","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"read","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1afa7a05c87d2905c4a0cc1350d34","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading public API dispatch\",\"path\":\"crates/spt/src/api/mod.rs:570-675,715-805\"}","call_id":"call_wOxOBuRid6sosAED3ehyOWkX","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"read","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1afa7a06487d295cdf483f0fbc57d","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading helper report gather\",\"path\":\"crates/spt/src/api/nowsignal.rs:689-760,1070-1135\"}","call_id":"call_C2u3CBPxjPH6QqvUD6Pm9vUm","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"read","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1afa7a06887d2b0171c8a79243848","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding field acceptance fixtures\",\"path\":\"**/*field*;**/*provenance*;**/*rc*e2e*;**/*harness*;**/*two*node*\",\"hidden\":true,\"gitignore\":true,\"limit\":70}","call_id":"call_JXOdbDqxkelt5pLurfHscQks","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"glob","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}}]},"duration":11365.375100000005,"ttft":11315.322799999994,"completedAt":1790029735699,"contextSnapshot":{"promptTokens":22269,"nonMessageTokens":10457,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_C2u3CBPxjPH6QqvUD6Pm9vUm|fc_0c7d22595484f800016ab1afa7a06487d295cdf483f0fbc57d","toolName":"read","startedAt":"2026-09-21T22:28:55.703Z","args":{"path":"crates/spt/src/api/nowsignal.rs:689-760,1070-1135"},"intent":"Reading helper report gather"},"id":"e6077f47","parentId":"3be25b79","timestamp":"2026-09-21T22:28:55.703Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_JXOdbDqxkelt5pLurfHscQks|fc_0c7d22595484f800016ab1afa7a06887d2b0171c8a79243848","toolName":"glob","startedAt":"2026-09-21T22:28:55.703Z","args":{"path":"**/*field*;**/*provenance*;**/*rc*e2e*;**/*harness*;**/*two*node*"},"intent":"Finding field acceptance fixtures"},"id":"79806b53","parentId":"e6077f47","timestamp":"2026-09-21T22:28:55.703Z"}
{"type":"message","id":"a580cfa1","parentId":"79806b53","timestamp":"2026-09-21T22:28:55.710Z","message":{"role":"toolResult","toolCallId":"call_uuI7i3OwU0EkuXRrXfqAvAX1|fc_0c7d22595484f800016ab1afa7a04087d2bfba0bddd08bd964","toolName":"read","content":[{"type":"text","text":"# spt-core — agent working rules\n\nHarness-independent core for an agent ecosystem (messaging, live-agent lifecycle, terminal hosting, P2P networking, runtime-manifest harness contract). Rust crates + a single `spt` binary. Clean-room rebuild of `claude_skill_owl`.\n\n**Orientation — read before working:** `PRD.md` (requirements), `ROADMAP.md` (build path), `CONTEXT.md` (glossary/model, authoritative for meaning), `docs/adr/` (decisions), `docs/KNOWN-HAZARDS.md` (invariants we must not re-break), `docs/{STORAGE,MANIFEST,CONTEXT-MEMORY,DOCS-STRATEGY,TRACEABILITY}.md`.\n\nFor maintainer/debug update work, also read `docs/DEBUG-ROLLOUT.md` before touching the update-set or rollout path.\n\nFor work needing Linux tests and proof, this machine is authorized to ssh into a Linux box: `reavus@kitsubito`\n\nIMPORTANT: All agents you work alongside run on spt-core itself — the legacy-SPT (`$OWL`/`$LIVE`) era ended with the 2026-07 fleet migration; those commands are gone. Reach other agents with `spt send` (or the `/sptc:send` skill); keep message bodies short, and send long bodies from a file rather than inline. Everything else can be learned from the corresponding `/sptc:` skill doc.\n\n## Requirement traceability (binding)\n\nThis project uses `traceable-reqs` (`traceable-reqs.toml` = the authoritative `REQ-*` registry). The full contract is `docs/TRACEABILITY.md`. The rules you must follow:\n\n1. **Tag evidence in the same change.** When you write a function/test/doc-section that satisfies a requirement stage, add its tag in that same commit:\n `// [impl->REQ-FOO]` · `// [unit->REQ-FOO]` · ``\n Stages: `doc` / `impl` / `unit` / `int`. Tag *on or immediately above* the real evidence — never at file tops to satisfy coverage.\n2. **Run `traceable-reqs check` before declaring work done.** Exit-1 means missing/invalid evidence — fix it, don't ship it.\n3. **New requirement → add it to `traceable-reqs.toml` first** (with a `REQ-*` id), then satisfy it. No untracked work; no untagged evidence.\n4. **KNOWN-HAZARDS are `REQ-HAZARD-*` requirements** — each needs a test before it's \"covered.\" Treat the hazard list as a conformance checklist you must satisfy, not advice.\n5. **Activate, don't pre-fail.** Requirements you aren't yet working stay `required_stages = []`. Activate (set real stages) only when starting the milestone that delivers them.\n\n## Issue tracking (unique case)\n\nCodebase issues are maintained on **`BigscreenVR/spt-bs-releases`** — the less-private *releases* repo — NOT on `spt-bs-core` where the code lives. This is a deliberate exception (operator-ruled 2026-07-27): file, triage, and reference issues against `spt-bs-releases`.\n\nRequests and milestones are tracked through the **alchemy shell** (`alchemy-0`, the Requests shell bound to `spt-bs-releases`) on top of those GitHub issues. The label taxonomy is the workflow: `state:` BACKLOG → EVAL → GREENLIT → WIP → ACCEPTANCE → DONE (plus CUT / SHELVED), `type:` BUGFIX / ADDITION / CHANGE, `flag: NEEDS-OPERATOR`, and per-node `kind: SPT-TRACKING` pins (marked DO NOT DELETE — leave them alone).\n\n## Other conventions\n\n- Match surrounding code style; copy-verbatim the sister project's stable wire/schema formats (ADR-0001), clean-room everything else.\n- Honor every `docs/KNOWN-HAZARDS.md` invariant — these are real bugs already paid for once.\n- Docs are dual-audience (human + AI dev-agent) per `docs/DOCS-STRATEGY.md`; doc generation is CI-gated against drift.\n- Commit messages end with the project's co-author trailer, exact spelling `Co-authored by: ` (e.g. `Co-authored by: todlando`) — NOT git's hyphenated `Co-Authored-By:`; CI's runner-informant parses only the space spelling for attribution.\n - **Audit this trailer with `git log --grep` or a raw body read, NEVER `%(trailers:)`** (nor `interpret-trailers --parse`): git's trailer tokenizer requires a whitespace-free token, so the space spelling is structurally invisible to it and every trailer query returns a confident EMPTY on every commit — a clean zero that reads as total attribution loss. Measured 2026-07-30 (main @`8f3e10b`, Signed-off-by and hyphenated-key controls both parse); re-derived at full cost 2026-08-03 by one of its own original measurers, which is why this sentence lives here at the mandate rather than in a document you must decide to open.\n- **Worktrees (binding, operator-ruled 2026-07-05):** every `git worktree` (gate rigs, agent scratch, anything) goes under `.worktrees/` in THIS project's root (`.gitignore`d) — e.g. `git worktree add --detach .worktrees/gate- `. NEVER create worktrees as siblings of the project dir; stray sibling folders accumulate orphan-pinned skeletons and pollute `~/Documents/projects`. Remove yours when done (`git worktree remove` + prune; retry later if a handle pins it).\n\n- **Build-cache pools (binding, releases#103):** a cargo `target/` directory belongs to ONE source tree. Two trees building into one pool overwrite each other's artifacts and fabricate reds that belong to neither — the v0.51.0 W1/H1 `E0308` that vanished on re-run. **The rule is about the RELATIONSHIP, not the path:** a junction and a `CARGO_TARGET_DIR` env var reach the same hazard, and the env var leaves no directory entry to notice afterwards, so \"is this dir under `.worktrees/`\" never was the question. A build script enforces it (`crates/spt-store/build.rs`) and refuses with `SPT_POOL_FOREIGN`. **Sharing a pool SEQUENTIALLY is fine and expected** — a finished lane is taken over loudly, not refused; only a LIVE lane blocks you. Claim a pool at lane start with `cargo run -p xtask -- pool-claim --pool --label ` and drop it with `pool-release`. **The claim verb WRITES a record and does not read the incumbent's lane state — claiming is last-writer-wins by construction; every LANE-IDENTITY enforcement arm (refuse/takeover/unproven/hatch) lives in the BUILD (`crates/spt-store/build.rs`) and speaks only at the next build. Predict lane-identity refusals from builds, never from `pool-claim` (IR-42). One ADDRESSING guard does live in the claim verb itself (ir56, post-IR-42): claiming another worktree's pool from outside it exits 2 with nothing written unless you pass `--foreign-pool` for a deliberate sequential takeover — measured todlando 2026-08-28, doyle same day.** **The claim records your lane's GIT IDENTITY — its branch and the base sha it carried — and that is what decides whether the lane has finished: unlanded work refuses, a merged (or vanished, or re-pointed) branch is taken over.** The holder process it also records is ADVISORY: a live holder still refuses, but a dead one no longer authorizes a takeover, because a cleared agent session is not a finished lane (measured: 3 of 3 claims had dead holders while one of those lanes was live). Claim from the lane's own worktree so the identity it writes is the lane's. A pool holding another tree's artifacts with NO claim refuses and prints the claim command. `SPT_POOL_UNCHECKED=1` overrides and **says so on every build it allows** — there is no silent override.\n- **Target-tree teardown (releases#103, same lane):** never delete a `target/` you have not classified. Check OUTBOUND first (`Get-Item -Force`: a junction is deleted as a link, a real dir as a tree), then sweep INBOUND for reparse points aimed at it before removing a real one, and measure size and free space before and after so the reclaim is a number rather than a claim. Reap the target SUBTREE, never a session or worktree directory around it. Do not point `CARGO_TARGET_DIR` into a scratchpad (v0.50.0 incident) or at another checkout's target (H1 incident).\n- **CI / merge strategy:** golden CI (ADR-0050, ruled 2026-07-27) — milestone-batch golden runs, thin-lane PRs, ff-only main (tested sha == merged sha). Piloting from the next milestone; read the ADR before shaping a PR lane.\n\nIf you finish a significant body of work without need for user intervention, or if your context gets too high, you can clear your own context and keep moving:\n1. Create a JIT plan for the next immediate body of work, if it isn't already planned\n2. If you are a live agent, /sptc:commune with immediate next steps and broad summary of the project's status + end goal\n3. Execute the /self-clear skill\n"}],"details":{"totalLines":48,"displayContent":{"text":"# spt-core — agent working rules\r\n\r\nHarness-independent core for an agent ecosystem (messaging, live-agent lifecycle, terminal hosting, P2P networking, runtime-manifest harness contract). Rust crates + a single `spt` binary. Clean-room rebuild of `claude_skill_owl`.\r\n\r\n**Orientation — read before working:** `PRD.md` (requirements), `ROADMAP.md` (build path), `CONTEXT.md` (glossary/model, authoritative for meaning), `docs/adr/` (decisions), `docs/KNOWN-HAZARDS.md` (invariants we must not re-break), `docs/{STORAGE,MANIFEST,CONTEXT-MEMORY,DOCS-STRATEGY,TRACEABILITY}.md`.\r\n\r\nFor maintainer/debug update work, also read `docs/DEBUG-ROLLOUT.md` before touching the update-set or rollout path.\r\n\r\nFor work needing Linux tests and proof, this machine is authorized to ssh into a Linux box: `reavus@kitsubito`\r\n\r\nIMPORTANT: All agents you work alongside run on spt-core itself — the legacy-SPT (`$OWL`/`$LIVE`) era ended with the 2026-07 fleet migration; those commands are gone. Reach other agents with `spt send` (or the `/sptc:send` skill); keep message bodies short, and send long bodies from a file rather than inline. Everything else can be learned from the corresponding `/sptc:` skill doc.\r\n\r\n## Requirement traceability (binding)\r\n\r\nThis project uses `traceable-reqs` (`traceable-reqs.toml` = the authoritative `REQ-*` registry). The full contract is `docs/TRACEABILITY.md`. The rules you must follow:\r\n\r\n1. **Tag evidence in the same change.** When you write a function/test/doc-section that satisfies a requirement stage, add its tag in that same commit:\r\n `// [impl->REQ-FOO]` · `// [unit->REQ-FOO]` · ``\r\n Stages: `doc` / `impl` / `unit` / `int`. Tag *on or immediately above* the real evidence — never at file tops to satisfy coverage.\r\n2. **Run `traceable-reqs check` before declaring work done.** Exit-1 means missing/invalid evidence — fix it, don't ship it.\r\n3. **New requirement → add it to `traceable-reqs.toml` first** (with a `REQ-*` id), then satisfy it. No untracked work; no untagged evidence.\r\n4. **KNOWN-HAZARDS are `REQ-HAZARD-*` requirements** — each needs a test before it's \"covered.\" Treat the hazard list as a conformance checklist you must satisfy, not advice.\r\n5. **Activate, don't pre-fail.** Requirements you aren't yet working stay `required_stages = []`. Activate (set real stages) only when starting the milestone that delivers them.\r\n\r\n## Issue tracking (unique case)\r\n\r\nCodebase issues are maintained on **`BigscreenVR/spt-bs-releases`** — the less-private *releases* repo — NOT on `spt-bs-core` where the code lives. This is a deliberate exception (operator-ruled 2026-07-27): file, triage, and reference issues against `spt-bs-releases`.\r\n\r\nRequests and milestones are tracked through the **alchemy shell** (`alchemy-0`, the Requests shell bound to `spt-bs-releases`) on top of those GitHub issues. The label taxonomy is the workflow: `state:` BACKLOG → EVAL → GREENLIT → WIP → ACCEPTANCE → DONE (plus CUT / SHELVED), `type:` BUGFIX / ADDITION / CHANGE, `flag: NEEDS-OPERATOR`, and per-node `kind: SPT-TRACKING` pins (marked DO NOT DELETE — leave them alone).\r\n\r\n## Other conventions\r\n\r\n- Match surrounding code style; copy-verbatim the sister project's stable wire/schema formats (ADR-0001), clean-room everything else.\r\n- Honor every `docs/KNOWN-HAZARDS.md` invariant — these are real bugs already paid for once.\r\n- Docs are dual-audience (human + AI dev-agent) per `docs/DOCS-STRATEGY.md`; doc generation is CI-gated against drift.\r\n- Commit messages end with the project's co-author trailer, exact spelling `Co-authored by: ` (e.g. `Co-authored by: todlando`) — NOT git's hyphenated `Co-Authored-By:`; CI's runner-informant parses only the space spelling for attribution.\r\n - **Audit this trailer with `git log --grep` or a raw body read, NEVER `%(trailers:)`** (nor `interpret-trailers --parse`): git's trailer tokenizer requires a whitespace-free token, so the space spelling is structurally invisible to it and every trailer query returns a confident EMPTY on every commit — a clean zero that reads as total attribution loss. Measured 2026-07-30 (main @`8f3e10b`, Signed-off-by and hyphenated-key controls both parse); re-derived at full cost 2026-08-03 by one of its own original measurers, which is why this sentence lives here at the mandate rather than in a document you must decide to open.\r\n- **Worktrees (binding, operator-ruled 2026-07-05):** every `git worktree` (gate rigs, agent scratch, anything) goes under `.worktrees/` in THIS project's root (`.gitignore`d) — e.g. `git worktree add --detach .worktrees/gate- `. NEVER create worktrees as siblings of the project dir; stray sibling folders accumulate orphan-pinned skeletons and pollute `~/Documents/projects`. Remove yours when done (`git worktree remove` + prune; retry later if a handle pins it).\r\n\r\n- **Build-cache pools (binding, releases#103):** a cargo `target/` directory belongs to ONE source tree. Two trees building into one pool overwrite each other's artifacts and fabricate reds that belong to neither — the v0.51.0 W1/H1 `E0308` that vanished on re-run. **The rule is about the RELATIONSHIP, not the path:** a junction and a `CARGO_TARGET_DIR` env var reach the same hazard, and the env var leaves no directory entry to notice afterwards, so \"is this dir under `.worktrees/`\" never was the question. A build script enforces it (`crates/spt-store/build.rs`) and refuses with `SPT_POOL_FOREIGN`. **Sharing a pool SEQUENTIALLY is fine and expected** — a finished lane is taken over loudly, not refused; only a LIVE lane blocks you. Claim a pool at lane start with `cargo run -p xtask -- pool-claim --pool --label ` and drop it with `pool-release`. **The claim verb WRITES a record and does not read the incumbent's lane state — claiming is last-writer-wins by construction; every LANE-IDENTITY enforcement arm (refuse/takeover/unproven/hatch) lives in the BUILD (`crates/spt-store/build.rs`) and speaks only at the next build. Predict lane-identity refusals from builds, never from `pool-claim` (IR-42). One ADDRESSING guard does live in the claim verb itself (ir56, post-IR-42): claiming another worktree's pool from outside it exits 2 with nothing written unless you pass `--foreign-pool` for a deliberate sequential takeover — measured todlando 2026-08-28, doyle same day.** **The claim records your lane's GIT IDENTITY — its branch and the base sha it carried — and that is what decides whether the lane has finished: unlanded work refuses, a merged (or vanished, or re-pointed) branch is taken over.** The holder process it also records is ADVISORY: a live holder still refuses, but a dead one no longer authorizes a takeover, because a cleared agent session is not a finished lane (measured: 3 of 3 claims had dead holders while one of those lanes was live). Claim from the lane's own worktree so the identity it writes is the lane's. A pool holding another tree's artifacts with NO claim refuses and prints the claim command. `SPT_POOL_UNCHECKED=1` overrides and **says so on every build it allows** — there is no silent override.\r\n- **Target-tree teardown (releases#103, same lane):** never delete a `target/` you have not classified. Check OUTBOUND first (`Get-Item -Force`: a junction is deleted as a link, a real dir as a tree), then sweep INBOUND for reparse points aimed at it before removing a real one, and measure size and free space before and after so the reclaim is a number rather than a claim. Reap the target SUBTREE, never a session or worktree directory around it. Do not point `CARGO_TARGET_DIR` into a scratchpad (v0.50.0 incident) or at another checkout's target (H1 incident).\r\n- **CI / merge strategy:** golden CI (ADR-0050, ruled 2026-07-27) — milestone-batch golden runs, thin-lane PRs, ff-only main (tested sha == merged sha). Piloting from the next milestone; read the ADR before shaping a PR lane.\r\n\r\nIf you finish a significant body of work without need for user intervention, or if your context gets too high, you can clear your own context and keep moving:\r\n1. Create a JIT plan for the next immediate body of work, if it isn't already planned\r\n2. If you are a live agent, /sptc:commune with immediate next steps and broad summary of the project's status + end goal\r\n3. Execute the /self-clear skill\r\n","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48]},"fileSize":8436,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\AGENTS.md"}}},"isError":false,"timestamp":1790029735709}}
{"type":"message","id":"4b5bf84b","parentId":"a580cfa1","timestamp":"2026-09-21T22:28:55.711Z","message":{"role":"toolResult","toolCallId":"call_gk7Dluc5Ksmir0Zxja1o7OtR|fc_0c7d22595484f800016ab1afa7a04c87d29cc15403f1cf2752","toolName":"read","content":[{"type":"text","text":"@AGENTS.md\n\n\n"}],"details":{"totalLines":8,"displayContent":{"text":"@AGENTS.md\r\n\r\n\r\n","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8]},"fileSize":293,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\CLAUDE.md"}}},"isError":false,"timestamp":1790029735711}}
{"type":"message","id":"8cada8e4","parentId":"4b5bf84b","timestamp":"2026-09-21T22:28:55.713Z","message":{"role":"toolResult","toolCallId":"call_ASAe0dHsqay410ejFZGjgajC|fc_0c7d22595484f800016ab1afa7a05487d2bc8c7e04fec7c6b3","toolName":"read","content":[{"type":"text","text":"# Receipt-bound input provenance — core-only contract\n…\n## 7. Adapter answers on record\n…\n### omp-spt (emphasys, 2026-09-13, message 4II3N2NA) — answered from public upstream declarations, not a runtime measurement\n…\n**No submission-bound carrier.** `InputEvent` carries `type`, `text`, optional `images`, and\n…\ncore-issued value. `BeforeAgentStartEvent` carries `prompt`/`images`/`systemPrompt`, nothing more.\n**`InputEventResult` may replace text/images**, so observed text is not guaranteed to be the committed\npayload after later extensions run. `sendUserMessage` permits programmatic prompts and queued streaming.\n\n**§5.2 ordering: UNVERIFIED.** The declarations do not establish a pre-enqueue acceptance boundary;\nemphasys inspected upstream `main` declarations only and will not promise ordering or byte preservation.\n\n**§5.2b origin: `source` names a ROUTE, not a person.** `source === \"interactive\"` distinguishes input\nroutes from one another, not an authenticated controller from automation using the same route; no\nreplay/resume discriminator exists.\n\nScope carried with the answer: no experiment, no installed-runtime measurement, no core-source inspection.\n\n## 8. RULING (doyle, 2026-09-13; RE-CUT the same day on the operator's direction) — core-only; no token, nothing asked of adapters\n\n\n\n**Operator, 2026-09-13, direct:** \"#300 needs to be developed entirely independently of harness adapters.\nspt-core does not concern itself with harness adapter integration. omp-spt and/or claude-spt should not\nhave anything to do with #300. they already submit USER_INPUT kind event hooks, and that's all spt-core\nshould be asking of them.\"\n\nThat strikes the whole adapter half of this contract — §3's obligations, the token, and the first cut of\nthis ruling (a manifest declaration plus a submission id, retracted within the hour). What remains is\nwhat core can do with what it ALREADY receives: a session-authenticated USER_INPUT report carrying the\nexact payload, at whatever moment the harness reports it.\n\n1. **Core binds origin at RECEIPT of a path-bearing USER_INPUT report** — the session's current\n authenticated REMOTE controller seat (the broker-owned `driven_by`). No quoted paths means no broker\n IPC and no line. An absent hosted session, local seat, viewer-only seat, or no controller binds\n nothing silently. No adapter declares anything; no adapter is asked when it reports.\n2. **Own-injection exclusion.** Core delivers peer messages by writing into the session's PTY itself. A\n USER_INPUT whose payload matches a delivery core physically wrote into that session binds no origin.\n Comparison is exact bytes OR both byte sequences trimmed of ASCII whitespace at their ends, never\n payload-shape parsing or interior normalization. This is core's origin signal for the one injection\n source it owns; resumed-session re-submission and external automation stay uncharacterised and bind\n the seat as the submitter rule says.\n3. **Dedup is core-side, keyed on the report:** a repeat of the same payload within the same session\n while its reference is live re-registers nothing, emits no second helper notice, and extends no TTL.\n No adapter-minted id exists.\n4. **Serving semantics from #17 / ADR-0058 Am.1, corrected by Am.2:** submitter's machine, 24h TTL,\n audience the receiving endpoint, helper notice once per submission and path. A path that names no\n file on the submitter's machine is SILENTLY SKIPPED, with no fallback origin. The ordinary silent\n cases in (1) are not authorization failures. CLI broker-connect and unanswered-receipt failures are\n silent unless `SPT_PUMP_TRACE` enables diagnostics. Named declines apply only to failures with a\n remote controller; the broker's 10-second owner-reply timeout remains named. §4.7's historical\n all-but-one refusal rule is superseded.\n5. **The stated ceiling, instead of an adapter promise.** The report lags acceptance by whatever the\n harness's own path costs (claude-spt: 0.5–1.0 s measured, n=3; omp-spt: unmeasured). A cross-operator\n Take inside that lag attributes the submission to the NEW holder, whose own file is then served to the\n agent that holder now controls. Core states this; it does not ask adapters to shrink it. §1's\n prohibition on sampling stands for anything core might build LATER than receipt — receipt is the\n earliest moment core has the payload, and it is the moment used.\n6. **§4.1 token issuance and §4.5 grace period: STRUCK.** §7's adapter answers stay on record as\n measurements of the ceiling in (5), not as obligations.\n\n**Build:** `REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT` activates doc/impl/unit in\nthe product lane. Adapter side: NONE. The integration stage awaits the separately\nadmitted two-node field leg.\n\n### Implemented boundaries\n\n- Both `api state` USER_INPUT and `api now-signal --user-input` check for quoted paths\n before broker IPC; a pathless payload produces no receipt request or line. Path-bearing\n reports precede event fanout, shortform processing, or roster gathering. Without a\n hosted session or remote controller, the broker silently binds nothing. Otherwise it\n snapshots the live remote controller connection before validating the harness session\n and checking physical delivery-byte evidence. A later Take never changes that origin.\n `api state` carries the caller's resolved session proof. A capability token\n can still authorize the state event, but cannot borrow a session ID from disk\n to mint input provenance.\n- File requests and replies ride that same authenticated rc stream. The owner\n derives the audience from its own rc target, never from request-supplied\n audience text. The existing MSG_OUT-backed WEB ServeFor guard is unchanged.\n- The receipt helper waits at most 500 ms for acknowledgement, including a stalled\n connect/hello/write, not for serving. CLI broker-connect and unanswered-receipt failures\n stay silent unless the existing `SPT_PUMP_TRACE` diagnostic gate is enabled.\n A same-node report deadline prevents a worker that outlives that wait from binding to\n a later seat. This is not a bound on the entire hook (its other work has separate costs).\n The broker allows 10 seconds for the controller reply, then names the unanswered outcome.\n Owner work runs off the rc display/input pump. An unanswered request or uncertain\n owner RPC result retains its dedup fence for the possible reference lifetime:\n a lost reply is not proof that the owner exposed nothing.\n- Dedup is per harness session and exact payload hash in the broker-held PTY\n session; it survives brain replacement. Live records are never evicted to make\n room: 4096 retained receipts or 64 unretired reply deadlines refuse new grants\n by name. Answered requests still count until their deadline worker exits.\n The owner reuses a live same-audience input reference without extending it or\n changing unrelated exposure. Its timestamp is the earlier of receipt time and\n owner time, so clock skew cannot lengthen either side's 24-hour bound.\n- Physical delivery writes retain fixed-size streaming evidence for exact bytes and\n ASCII-edge-trimmed bytes, not payload shapes or interior-normalized text. Evidence is\n published in physical-write order, not when delivery is merely queued.\n Source-tagged controller/typeahead and choreography keys are not delivery text.\n In-progress or partially failed physical delivery writes make provenance unavailable\n by name when a remote controller is seated rather than guessing; no receipt blocks\n on a PTY writer. Session-lifetime evidence is never silently evicted (65536 distinct\n delivery candidates is the named capacity limit; exact and trimmed evidence share\n one candidate quota). A later human payload matching either comparison\n is indistinguishable from these known bytes and is excluded too; external automation\n and native harness re-submission remain subject to the receipt-seat ceiling above.\n- Missing files produce neither helper notices nor declined diagnostics. No quoted paths,\n absent hosted sessions, and local/viewer-only/no-controller seats are also silent.\n With a remote controller seated, wrong session, unknown delivery evidence, queue\n pressure, owner refusal, the broker's owner-reply timeout, and persistence failure\n each name their condition. CLI transport diagnostics remain gated by `SPT_PUMP_TRACE`.\n\n### Pending field acceptance — not executed in the doc/impl/unit lane\n\nThe separately admitted two-node field leg must exercise a remote controller's quoted\npath being served only to the receiving agent, and local input not being served.\nIts hazard arm must keep a **remote controller seated while core physically delivers\na path-bearing peer message into the receiving session**: the ensuing USER_INPUT\nreport must cause **no serve**. A viewer-only or empty-seat run cannot prove that arm.\nThe same field leg must measure the added hook cost; the 500 ms receipt wait bound\nis not an observed hook-cost measurement. These obligations remain pending and do\nnot activate `int` or impose adapter integration work. The historical measurements\nin §7 are not execution evidence for this implementation."}],"details":{"totalLines":503,"displayContent":{"text":"# Receipt-bound input provenance — core-only contract\n…\n## 7. Adapter answers on record\n…\n### omp-spt (emphasys, 2026-09-13, message 4II3N2NA) — answered from public upstream declarations, not a runtime measurement\n…\n**No submission-bound carrier.** `InputEvent` carries `type`, `text`, optional `images`, and\n…\ncore-issued value. `BeforeAgentStartEvent` carries `prompt`/`images`/`systemPrompt`, nothing more.\r\n**`InputEventResult` may replace text/images**, so observed text is not guaranteed to be the committed\r\npayload after later extensions run. `sendUserMessage` permits programmatic prompts and queued streaming.\r\n\r\n**§5.2 ordering: UNVERIFIED.** The declarations do not establish a pre-enqueue acceptance boundary;\r\nemphasys inspected upstream `main` declarations only and will not promise ordering or byte preservation.\r\n\r\n**§5.2b origin: `source` names a ROUTE, not a person.** `source === \"interactive\"` distinguishes input\r\nroutes from one another, not an authenticated controller from automation using the same route; no\r\nreplay/resume discriminator exists.\r\n\r\nScope carried with the answer: no experiment, no installed-runtime measurement, no core-source inspection.\r\n\r\n## 8. RULING (doyle, 2026-09-13; RE-CUT the same day on the operator's direction) — core-only; no token, nothing asked of adapters\r\n\r\n\r\n\r\n**Operator, 2026-09-13, direct:** \"#300 needs to be developed entirely independently of harness adapters.\r\nspt-core does not concern itself with harness adapter integration. omp-spt and/or claude-spt should not\r\nhave anything to do with #300. they already submit USER_INPUT kind event hooks, and that's all spt-core\r\nshould be asking of them.\"\r\n\r\nThat strikes the whole adapter half of this contract — §3's obligations, the token, and the first cut of\r\nthis ruling (a manifest declaration plus a submission id, retracted within the hour). What remains is\r\nwhat core can do with what it ALREADY receives: a session-authenticated USER_INPUT report carrying the\r\nexact payload, at whatever moment the harness reports it.\r\n\r\n1. **Core binds origin at RECEIPT of a path-bearing USER_INPUT report** — the session's current\r\n authenticated REMOTE controller seat (the broker-owned `driven_by`). No quoted paths means no broker\r\n IPC and no line. An absent hosted session, local seat, viewer-only seat, or no controller binds\r\n nothing silently. No adapter declares anything; no adapter is asked when it reports.\r\n2. **Own-injection exclusion.** Core delivers peer messages by writing into the session's PTY itself. A\r\n USER_INPUT whose payload matches a delivery core physically wrote into that session binds no origin.\r\n Comparison is exact bytes OR both byte sequences trimmed of ASCII whitespace at their ends, never\r\n payload-shape parsing or interior normalization. This is core's origin signal for the one injection\r\n source it owns; resumed-session re-submission and external automation stay uncharacterised and bind\r\n the seat as the submitter rule says.\r\n3. **Dedup is core-side, keyed on the report:** a repeat of the same payload within the same session\r\n while its reference is live re-registers nothing, emits no second helper notice, and extends no TTL.\r\n No adapter-minted id exists.\r\n4. **Serving semantics from #17 / ADR-0058 Am.1, corrected by Am.2:** submitter's machine, 24h TTL,\r\n audience the receiving endpoint, helper notice once per submission and path. A path that names no\r\n file on the submitter's machine is SILENTLY SKIPPED, with no fallback origin. The ordinary silent\r\n cases in (1) are not authorization failures. CLI broker-connect and unanswered-receipt failures are\r\n silent unless `SPT_PUMP_TRACE` enables diagnostics. Named declines apply only to failures with a\r\n remote controller; the broker's 10-second owner-reply timeout remains named. §4.7's historical\r\n all-but-one refusal rule is superseded.\r\n5. **The stated ceiling, instead of an adapter promise.** The report lags acceptance by whatever the\r\n harness's own path costs (claude-spt: 0.5–1.0 s measured, n=3; omp-spt: unmeasured). A cross-operator\r\n Take inside that lag attributes the submission to the NEW holder, whose own file is then served to the\r\n agent that holder now controls. Core states this; it does not ask adapters to shrink it. §1's\r\n prohibition on sampling stands for anything core might build LATER than receipt — receipt is the\r\n earliest moment core has the payload, and it is the moment used.\r\n6. **§4.1 token issuance and §4.5 grace period: STRUCK.** §7's adapter answers stay on record as\r\n measurements of the ceiling in (5), not as obligations.\r\n\r\n**Build:** `REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT` activates doc/impl/unit in\r\nthe product lane. Adapter side: NONE. The integration stage awaits the separately\r\nadmitted two-node field leg.\r\n\r\n### Implemented boundaries\r\n\r\n- Both `api state` USER_INPUT and `api now-signal --user-input` check for quoted paths\r\n before broker IPC; a pathless payload produces no receipt request or line. Path-bearing\r\n reports precede event fanout, shortform processing, or roster gathering. Without a\r\n hosted session or remote controller, the broker silently binds nothing. Otherwise it\r\n snapshots the live remote controller connection before validating the harness session\r\n and checking physical delivery-byte evidence. A later Take never changes that origin.\r\n `api state` carries the caller's resolved session proof. A capability token\r\n can still authorize the state event, but cannot borrow a session ID from disk\r\n to mint input provenance.\r\n- File requests and replies ride that same authenticated rc stream. The owner\r\n derives the audience from its own rc target, never from request-supplied\r\n audience text. The existing MSG_OUT-backed WEB ServeFor guard is unchanged.\r\n- The receipt helper waits at most 500 ms for acknowledgement, including a stalled\r\n connect/hello/write, not for serving. CLI broker-connect and unanswered-receipt failures\r\n stay silent unless the existing `SPT_PUMP_TRACE` diagnostic gate is enabled.\r\n A same-node report deadline prevents a worker that outlives that wait from binding to\r\n a later seat. This is not a bound on the entire hook (its other work has separate costs).\r\n The broker allows 10 seconds for the controller reply, then names the unanswered outcome.\r\n Owner work runs off the rc display/input pump. An unanswered request or uncertain\r\n owner RPC result retains its dedup fence for the possible reference lifetime:\r\n a lost reply is not proof that the owner exposed nothing.\r\n- Dedup is per harness session and exact payload hash in the broker-held PTY\r\n session; it survives brain replacement. Live records are never evicted to make\r\n room: 4096 retained receipts or 64 unretired reply deadlines refuse new grants\r\n by name. Answered requests still count until their deadline worker exits.\r\n The owner reuses a live same-audience input reference without extending it or\r\n changing unrelated exposure. Its timestamp is the earlier of receipt time and\r\n owner time, so clock skew cannot lengthen either side's 24-hour bound.\r\n- Physical delivery writes retain fixed-size streaming evidence for exact bytes and\r\n ASCII-edge-trimmed bytes, not payload shapes or interior-normalized text. Evidence is\r\n published in physical-write order, not when delivery is merely queued.\r\n Source-tagged controller/typeahead and choreography keys are not delivery text.\r\n In-progress or partially failed physical delivery writes make provenance unavailable\r\n by name when a remote controller is seated rather than guessing; no receipt blocks\r\n on a PTY writer. Session-lifetime evidence is never silently evicted (65536 distinct\r\n delivery candidates is the named capacity limit; exact and trimmed evidence share\r\n one candidate quota). A later human payload matching either comparison\r\n is indistinguishable from these known bytes and is excluded too; external automation\r\n and native harness re-submission remain subject to the receipt-seat ceiling above.\r\n- Missing files produce neither helper notices nor declined diagnostics. No quoted paths,\r\n absent hosted sessions, and local/viewer-only/no-controller seats are also silent.\r\n With a remote controller seated, wrong session, unknown delivery evidence, queue\r\n pressure, owner refusal, the broker's owner-reply timeout, and persistence failure\r\n each name their condition. CLI transport diagnostics remain gated by `SPT_PUMP_TRACE`.\r\n\r\n### Pending field acceptance — not executed in the doc/impl/unit lane\r\n\r\nThe separately admitted two-node field leg must exercise a remote controller's quoted\r\npath being served only to the receiving agent, and local input not being served.\r\nIts hazard arm must keep a **remote controller seated while core physically delivers\r\na path-bearing peer message into the receiving session**: the ensuing USER_INPUT\r\nreport must cause **no serve**. A viewer-only or empty-seat run cannot prove that arm.\r\nThe same field leg must measure the added hook cost; the 500 ms receipt wait bound\r\nis not an observed hook-cost measurement. These obligations remain pending and do\r\nnot activate `int` or impose adapter integration work. The historical measurements\r\nin §7 are not execution evidence for this implementation.\r","startLine":1,"lineNumbers":[1,null,288,null,382,null,384,null,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503]},"fileSize":38531,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs\\INPUT-PROVENANCE-CONTRACT.md"}}},"isError":false,"timestamp":1790029735713}}
{"type":"message","id":"32588d0e","parentId":"8cada8e4","timestamp":"2026-09-21T22:28:55.725Z","message":{"role":"toolResult","toolCallId":"call_C2u3CBPxjPH6QqvUD6Pm9vUm|fc_0c7d22595484f800016ab1afa7a06487d295cdf483f0fbc57d","toolName":"read","content":[{"type":"text","text":"/// FILE_ACCESS_HELPER — the exact command for a file this endpoint was handed.\n///\n/// TWO TRIGGERS, ONE OUTPUT SHAPE (ADR-0058 Amendment 1):\n///\n/// (a) a delivered message CARRIES ATTACHMENTS — one `spt fetch ` line per\n/// attachment, taken VERBATIM from the envelope rather than rebuilt, so the\n/// line the agent runs is the link the sender actually minted;\n/// (b) a user's message QUOTES A FILEPATH that exists — the path is registered\n/// for this endpoint alone and the same fetch line is handed over.\n///\n/// USER_INPUT is bound at receipt, not here. This gatherer never looks for the\n/// submitter's files on the receiving node or samples a later controller.\n///\n/// Delta discipline is per (message, path): a re-poll in the same session emits\n/// nothing, which is what keeps a standing signal from becoming a nag.\n// [impl->REQ-NOW-SIGNAL-FILE-ACCESS-HELPER]\npub fn gather_file_access_helper(input: &PollInput, seen: &mut SeenSet) -> Vec {\n let mut out = Vec::new();\n let perch_path = perch::resolve_perch_path(input.id, perch::ParentHint::Infer);\n // (a) THE ATTACHMENT TRIGGER. The io-log's TAIL is the read, not the whole\n // log: this runs on every poll, and a full walk per turn would make a\n // per-turn hook grow with the session's history.\n let head = spt_store::iolog::last_seq_at(&perch_path);\n let read = spt_store::iolog::read_after_at(\n &perch_path,\n head.saturating_sub(ATTACHMENT_SCAN_ROWS),\n None,\n );\n for row in read.rows {\n if row.kind != spt_proto::ioevent::IO_KIND_MSG_IN {\n continue;\n }\n let Some(id) = row.msg_id.as_deref() else {\n continue;\n };\n for attachment in spt_store::msgid::attachments_of(&row.payload) {\n // Keyed on (message, attachment url) — the (message, path) pair this\n // category's delta is defined over, in the form the envelope has.\n if !seen.take_new(&format!(\"{id}={}\", attachment.url)) {\n continue;\n }\n out.push(format!(\"spt fetch {}\", attachment.url));\n }\n }\n // (b) THE QUOTED-PATH TRIGGER, REMOTE arm: a peer's daemon registered the\n // file its user quoted, on this endpoint's behalf, and wrote down the URL it\n // was handed. Read from a RECEIVER-SIDE record rather than out of the\n // message, because `attachments` is the sender's attribute class and a\n // receiving node writing one would be a forgery (spt_store::helperline says\n // so at length).\n for line in spt_store::helperline::read_at(&perch_path) {\n if !seen.take_new(&format!(\"{}={}\", line.msg_id, line.path)) {\n continue;\n }\n out.push(format!(\"spt fetch {}\", line.url));\n }\n out\n}\n\n/// How far back the attachment trigger looks in the io-log.\n///\n/// A bound rather than the whole log: the delta set makes a repeat silent\n/// anyway, so the only thing a deeper scan buys is finding an attachment whose\n/// arrival the session already polled past — and paying for that on every turn.\nconst ATTACHMENT_SCAN_ROWS: u64 = 32;\n\n\n/// EDGE_TRANSITIONS — endpoint/node on-offline edges and subnet joins.\n///\n/// **This category SEEDS on a session's first poll and reports nothing**, and it\n/// is the one place the delta discipline reads differently. An edge is BY\n/// DEFINITION a change; a session that has observed nothing yet holds no change,\n…\npub fn resolve_spec(ctx: &Ctx, spec_manifest: bool, spec_file: Option<&Path>) -> NowSpec {\n…\n if spec_manifest {\n if let Some(table) = ctx\n .manifest\n .as_ref()\n .and_then(|m| m.io.as_ref())\n .and_then(|io| io.now_signal.as_ref())\n {\n return NowSpec::from_parts(&table.only, &table.without, table.max_lines);\n }\n }\n NowSpec::default()\n}\n\n/// Submit the hook's exact payload to the live broker before any slow gathering.\n/// No daemon start, no owner round trip, and no input-processing failure on a miss.\n// [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\npub(super) fn report_user_input(id: &str, session: &str, payload: &str) {\n use spt_daemon::brain::{Brain, PumpTrace};\n report_user_input_with(id, session, payload, |report| {\n Brain::cold_start_pump(\n &spt_daemon::endpoint::broker_socket_name(),\n now_ms(),\n spt_daemon::msg::USER_INPUT_REPORT_BOUND,\n PumpTrace::Silent,\n ).and_then(|mut brain| brain.report_user_input(report))\n });\n}\n\n// The effect boundary keeps the common path entirely outside IPC and threads.\n// [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\nfn report_user_input_with(\n id: &str,\n session: &str,\n payload: &str,\n send_report: impl FnOnce(spt_daemon::msg::UserInputReport)\n -> std::io::Result + Send + 'static,\n) {\n if spt_store::helperline::quoted_path_candidates(payload, 1).is_empty() {\n return;\n }\n use spt_daemon::msg::{UserInputReport, USER_INPUT_REPORT_BOUND};\n let report = UserInputReport {\n endpoint: id.to_owned(),\n session: session.to_owned(),\n payload: payload.to_owned(),\n expires_at_ms: now_ms().saturating_add(USER_INPUT_REPORT_BOUND.as_millis() as u64),\n };\n let (tx, rx) = std::sync::mpsc::sync_channel(1);\n // This CLI's one receipt worker also bounds connect, hello, and writes:\n // pump read deadlines alone do not bound a stalled initial handshake.\n let worker = std::thread::Builder::new().name(\"input-receipt\".into()).spawn(move || {\n let result = send_report(report);\n let _ = tx.send(result);\n });\n let result = worker.and_then(|_| {\n rx.recv_timeout(USER_INPUT_REPORT_BOUND)\n .map_err(|e| std::io::Error::new(std::io::ErrorKind::TimedOut, e))?\n });\n let declined = match result {\n Ok(reply) => reply.declined,\n Err(error) if spt_daemon::brain::PumpTrace::from_env() == spt_daemon::brain::PumpTrace::Stderr => {\n Some(format!(\"receipt broker unanswered: {error}\"))\n }\n Err(_) => None,\n };\n if let Some(reason) = declined {\n spt_proto::emit_line_err!(\n…\n );\n }\n}"}],"details":{"displayContent":{"text":"/// FILE_ACCESS_HELPER — the exact command for a file this endpoint was handed.\n///\n/// TWO TRIGGERS, ONE OUTPUT SHAPE (ADR-0058 Amendment 1):\n///\n/// (a) a delivered message CARRIES ATTACHMENTS — one `spt fetch ` line per\n/// attachment, taken VERBATIM from the envelope rather than rebuilt, so the\n/// line the agent runs is the link the sender actually minted;\n/// (b) a user's message QUOTES A FILEPATH that exists — the path is registered\n/// for this endpoint alone and the same fetch line is handed over.\n///\n/// USER_INPUT is bound at receipt, not here. This gatherer never looks for the\n/// submitter's files on the receiving node or samples a later controller.\n///\n/// Delta discipline is per (message, path): a re-poll in the same session emits\n/// nothing, which is what keeps a standing signal from becoming a nag.\n// [impl->REQ-NOW-SIGNAL-FILE-ACCESS-HELPER]\npub fn gather_file_access_helper(input: &PollInput, seen: &mut SeenSet) -> Vec {\n let mut out = Vec::new();\n let perch_path = perch::resolve_perch_path(input.id, perch::ParentHint::Infer);\n // (a) THE ATTACHMENT TRIGGER. The io-log's TAIL is the read, not the whole\n // log: this runs on every poll, and a full walk per turn would make a\n // per-turn hook grow with the session's history.\n let head = spt_store::iolog::last_seq_at(&perch_path);\n let read = spt_store::iolog::read_after_at(\n &perch_path,\n head.saturating_sub(ATTACHMENT_SCAN_ROWS),\n None,\n );\n for row in read.rows {\n if row.kind != spt_proto::ioevent::IO_KIND_MSG_IN {\n continue;\n }\n let Some(id) = row.msg_id.as_deref() else {\n continue;\n };\n for attachment in spt_store::msgid::attachments_of(&row.payload) {\n // Keyed on (message, attachment url) — the (message, path) pair this\n // category's delta is defined over, in the form the envelope has.\n if !seen.take_new(&format!(\"{id}={}\", attachment.url)) {\n continue;\n }\n out.push(format!(\"spt fetch {}\", attachment.url));\n }\n }\n // (b) THE QUOTED-PATH TRIGGER, REMOTE arm: a peer's daemon registered the\n // file its user quoted, on this endpoint's behalf, and wrote down the URL it\n // was handed. Read from a RECEIVER-SIDE record rather than out of the\n // message, because `attachments` is the sender's attribute class and a\n // receiving node writing one would be a forgery (spt_store::helperline says\n // so at length).\n for line in spt_store::helperline::read_at(&perch_path) {\n if !seen.take_new(&format!(\"{}={}\", line.msg_id, line.path)) {\n continue;\n }\n out.push(format!(\"spt fetch {}\", line.url));\n }\n out\n}\n\n/// How far back the attachment trigger looks in the io-log.\n///\n/// A bound rather than the whole log: the delta set makes a repeat silent\n/// anyway, so the only thing a deeper scan buys is finding an attachment whose\n/// arrival the session already polled past — and paying for that on every turn.\nconst ATTACHMENT_SCAN_ROWS: u64 = 32;\n\n\n/// EDGE_TRANSITIONS — endpoint/node on-offline edges and subnet joins.\n///\n/// **This category SEEDS on a session's first poll and reports nothing**, and it\n/// is the one place the delta discipline reads differently. An edge is BY\n/// DEFINITION a change; a session that has observed nothing yet holds no change,\n…\npub fn resolve_spec(ctx: &Ctx, spec_manifest: bool, spec_file: Option<&Path>) -> NowSpec {\n…\n if spec_manifest {\n if let Some(table) = ctx\n .manifest\n .as_ref()\n .and_then(|m| m.io.as_ref())\n .and_then(|io| io.now_signal.as_ref())\n {\n return NowSpec::from_parts(&table.only, &table.without, table.max_lines);\n }\n }\n NowSpec::default()\n}\n\n/// Submit the hook's exact payload to the live broker before any slow gathering.\n/// No daemon start, no owner round trip, and no input-processing failure on a miss.\n// [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\npub(super) fn report_user_input(id: &str, session: &str, payload: &str) {\n use spt_daemon::brain::{Brain, PumpTrace};\n report_user_input_with(id, session, payload, |report| {\n Brain::cold_start_pump(\n &spt_daemon::endpoint::broker_socket_name(),\n now_ms(),\n spt_daemon::msg::USER_INPUT_REPORT_BOUND,\n PumpTrace::Silent,\n ).and_then(|mut brain| brain.report_user_input(report))\n });\n}\n\n// The effect boundary keeps the common path entirely outside IPC and threads.\n// [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\nfn report_user_input_with(\n id: &str,\n session: &str,\n payload: &str,\n send_report: impl FnOnce(spt_daemon::msg::UserInputReport)\n -> std::io::Result + Send + 'static,\n) {\n if spt_store::helperline::quoted_path_candidates(payload, 1).is_empty() {\n return;\n }\n use spt_daemon::msg::{UserInputReport, USER_INPUT_REPORT_BOUND};\n let report = UserInputReport {\n endpoint: id.to_owned(),\n session: session.to_owned(),\n payload: payload.to_owned(),\n expires_at_ms: now_ms().saturating_add(USER_INPUT_REPORT_BOUND.as_millis() as u64),\n };\n let (tx, rx) = std::sync::mpsc::sync_channel(1);\n // This CLI's one receipt worker also bounds connect, hello, and writes:\n // pump read deadlines alone do not bound a stalled initial handshake.\n let worker = std::thread::Builder::new().name(\"input-receipt\".into()).spawn(move || {\n let result = send_report(report);\n let _ = tx.send(result);\n });\n let result = worker.and_then(|_| {\n rx.recv_timeout(USER_INPUT_REPORT_BOUND)\n .map_err(|e| std::io::Error::new(std::io::ErrorKind::TimedOut, e))?\n });\n let declined = match result {\n Ok(reply) => reply.declined,\n Err(error) if spt_daemon::brain::PumpTrace::from_env() == spt_daemon::brain::PumpTrace::Stderr => {\n Some(format!(\"receipt broker unanswered: {error}\"))\n }\n Err(_) => None,\n };\n if let Some(reason) = declined {\n spt_proto::emit_line_err!(\n…\n );\n }\n}","startLine":689,"lineNumbers":[689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,null,1062,null,1069,1070,1071,1072,1073,1074,1075,1076,1077,1078,1079,1080,1081,1082,1083,1084,1085,1086,1087,1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098,1099,1100,1101,1102,1103,1104,1105,1106,1107,1108,1109,1110,1111,1112,1113,1114,1115,1116,1117,1118,1119,1120,1121,1122,1123,1124,1125,1126,1127,1128,1129,1130,1131,1132,1133,1134,1135,null,1137,1138,1139]},"fileSize":78878,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\spt\\src\\api\\nowsignal.rs"}}},"isError":false,"timestamp":1790029735724}}
{"type":"message","id":"6e573787","parentId":"32588d0e","timestamp":"2026-09-21T22:28:55.738Z","message":{"role":"toolResult","toolCallId":"call_JXOdbDqxkelt5pLurfHscQks|fc_0c7d22595484f800016ab1afa7a06887d2b0171c8a79243848","toolName":"glob","content":[{"type":"text","text":"# docs-site/src/harness-contract/\n# crates/\n## spt/tests/\nshell_relink_force_e2e.rs\ndummy_harness_e2e.rs\nbind_honest_cross_perch_e2e.rs\nshell_perch_dir_e2e.rs\n## spt-daemon/src/\nharnesshost.rs\n# docs/adr/\n0021-harness-hosted-adapter-agnostic-seed-and-bind-time-resolution.md\n0002-bake-networking-into-core-collapse-spt-node.md"}],"details":{"scopePath":"**/*field*, **/*provenance*, **/*rc*e2e*, **/*harness*, **/*two*node*","fileCount":8,"files":["docs-site/src/harness-contract/","crates/spt/tests/shell_relink_force_e2e.rs","crates/spt/tests/dummy_harness_e2e.rs","crates/spt/tests/bind_honest_cross_perch_e2e.rs","crates/spt-daemon/src/harnesshost.rs","crates/spt/tests/shell_perch_dir_e2e.rs","docs/adr/0021-harness-hosted-adapter-agnostic-seed-and-bind-time-resolution.md","docs/adr/0002-bake-networking-into-core-collapse-spt-node.md"],"truncated":false,"cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core"},"isError":false,"timestamp":1790029735737}}
{"type":"message","id":"63e9d552","parentId":"6e573787","timestamp":"2026-09-21T22:28:55.744Z","message":{"role":"toolResult","toolCallId":"call_wOxOBuRid6sosAED3ehyOWkX|fc_0c7d22595484f800016ab1afa7a05c87d2905c4a0cc1350d34","toolName":"read","content":[{"type":"text","text":"fn emit_link_activity(owner: &str, shell_id: &str, link_token: &str) {\n…\n let since_ms = since.unwrap_or_else(|| {\n…\n // landed): the bind instant is the most truthful thing we hold — the\n // state has been in effect since at least now.\n std::time::SystemTime::now()\n .duration_since(std::time::UNIX_EPOCH)\n .map(|d| d.as_millis() as u64)\n .unwrap_or(0)\n });\n let frame = spt_daemon::shellchan::compose_activity_frame(owner, idle, since_ms);\n let _ = spt_daemon::activity_write(\n &spt_daemon::drive_socket_name(),\n owner,\n shell_id,\n link_token,\n &frame,\n );\n}\n\n/// The `spt api seal` verbs (see [`seal`]): `describe` renders what a token\n/// attests; `verify` answers whether it attests exactly the content on stdin.\n#[derive(Subcommand)]\npub enum SealCmd {\n /// Print the seal record's fields (token, content hash, minter, mint\n /// timestamp, ceremony kind) for a token. Read-only.\n // [impl->REQ-SEAL-DESCRIBE]\n Describe {\n /// The seal token to describe.\n token: String,\n },\n /// Verify content against a seal: the content arrives on **stdin**, its\n /// hash is recomputed over the exact bytes received, and the verdict is\n /// BOUND or NOT-BOUND with the record's fields. Exit 0 only when BOUND.\n /// With no content on stdin this refuses and points at `describe`.\n // [impl->REQ-SEAL-VERIFY-CONTENT-BOUND]\n Verify {\n /// The seal token to verify against.\n token: String,\n },\n}\n\n/// Parse + dispatch the `api` group. Returns the process exit code.\npub fn run(args: ApiArgs, json: bool) -> i32 {\n // Any api invocation brings the daemon up if absent — the reliable anchor\n // every harness hook shares (REQ-DAEMON-3).\n ensure_daemon();\n\n // Resolve the manifest up front so a bad path/content fails fast and\n // uniformly, before any state mutation.\n let (manifest, install_dir) =\n match resolve_ctx_manifest(args.manifest.as_deref(), args.adapter.as_deref()) {\n Ok(pair) => pair,\n Err(code) => return code,\n };\n let ctx = Ctx {\n adapter: args.adapter,\n manifest,\n install_dir,\n };\n\n match args.cmd {\n ApiCmd::Capability => reporting::cmd_capability(&ctx),\n // The alias routes through the SAME gatherer the category uses, rather\n // than keeping its own copy of the selection: one answer to \"has this\n // session seen this hint\", not two that agree until one is edited.\n // [impl->REQ-NOW-SIGNAL-VERB]\n ApiCmd::Hint { session } => reporting::cmd_hint(&ctx, &session),\n // [impl->REQ-IO-EVENT-POLL-VERB]\n ApiCmd::IoEvents {\n id,\n after,\n limit,\n auth,\n } => {\n // The cursor key IS the auth session id — one identity, one flag.\n let session = auth.session_id.clone();\n gated(&id, &auth, |id| {\n ioevents::cmd_io_events(id, session.as_deref(), after, limit, json)\n })\n }\n // [impl->REQ-NOW-SIGNAL-VERB]\n ApiCmd::NowSignal {\n id,\n session,\n user_input,\n agent_output,\n spec_manifest,\n spec_file,\n } => {\n if !user_input.is_empty() {\n nowsignal::report_user_input(&id, &session, &user_input);\n }\n let spec = nowsignal::resolve_spec(&ctx, spec_manifest, spec_file.as_deref());\n nowsignal::cmd_now_signal(&ctx, &id, &session, &user_input, &agent_output, &spec)\n }\n // Harness-hosted startup (T4). Seed establishes; listen consumes+binds;\n // bind is the post-spawn establishing call (intrinsic auth).\n ApiCmd::Seed { pid, session_id } => startup::cmd_seed(pid, session_id),\n ApiCmd::Listen {\n id,\n parent_pid,\n once,\n subnet,\n session_id,\n } => startup::cmd_listen(\n &id,\n parent_pid,\n once,\n…\n ),\n ApiCmd::BindShell { link_token } => {\n…\n match spt_daemon::shellhost::bind_shell_by_token(\n…\n ) {\n Some((owner, shell_id)) => {\n…\n 0\n }\n None => {\n spt_proto::emit_line_err!(\"BIND_SHELL_REFUSED: no instance holds this link token\");\n EXIT_REFUSED\n }\n }\n }\n ApiCmd::Bind {\n id,\n bind_session,\n subnet,\n endpoint_type,\n auth,\n } => {\n // The bind path's adapter source is the api group's own\n // --adapter (no seed on this path) — the adapter-at-creation rule.\n let adapter = ctx.adapter.as_deref().filter(|a| !a.is_empty());\n startup::cmd_bind(\n &id,\n bind_session,\n auth.session_id,\n adapter,\n subnet.as_deref(),\n &endpoint_type,\n )\n }\n // Delivery + activity (T5), gated by auth.\n ApiCmd::State {\n state,\n id,\n no_gate,\n payload_stdin,\n payload_file,\n mid,\n auth,\n } => {\n // Resolve the payload BEFORE the auth gate so an ambiguous\n // invocation is named as ambiguous rather than as unauthorized —\n // a caller who passed both sources has a usage bug, and telling\n // them \"denied\" would send them hunting the wrong thing.\n let payload = match delivery::resolve_state_payload(payload_stdin, payload_file.as_deref())\n {\n Ok(p) => p,\n Err(code) => return code,\n };\n // [impl->REQ-IO-MIDTURN-SPAN] refused BEFORE the auth gate for the\n // same reason the payload sources are: a caller who wrote a\n // contradiction has a usage bug, and answering `denied` would send\n // them hunting the wrong thing.\n if let Err(code) = delivery::validate_mid(&state, mid, payload.is_some()) {\n return code;\n }\n // [impl->REQ-IO-SHORTFORM-GATE] the gate is read from the RESOLVED\n // manifest of the adapter making the call, and a call with no\n // manifest at all is ungated-off: absent declaration, absent\n // permission. `Manifest::shortform_enabled` holds both rulings.\n let shortform = ctx\n .manifest\n .as_ref()\n .is_some_and(|m| m.shortform_enabled());\n gated(&id, &auth, |id| {\n // [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\n if delivery::state_io_kind(&state, payload.is_some(), mid)\n == Some(spt_proto::ioevent::IO_KIND_USER_INPUT)\n {\n // Carry the caller's proof, never borrow a session from disk\n // merely because a capability token authorized the mutation.\n let proof = auth.proof();\n nowsignal::report_user_input(\n id, proof.session_id.as_deref().unwrap_or_default(), payload.as_deref().unwrap_or_default(),\n );\n }\n delivery::cmd_state(id, &state, no_gate, payload.as_deref(), shortform, mid)\n })\n }\n ApiCmd::EchoGate { action, id, auth } => {\n gated(&id, &auth, |id| delivery::cmd_echo_gate(id, &action))\n }\n ApiCmd::Poll {\n id,\n include_deferred,\n link,\n auth,\n } => match link {\n // Shell relay drain: the link token IS the auth (no perch record\n // to authenticate against — shells carry ShellInfo, not InfoJson).\n // [impl->REQ-SHELL-1]\n Some(token) => delivery::cmd_poll_shell(&id, &token),\n None => gated(&id, &auth, |id| {\n delivery::cmd_poll(id, include_deferred, ctx.manifest.as_ref())\n }),\n },\n…\n }\n}"}],"details":{"displayContent":{"text":"fn emit_link_activity(owner: &str, shell_id: &str, link_token: &str) {\n…\n let since_ms = since.unwrap_or_else(|| {\n…\n // landed): the bind instant is the most truthful thing we hold — the\n // state has been in effect since at least now.\n std::time::SystemTime::now()\n .duration_since(std::time::UNIX_EPOCH)\n .map(|d| d.as_millis() as u64)\n .unwrap_or(0)\n });\n let frame = spt_daemon::shellchan::compose_activity_frame(owner, idle, since_ms);\n let _ = spt_daemon::activity_write(\n &spt_daemon::drive_socket_name(),\n owner,\n shell_id,\n link_token,\n &frame,\n );\n}\n\n/// The `spt api seal` verbs (see [`seal`]): `describe` renders what a token\n/// attests; `verify` answers whether it attests exactly the content on stdin.\n#[derive(Subcommand)]\npub enum SealCmd {\n /// Print the seal record's fields (token, content hash, minter, mint\n /// timestamp, ceremony kind) for a token. Read-only.\n // [impl->REQ-SEAL-DESCRIBE]\n Describe {\n /// The seal token to describe.\n token: String,\n },\n /// Verify content against a seal: the content arrives on **stdin**, its\n /// hash is recomputed over the exact bytes received, and the verdict is\n /// BOUND or NOT-BOUND with the record's fields. Exit 0 only when BOUND.\n /// With no content on stdin this refuses and points at `describe`.\n // [impl->REQ-SEAL-VERIFY-CONTENT-BOUND]\n Verify {\n /// The seal token to verify against.\n token: String,\n },\n}\n\n/// Parse + dispatch the `api` group. Returns the process exit code.\npub fn run(args: ApiArgs, json: bool) -> i32 {\n // Any api invocation brings the daemon up if absent — the reliable anchor\n // every harness hook shares (REQ-DAEMON-3).\n ensure_daemon();\n\n // Resolve the manifest up front so a bad path/content fails fast and\n // uniformly, before any state mutation.\n let (manifest, install_dir) =\n match resolve_ctx_manifest(args.manifest.as_deref(), args.adapter.as_deref()) {\n Ok(pair) => pair,\n Err(code) => return code,\n };\n let ctx = Ctx {\n adapter: args.adapter,\n manifest,\n install_dir,\n };\n\n match args.cmd {\n ApiCmd::Capability => reporting::cmd_capability(&ctx),\n // The alias routes through the SAME gatherer the category uses, rather\n // than keeping its own copy of the selection: one answer to \"has this\n // session seen this hint\", not two that agree until one is edited.\n // [impl->REQ-NOW-SIGNAL-VERB]\n ApiCmd::Hint { session } => reporting::cmd_hint(&ctx, &session),\n // [impl->REQ-IO-EVENT-POLL-VERB]\n ApiCmd::IoEvents {\n id,\n after,\n limit,\n auth,\n } => {\n // The cursor key IS the auth session id — one identity, one flag.\n let session = auth.session_id.clone();\n gated(&id, &auth, |id| {\n ioevents::cmd_io_events(id, session.as_deref(), after, limit, json)\n })\n }\n // [impl->REQ-NOW-SIGNAL-VERB]\n ApiCmd::NowSignal {\n id,\n session,\n user_input,\n agent_output,\n spec_manifest,\n spec_file,\n } => {\n if !user_input.is_empty() {\n nowsignal::report_user_input(&id, &session, &user_input);\n }\n let spec = nowsignal::resolve_spec(&ctx, spec_manifest, spec_file.as_deref());\n nowsignal::cmd_now_signal(&ctx, &id, &session, &user_input, &agent_output, &spec)\n }\n // Harness-hosted startup (T4). Seed establishes; listen consumes+binds;\n // bind is the post-spawn establishing call (intrinsic auth).\n ApiCmd::Seed { pid, session_id } => startup::cmd_seed(pid, session_id),\n ApiCmd::Listen {\n id,\n parent_pid,\n once,\n subnet,\n session_id,\n } => startup::cmd_listen(\n &id,\n parent_pid,\n once,\n…\n ),\n ApiCmd::BindShell { link_token } => {\n…\n match spt_daemon::shellhost::bind_shell_by_token(\n…\n ) {\n Some((owner, shell_id)) => {\n…\n 0\n }\n None => {\n spt_proto::emit_line_err!(\"BIND_SHELL_REFUSED: no instance holds this link token\");\n EXIT_REFUSED\n }\n }\n }\n ApiCmd::Bind {\n id,\n bind_session,\n subnet,\n endpoint_type,\n auth,\n } => {\n // The bind path's adapter source is the api group's own\n // --adapter (no seed on this path) — the adapter-at-creation rule.\n let adapter = ctx.adapter.as_deref().filter(|a| !a.is_empty());\n startup::cmd_bind(\n &id,\n bind_session,\n auth.session_id,\n adapter,\n subnet.as_deref(),\n &endpoint_type,\n )\n }\n // Delivery + activity (T5), gated by auth.\n ApiCmd::State {\n state,\n id,\n no_gate,\n payload_stdin,\n payload_file,\n mid,\n auth,\n } => {\n // Resolve the payload BEFORE the auth gate so an ambiguous\n // invocation is named as ambiguous rather than as unauthorized —\n // a caller who passed both sources has a usage bug, and telling\n // them \"denied\" would send them hunting the wrong thing.\n let payload = match delivery::resolve_state_payload(payload_stdin, payload_file.as_deref())\n {\n Ok(p) => p,\n Err(code) => return code,\n };\n // [impl->REQ-IO-MIDTURN-SPAN] refused BEFORE the auth gate for the\n // same reason the payload sources are: a caller who wrote a\n // contradiction has a usage bug, and answering `denied` would send\n // them hunting the wrong thing.\n if let Err(code) = delivery::validate_mid(&state, mid, payload.is_some()) {\n return code;\n }\n // [impl->REQ-IO-SHORTFORM-GATE] the gate is read from the RESOLVED\n // manifest of the adapter making the call, and a call with no\n // manifest at all is ungated-off: absent declaration, absent\n // permission. `Manifest::shortform_enabled` holds both rulings.\n let shortform = ctx\n .manifest\n .as_ref()\n .is_some_and(|m| m.shortform_enabled());\n gated(&id, &auth, |id| {\n // [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\n if delivery::state_io_kind(&state, payload.is_some(), mid)\n == Some(spt_proto::ioevent::IO_KIND_USER_INPUT)\n {\n // Carry the caller's proof, never borrow a session from disk\n // merely because a capability token authorized the mutation.\n let proof = auth.proof();\n nowsignal::report_user_input(\n id, proof.session_id.as_deref().unwrap_or_default(), payload.as_deref().unwrap_or_default(),\n );\n }\n delivery::cmd_state(id, &state, no_gate, payload.as_deref(), shortform, mid)\n })\n }\n ApiCmd::EchoGate { action, id, auth } => {\n gated(&id, &auth, |id| delivery::cmd_echo_gate(id, &action))\n }\n ApiCmd::Poll {\n id,\n include_deferred,\n link,\n auth,\n } => match link {\n // Shell relay drain: the link token IS the auth (no perch record\n // to authenticate against — shells carry ShellInfo, not InfoJson).\n // [impl->REQ-SHELL-1]\n Some(token) => delivery::cmd_poll_shell(&id, &token),\n None => gated(&id, &auth, |id| {\n delivery::cmd_poll(id, include_deferred, ctx.manifest.as_ref())\n }),\n },\n…\n }\n}","startLine":564,"lineNumbers":[564,null,568,null,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,null,680,681,null,686,null,689,690,null,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,null,940,941]},"fileSize":65009,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\spt\\src\\api\\mod.rs"}}},"isError":false,"timestamp":1790029735744}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_hjFsUZWVHZBvalpF5os5px09|fc_0c7d22595484f800016ab1afb1b1ac87d2812ba1d0e2a3ce39","toolName":"read","startedAt":"2026-09-21T22:29:05.796Z","args":{"path":"crates/spt/tests/dummy_harness_e2e.rs:1-240"},"intent":"Reading hosted integration fixture"},"id":"c5affa20","parentId":"63e9d552","timestamp":"2026-09-21T22:29:05.796Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_W807lonhGChWxAYV1eW05zY7|fc_0c7d22595484f800016ab1afb1b1bc87d296321259721308f3","toolName":"grep","startedAt":"2026-09-21T22:29:05.796Z","args":{"path":"crates/spt-daemon/src"},"intent":"Finding controller input protocol"},"id":"90bb3193","parentId":"c5affa20","timestamp":"2026-09-21T22:29:05.796Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_4BVDZdFMlS8cR9CCfPfKgqaa|fc_0c7d22595484f800016ab1afb1b1c487d2b4eb66a998a3cd8a","toolName":"grep","startedAt":"2026-09-21T22:29:05.796Z","args":{"path":"crates/spt/tests/webserve_attachment_e2e.rs;crates/spt/tests/dummy_harness_e2e.rs;docs-site/src"},"intent":"Finding isolation and node flags"},"id":"e2c1fc96","parentId":"90bb3193","timestamp":"2026-09-21T22:29:05.796Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_VoC90R5GoRl1BFlqjckuC05T|fc_0c7d22595484f800016ab1afb1b1cc87d283f0f03c715bd12c","toolName":"read","startedAt":"2026-09-21T22:29:05.796Z","args":{"path":"crates/spt/src/api/mod.rs:65-285"},"intent":"Reading input API flags"},"id":"4a8ffdd7","parentId":"e2c1fc96","timestamp":"2026-09-21T22:29:05.796Z"}
{"type":"message","id":"bdfd928f","parentId":"4a8ffdd7","timestamp":"2026-09-21T22:29:05.796Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_hjFsUZWVHZBvalpF5os5px09|fc_0c7d22595484f800016ab1afb1b1ac87d2812ba1d0e2a3ce39","name":"read","arguments":{"i":"Reading hosted integration fixture","path":"crates/spt/tests/dummy_harness_e2e.rs:1-240"},"intent":"Reading hosted integration fixture"},{"type":"toolCall","id":"call_W807lonhGChWxAYV1eW05zY7|fc_0c7d22595484f800016ab1afb1b1bc87d296321259721308f3","name":"grep","arguments":{"i":"Finding controller input protocol","pattern":"UserInput|user_input|InputServe|ServeInput|driven_by","path":"crates/spt-daemon/src","case":true,"gitignore":true,"skip":0},"intent":"Finding controller input protocol"},{"type":"toolCall","id":"call_4BVDZdFMlS8cR9CCfPfKgqaa|fc_0c7d22595484f800016ab1afb1b1c487d2b4eb66a998a3cd8a","name":"grep","arguments":{"i":"Finding isolation and node flags","pattern":"SPT_HOME|SPT_BROKER|SPT_.*PORT|trust|spt rc|--headless","path":"crates/spt/tests/webserve_attachment_e2e.rs;crates/spt/tests/dummy_harness_e2e.rs;docs-site/src","case":true,"gitignore":true,"skip":0},"intent":"Finding isolation and node flags"},{"type":"toolCall","id":"call_VoC90R5GoRl1BFlqjckuC05T|fc_0c7d22595484f800016ab1afb1b1cc87d283f0f03c715bd12c","name":"read","arguments":{"i":"Reading input API flags","path":"crates/spt/src/api/mod.rs:65-285"},"intent":"Reading input API flags"},{"type":"toolCall","id":"call_yKpYK0ygrde0occe18ArSpwg|fc_0c7d22595484f800016ab1afb1b1d487d2b1b5d9da3d879ec9","name":"glob","arguments":{"i":"Finding field tool support","path":".spt/preserved/318/*;tools/*;**/*rc*.md;**/*trust*.md","hidden":true,"gitignore":false,"limit":75},"intent":"Finding field tool support"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":8130,"output":292,"cacheRead":22144,"cacheWrite":0,"totalTokens":30566,"cost":{"input":0.08130000000000001,"output":0.0146,"cacheRead":0.022144,"cacheWrite":0,"total":0.11804400000000001}},"stopReason":"toolUse","timestamp":1790029735796,"responseId":"resp_0c7d22595484f800016ab1afa7fccc87d28736ba5cfed952d8","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0c7d22595484f800016ab1afb1b1ac87d2812ba1d0e2a3ce39","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading hosted integration fixture\",\"path\":\"crates/spt/tests/dummy_harness_e2e.rs:1-240\"}","call_id":"call_hjFsUZWVHZBvalpF5os5px09","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"read","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1afb1b1bc87d296321259721308f3","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding controller input protocol\",\"pattern\":\"UserInput|user_input|InputServe|ServeInput|driven_by\",\"path\":\"crates/spt-daemon/src\",\"case\":true,\"gitignore\":true,\"skip\":0}","call_id":"call_W807lonhGChWxAYV1eW05zY7","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"grep","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1afb1b1c487d2b4eb66a998a3cd8a","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding isolation and node flags\",\"pattern\":\"SPT_HOME|SPT_BROKER|SPT_.*PORT|trust|spt rc|--headless\",\"path\":\"crates/spt/tests/webserve_attachment_e2e.rs;crates/spt/tests/dummy_harness_e2e.rs;docs-site/src\",\"case\":true,\"gitignore\":true,\"skip\":0}","call_id":"call_4BVDZdFMlS8cR9CCfPfKgqaa","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"grep","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1afb1b1cc87d283f0f03c715bd12c","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading input API flags\",\"path\":\"crates/spt/src/api/mod.rs:65-285\"}","call_id":"call_VoC90R5GoRl1BFlqjckuC05T","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"read","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1afb1b1d487d2b1b5d9da3d879ec9","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding field tool support\",\"path\":\".spt/preserved/318/*;tools/*;**/*rc*.md;**/*trust*.md\",\"hidden\":true,\"gitignore\":false,\"limit\":75}","call_id":"call_yKpYK0ygrde0occe18ArSpwg","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"glob","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}}]},"duration":9997.984800000006,"ttft":9921.910499999998,"completedAt":1790029745795,"contextSnapshot":{"promptTokens":30274,"nonMessageTokens":10457,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_yKpYK0ygrde0occe18ArSpwg|fc_0c7d22595484f800016ab1afb1b1d487d2b1b5d9da3d879ec9","toolName":"glob","startedAt":"2026-09-21T22:29:05.797Z","args":{"path":".spt/preserved/318/*;tools/*;**/*rc*.md;**/*trust*.md"},"intent":"Finding field tool support"},"id":"cff461fd","parentId":"bdfd928f","timestamp":"2026-09-21T22:29:05.797Z"}
{"type":"message","id":"1d18976e","parentId":"cff461fd","timestamp":"2026-09-21T22:29:05.804Z","message":{"role":"toolResult","toolCallId":"call_hjFsUZWVHZBvalpF5os5px09|fc_0c7d22595484f800016ab1afb1b1ac87d2812ba1d0e2a3ce39","toolName":"read","content":[{"type":"text","text":"//! Wave 1 (v0.12.1) — the DUMMY-HARNESS fixture smoke test. The permanent\n//! real-harness regression fixture the v0.12.0 mock tests never had: it drives the\n//! REAL spt-hosted bringup path end-to-end —\n//! `spt endpoint start` → `launch_harness_brokered_in` → broker PTY → `spt rc` attach\n//! — against a REAL detached `spt daemon run`, NOT an in-proc `reconcile_once` and\n//! NOT a mock that exits immediately.\n//!\n//! The dummy harness (`mock-session --mode dummy`) binds its perch on startup (the\n//! harness contract), prints a stdout heartbeat on an interval, and stays alive\n//! until killed — so \"broker wedged / endpoint died\" is cleanly separable from \"a\n//! real harness failed to launch.\" Wave 2's lifecycle gates (VIEWER-CLOSE-DETACH,\n//! ATTACH-WEDGE, daemon-stop) build on exactly this bring-up.\n//!\n//! Asserts: `endpoint create` + `endpoint start` bring the dummy up, its perch goes ONLINE, the\n//! PTY child stays alive (heartbeating), and `spt rc ` attaches and receives the\n//! live heartbeat output. Bounded; all spawned pids reaped scoped (never\n//! machine-wide — shared runner).\n\nuse std::io::Read;\nuse std::path::{Path, PathBuf};\nuse std::process::{Child, Command, Stdio};\nuse std::sync::Mutex;\nuse std::time::{Duration, Instant};\n\nmod common;\nuse common::CommandNoWindowExt;\n\nuse spt_store::perch::{self, ParentHint};\n\n// Both tests in this file set the PROCESS-GLOBAL env var SPT_HOME then do in-proc\n// reads of it (perch::spt_home / adapters_dir, registry::register, psychebin\n// fs::copy staging). One file = one test binary → the two tests otherwise run on\n// parallel threads and their set_var/reads race (register lands in the wrong home\n// → ENDPOINT_RUN_ADAPTER_UNREGISTERED; psychebin staging → os-32 sharing\n// collision). Serialize the whole body of each on one file-local lock — the exact\n// isolated-home pattern of contract_e2e.rs:26 / gateway_e2e.rs:35. Child procs\n// already inherit the right home via explicit `.env(\"SPT_HOME\", …)`; only the\n// in-proc reads leak, so serializing the two bodies is sufficient.\nstatic E2E_LOCK: Mutex<()> = Mutex::new(());\n\nfn kill_pid(pid: u32) {\n #[cfg(windows)]\n let _ = Command::new(\"taskkill\")\n .no_window()\n .args([\"/PID\", &pid.to_string(), \"/F\", \"/T\"])\n .output();\n #[cfg(unix)]\n let _ = Command::new(\"kill\").args([\"-9\", &pid.to_string()]).output();\n}\n\n\n\nfn ready_pid(path: &Path) -> Option {\n let s = std::fs::read_to_string(path).ok()?;\n serde_json::from_str::(&s)\n .ok()?\n .get(\"pid\")?\n .as_u64()\n .map(|p| p as u32)\n}\n\nfn wait_for_ready_pid(path: &Path, budget: Duration) -> Option {\n let deadline = Instant::now() + budget;\n while Instant::now() < deadline {\n if let Some(p) = ready_pid(path) {\n return Some(p);\n }\n std::thread::sleep(Duration::from_millis(50));\n }\n None\n}\n\n\n\n#[test]\nfn endpoint_run_brings_up_a_long_lived_dummy_harness_and_rc_attaches() {\n // Serialize against the sister test — shared process-global SPT_HOME.\n let _serial = E2E_LOCK.lock().unwrap_or_else(|e| e.into_inner());\n // ── (1) Isolated SPT_HOME. NET-ENABLED (the daemon self-initializes a real node\n // identity): `spt rc` attaches over a broker-minted LOOPBACK conn that surfaces\n // as net-stream events, so it requires a net-bound broker — a net-less broker\n // refuses the loopback dial (\"net disabled\"). Unlike the livehost/reconcile\n // tests (which only inspect perch state), the rc-attach path needs net up. ──\n let home = tempfile::tempdir().unwrap();\n std::env::set_var(\"SPT_HOME\", home.path());\n\n let spt_bin = PathBuf::from(env!(\"CARGO_BIN_EXE_spt\"));\n let exe_suffix = spt_bin\n .extension()\n .map(|e| format!(\".{}\", e.to_string_lossy()))\n .unwrap_or_default();\n let mock_session = common::sibling_bin(\"mock-session\");\n assert!(\n mock_session.exists(),\n \"the dummy-harness program must be built: {} \\\n (pre-build: cargo build -p mock-adapter --bin mock-session)\",\n mock_session.display()\n );\n\n // ── (2) Register the DUMMY-HARNESS adapter: a kind=harness adapter whose\n // [session.self] runs the long-lived dummy. The broker fills {id}/{session_id};\n // the program token is the absolute mock-session path. The dummy shells the\n // same `spt` to bind (via --spt). ──\n let spt_for_cmd = spt_bin.to_string_lossy().replace('\\\\', \"/\");\n let mock_for_cmd = mock_session.to_string_lossy().replace('\\\\', \"/\");\n let self_cmd = format!(\n \"{mock_for_cmd} --mode dummy --id {{id}} --session-id {{session_id}} \\\n --spt {spt_for_cmd} --mock-adapter dummyharness --type live_agent --heartbeat-ms 200\"\n );\n // A faithful live_agent fixture DECLARES `[session.psyche_init]`: cmd_bind only\n // marks status=online for `live_agent && psyche_init.is_some()` (startup.rs:464 —\n // the online signal is gated to the host predicate), so the declaration is what\n // this test needs for the online path. A psyche binary fixture (a copy of `spt`)\n // is staged too; under F-030 the Psyche is a bounded PER-EVENT TURN, not a\n // resident process the reconcile hosts — no resident `{id}-psyche` is expected,\n // so the psyche-perch reap at teardown (step 6) is belt-and-suspenders.\n let src = perch::spt_home().join(\"srcs\").join(\"dummyharness\");\n std::fs::create_dir_all(&src).unwrap();\n let psyche_bin = src.join(format!(\"psychebin{exe_suffix}\"));\n std::fs::copy(&spt_bin, &psyche_bin).expect(\"stage the psyche binary fixture\");\n let drops = home.path().join(\"drops\");\n std::fs::create_dir_all(&drops).unwrap();\n let dir = drops.to_string_lossy().replace('\\\\', \"/\");\n let manifest_toml = format!(\n \"[adapter]\\nname=\\\"dummyharness\\\"\\nkind=\\\"harness\\\"\\nversion=\\\"1\\\"\\n\\\n min_spt_core_version=\\\"0\\\"\\n\\n[session.self]\\ncommand='{self_cmd}'\\n\\n\\\n [session]\\ncommune_dir=\\\"{dir}\\\"\\nsignoff_dir=\\\"{dir}\\\"\\n\\n\\\n [session.psyche_init]\\ncommand='psychebin ready {{id}}'\\ncwd=\\\"{{psyche_dir}}\\\"\\nkeys=[]\\n\"\n );\n std::fs::write(src.join(\"manifest.toml\"), &manifest_toml).unwrap();\n spt_runtime::registry::register(&perch::adapters_dir(), &src, 1000).unwrap();\n\n // ── (3) The REAL daemon broker process. ──\n let brain_log = home.path().join(\"brain.stderr.log\");\n let brain_log_file = std::fs::File::create(&brain_log).expect(\"create brain stderr log\");\n let mut broker: Child = Command::new(&spt_bin)\n .no_window()\n .args([\"daemon\", \"run\"])\n .env(\"SPT_HOME\", home.path())\n // Rig daemon: the advisory well-known ports belong to this box's resident\n // fleet, never to a test tree (REQ-TEST-DAEMON-EPHEMERAL-ADVISORY-PORTS).\n .env(\n spt_daemon::docshost::TEST_EPHEMERAL_ADVISORY_PORTS_ENV,\n \"1\",\n )\n .stdout(Stdio::null())\n .stderr(Stdio::from(brain_log_file))\n .spawn()\n .expect(\"spawn spt daemon run (broker process)\");\n let brain_pid = match wait_for_ready_pid(&home.path().join(\"brain.ready\"), Duration::from_secs(30))\n {\n Some(p) => p,\n None => {\n let _ = broker.kill();\n let _ = broker.wait();\n panic!(\n \"PRECONDITION: brain never came up.\\n{}\",\n common::daemon_stderr_panel(&brain_log)\n );\n }\n };\n\n // ── (4) The REAL spt-hosted bringup: endpoint create + start (broker spawns the\n // dummy into a PTY; the dummy binds its perch + heartbeats). ──\n let id = \"dummy7\";\n // U3: the mint and the first session are separate verbs.\n common::create_endpoint(&spt_bin, home.path(), id, \"dummyharness\");\n let run = {\n let mut cmd = Command::new(&spt_bin);\n cmd.no_window()\n .args([\"endpoint\", \"start\", id])\n .env(\"SPT_HOME\", home.path());\n common::output_bounded(cmd, Duration::from_secs(45))\n };\n\n let self_perch = perch::resolve_perch_path(id, ParentHint::Infer);\n let status = || spt_store::info::read_info(&self_perch).and_then(|i| i.status);\n\n // The dummy binds its perch live within a few seconds of the broker PTY spawn.\n let mut online = false;\n let deadline = Instant::now() + Duration::from_secs(20);\n while Instant::now() < deadline {\n if status().as_deref() == Some(spt_store::liveness::STATUS_ONLINE) {\n online = true;\n break;\n }\n std::thread::sleep(Duration::from_millis(150));\n }\n\n // The broker-spawned harness pid (from the terse `ENDPOINT_RUN:… pid=NNN`\n // machine token) — the long-lived PTY child itself, NOT the transient `spt api\n // bind` subprocess that stamps info.json's pid. It must stay alive (heartbeating).\n let run_stderr = String::from_utf8_lossy(&run.stderr).to_string();\n let harness_pid: Option = run_stderr\n .split(\"pid=\")\n .nth(1)\n .and_then(|s| s.split_whitespace().next())\n .and_then(|s| s.trim().parse().ok());\n let alive_after = {\n std::thread::sleep(Duration::from_millis(700));\n harness_pid.map(spt_store::proc::is_process_alive).unwrap_or(false)\n };\n\n // ── (5) rc ATTACH: stream the live PTY output; assert the heartbeat arrives. ──\n let rc_err = home.path().join(\"rc.stderr.log\");\n let rc_err_file = std::fs::File::create(&rc_err).expect(\"create rc stderr log\");\n let mut rc: Child = Command::new(&spt_bin)\n .no_window()\n .args([\"rc\", id])\n .env(\"SPT_HOME\", home.path())\n // This rig's attach-CONNECTS proof reads PUMP_IPC_READER off rc's\n // stderr, which is now SILENT by default — a client must not write\n // diagnostics into a terminal it owns (REQ-RC-DISPLAY-SOLE-WRITER).\n // A RIG may opt in: here stderr is a captured FILE, not a display.\n .env(\"SPT_PUMP_TRACE\", \"1\")\n .stdout(Stdio::piped())\n .stderr(Stdio::from(rc_err_file))\n .stdin(Stdio::piped()) // keep stdin OPEN — a closed stdin makes the rc pump EOF-detach before streaming\n .spawn()\n .expect(\"spawn spt rc \");\n let _rc_stdin = rc.stdin.take(); // hold the write end open for the attach window\n let mut rc_out = rc.stdout.take().unwrap();\n let (tx, rx) = std::sync::mpsc::channel::();\n std::thread::spawn(move || {\n let mut buf = [0u8; 4096];\n let mut acc = String::new();\n loop {\n match rc_out.read(&mut buf) {\n Ok(0) => break,\n Ok(n) => {\n acc.push_str(&String::from_utf8_lossy(&buf[..n]));\n if acc.contains(\"DUMMY_HARNESS_TICK\") {\n let _ = tx.send(acc.clone());\n break;\n }\n }\n Err(_) => break,\n }\n }\n let _ = tx.send(acc);\n });\n let rc_captured = rx.recv_timeout(Duration::from_secs(10)).unwrap_or_default();\n let rc_saw_tick = rc_captured.contains(\"DUMMY_HARNESS_TICK\");\n…\n}\n\n[Showing lines 1-243 of 640. Use :244 to continue]"}],"details":{"truncation":{"content":"//! Wave 1 (v0.12.1) — the DUMMY-HARNESS fixture smoke test. The permanent\r\n//! real-harness regression fixture the v0.12.0 mock tests never had: it drives the\r\n//! REAL spt-hosted bringup path end-to-end —\r\n//! `spt endpoint start` → `launch_harness_brokered_in` → broker PTY → `spt rc` attach\r\n//! — against a REAL detached `spt daemon run`, NOT an in-proc `reconcile_once` and\r\n//! NOT a mock that exits immediately.\r\n//!\r\n//! The dummy harness (`mock-session --mode dummy`) binds its perch on startup (the\r\n//! harness contract), prints a stdout heartbeat on an interval, and stays alive\r\n//! until killed — so \"broker wedged / endpoint died\" is cleanly separable from \"a\r\n//! real harness failed to launch.\" Wave 2's lifecycle gates (VIEWER-CLOSE-DETACH,\r\n//! ATTACH-WEDGE, daemon-stop) build on exactly this bring-up.\r\n//!\r\n//! Asserts: `endpoint create` + `endpoint start` bring the dummy up, its perch goes ONLINE, the\r\n//! PTY child stays alive (heartbeating), and `spt rc ` attaches and receives the\r\n//! live heartbeat output. Bounded; all spawned pids reaped scoped (never\r\n//! machine-wide — shared runner).\r\n\r\nuse std::io::Read;\r\nuse std::path::{Path, PathBuf};\r\nuse std::process::{Child, Command, Stdio};\r\nuse std::sync::Mutex;\r\nuse std::time::{Duration, Instant};\r\n\r\nmod common;\r\nuse common::CommandNoWindowExt;\r\n\r\nuse spt_store::perch::{self, ParentHint};\r\n\r\n// Both tests in this file set the PROCESS-GLOBAL env var SPT_HOME then do in-proc\r\n// reads of it (perch::spt_home / adapters_dir, registry::register, psychebin\r\n// fs::copy staging). One file = one test binary → the two tests otherwise run on\r\n// parallel threads and their set_var/reads race (register lands in the wrong home\r\n// → ENDPOINT_RUN_ADAPTER_UNREGISTERED; psychebin staging → os-32 sharing\r\n// collision). Serialize the whole body of each on one file-local lock — the exact\r\n// isolated-home pattern of contract_e2e.rs:26 / gateway_e2e.rs:35. Child procs\r\n// already inherit the right home via explicit `.env(\"SPT_HOME\", …)`; only the\r\n// in-proc reads leak, so serializing the two bodies is sufficient.\r\nstatic E2E_LOCK: Mutex<()> = Mutex::new(());\r\n\r\nfn kill_pid(pid: u32) {\r\n #[cfg(windows)]\r\n let _ = Command::new(\"taskkill\")\r\n .no_window()\r\n .args([\"/PID\", &pid.to_string(), \"/F\", \"/T\"])\r\n .output();\r\n #[cfg(unix)]\r\n let _ = Command::new(\"kill\").args([\"-9\", &pid.to_string()]).output();\r\n}\r\n\r\n\r\n\r\nfn ready_pid(path: &Path) -> Option {\r\n let s = std::fs::read_to_string(path).ok()?;\r\n serde_json::from_str::(&s)\r\n .ok()?\r\n .get(\"pid\")?\r\n .as_u64()\r\n .map(|p| p as u32)\r\n}\r\n\r\nfn wait_for_ready_pid(path: &Path, budget: Duration) -> Option {\r\n let deadline = Instant::now() + budget;\r\n while Instant::now() < deadline {\r\n if let Some(p) = ready_pid(path) {\r\n return Some(p);\r\n }\r\n std::thread::sleep(Duration::from_millis(50));\r\n }\r\n None\r\n}\r\n\r\n\r\n\r\n#[test]\r\nfn endpoint_run_brings_up_a_long_lived_dummy_harness_and_rc_attaches() {\r\n // Serialize against the sister test — shared process-global SPT_HOME.\r\n let _serial = E2E_LOCK.lock().unwrap_or_else(|e| e.into_inner());\r\n // ── (1) Isolated SPT_HOME. NET-ENABLED (the daemon self-initializes a real node\r\n // identity): `spt rc` attaches over a broker-minted LOOPBACK conn that surfaces\r\n // as net-stream events, so it requires a net-bound broker — a net-less broker\r\n // refuses the loopback dial (\"net disabled\"). Unlike the livehost/reconcile\r\n // tests (which only inspect perch state), the rc-attach path needs net up. ──\r\n let home = tempfile::tempdir().unwrap();\r\n std::env::set_var(\"SPT_HOME\", home.path());\r\n\r\n let spt_bin = PathBuf::from(env!(\"CARGO_BIN_EXE_spt\"));\r\n let exe_suffix = spt_bin\r\n .extension()\r\n .map(|e| format!(\".{}\", e.to_string_lossy()))\r\n .unwrap_or_default();\r\n let mock_session = common::sibling_bin(\"mock-session\");\r\n assert!(\r\n mock_session.exists(),\r\n \"the dummy-harness program must be built: {} \\\r\n (pre-build: cargo build -p mock-adapter --bin mock-session)\",\r\n mock_session.display()\r\n );\r\n\r\n // ── (2) Register the DUMMY-HARNESS adapter: a kind=harness adapter whose\r\n // [session.self] runs the long-lived dummy. The broker fills {id}/{session_id};\r\n // the program token is the absolute mock-session path. The dummy shells the\r\n // same `spt` to bind (via --spt). ──\r\n let spt_for_cmd = spt_bin.to_string_lossy().replace('\\\\', \"/\");\r\n let mock_for_cmd = mock_session.to_string_lossy().replace('\\\\', \"/\");\r\n let self_cmd = format!(\r\n \"{mock_for_cmd} --mode dummy --id {{id}} --session-id {{session_id}} \\\r\n --spt {spt_for_cmd} --mock-adapter dummyharness --type live_agent --heartbeat-ms 200\"\r\n );\r\n // A faithful live_agent fixture DECLARES `[session.psyche_init]`: cmd_bind only\r\n // marks status=online for `live_agent && psyche_init.is_some()` (startup.rs:464 —\r\n // the online signal is gated to the host predicate), so the declaration is what\r\n // this test needs for the online path. A psyche binary fixture (a copy of `spt`)\r\n // is staged too; under F-030 the Psyche is a bounded PER-EVENT TURN, not a\r\n // resident process the reconcile hosts — no resident `{id}-psyche` is expected,\r\n // so the psyche-perch reap at teardown (step 6) is belt-and-suspenders.\r\n let src = perch::spt_home().join(\"srcs\").join(\"dummyharness\");\r\n std::fs::create_dir_all(&src).unwrap();\r\n let psyche_bin = src.join(format!(\"psychebin{exe_suffix}\"));\r\n std::fs::copy(&spt_bin, &psyche_bin).expect(\"stage the psyche binary fixture\");\r\n let drops = home.path().join(\"drops\");\r\n std::fs::create_dir_all(&drops).unwrap();\r\n let dir = drops.to_string_lossy().replace('\\\\', \"/\");\r\n let manifest_toml = format!(\r\n \"[adapter]\\nname=\\\"dummyharness\\\"\\nkind=\\\"harness\\\"\\nversion=\\\"1\\\"\\n\\\r\n min_spt_core_version=\\\"0\\\"\\n\\n[session.self]\\ncommand='{self_cmd}'\\n\\n\\\r\n [session]\\ncommune_dir=\\\"{dir}\\\"\\nsignoff_dir=\\\"{dir}\\\"\\n\\n\\\r\n [session.psyche_init]\\ncommand='psychebin ready {{id}}'\\ncwd=\\\"{{psyche_dir}}\\\"\\nkeys=[]\\n\"\r\n );\r\n std::fs::write(src.join(\"manifest.toml\"), &manifest_toml).unwrap();\r\n spt_runtime::registry::register(&perch::adapters_dir(), &src, 1000).unwrap();\r\n\r\n // ── (3) The REAL daemon broker process. ──\r\n let brain_log = home.path().join(\"brain.stderr.log\");\r\n let brain_log_file = std::fs::File::create(&brain_log).expect(\"create brain stderr log\");\r\n let mut broker: Child = Command::new(&spt_bin)\r\n .no_window()\r\n .args([\"daemon\", \"run\"])\r\n .env(\"SPT_HOME\", home.path())\r\n // Rig daemon: the advisory well-known ports belong to this box's resident\r\n // fleet, never to a test tree (REQ-TEST-DAEMON-EPHEMERAL-ADVISORY-PORTS).\r\n .env(\r\n spt_daemon::docshost::TEST_EPHEMERAL_ADVISORY_PORTS_ENV,\r\n \"1\",\r\n )\r\n .stdout(Stdio::null())\r\n .stderr(Stdio::from(brain_log_file))\r\n .spawn()\r\n .expect(\"spawn spt daemon run (broker process)\");\r\n let brain_pid = match wait_for_ready_pid(&home.path().join(\"brain.ready\"), Duration::from_secs(30))\r\n {\r\n Some(p) => p,\r\n None => {\r\n let _ = broker.kill();\r\n let _ = broker.wait();\r\n panic!(\r\n \"PRECONDITION: brain never came up.\\n{}\",\r\n common::daemon_stderr_panel(&brain_log)\r\n );\r\n }\r\n };\r\n\r\n // ── (4) The REAL spt-hosted bringup: endpoint create + start (broker spawns the\r\n // dummy into a PTY; the dummy binds its perch + heartbeats). ──\r\n let id = \"dummy7\";\r\n // U3: the mint and the first session are separate verbs.\r\n common::create_endpoint(&spt_bin, home.path(), id, \"dummyharness\");\r\n let run = {\r\n let mut cmd = Command::new(&spt_bin);\r\n cmd.no_window()\r\n .args([\"endpoint\", \"start\", id])\r\n .env(\"SPT_HOME\", home.path());\r\n common::output_bounded(cmd, Duration::from_secs(45))\r\n };\r\n\r\n let self_perch = perch::resolve_perch_path(id, ParentHint::Infer);\r\n let status = || spt_store::info::read_info(&self_perch).and_then(|i| i.status);\r\n\r\n // The dummy binds its perch live within a few seconds of the broker PTY spawn.\r\n let mut online = false;\r\n let deadline = Instant::now() + Duration::from_secs(20);\r\n while Instant::now() < deadline {\r\n if status().as_deref() == Some(spt_store::liveness::STATUS_ONLINE) {\r\n online = true;\r\n break;\r\n }\r\n std::thread::sleep(Duration::from_millis(150));\r\n }\r\n\r\n // The broker-spawned harness pid (from the terse `ENDPOINT_RUN:… pid=NNN`\r\n // machine token) — the long-lived PTY child itself, NOT the transient `spt api\r\n // bind` subprocess that stamps info.json's pid. It must stay alive (heartbeating).\r\n let run_stderr = String::from_utf8_lossy(&run.stderr).to_string();\r\n let harness_pid: Option = run_stderr\r\n .split(\"pid=\")\r\n .nth(1)\r\n .and_then(|s| s.split_whitespace().next())\r\n .and_then(|s| s.trim().parse().ok());\r\n let alive_after = {\r\n std::thread::sleep(Duration::from_millis(700));\r\n harness_pid.map(spt_store::proc::is_process_alive).unwrap_or(false)\r\n };\r\n\r\n // ── (5) rc ATTACH: stream the live PTY output; assert the heartbeat arrives. ──\r\n let rc_err = home.path().join(\"rc.stderr.log\");\r\n let rc_err_file = std::fs::File::create(&rc_err).expect(\"create rc stderr log\");\r\n let mut rc: Child = Command::new(&spt_bin)\r\n .no_window()\r\n .args([\"rc\", id])\r\n .env(\"SPT_HOME\", home.path())\r\n // This rig's attach-CONNECTS proof reads PUMP_IPC_READER off rc's\r\n // stderr, which is now SILENT by default — a client must not write\r\n // diagnostics into a terminal it owns (REQ-RC-DISPLAY-SOLE-WRITER).\r\n // A RIG may opt in: here stderr is a captured FILE, not a display.\r\n .env(\"SPT_PUMP_TRACE\", \"1\")\r\n .stdout(Stdio::piped())\r\n .stderr(Stdio::from(rc_err_file))\r\n .stdin(Stdio::piped()) // keep stdin OPEN — a closed stdin makes the rc pump EOF-detach before streaming\r\n .spawn()\r\n .expect(\"spawn spt rc \");\r\n let _rc_stdin = rc.stdin.take(); // hold the write end open for the attach window\r\n let mut rc_out = rc.stdout.take().unwrap();\r\n let (tx, rx) = std::sync::mpsc::channel::();\r\n std::thread::spawn(move || {\r\n let mut buf = [0u8; 4096];\r\n let mut acc = String::new();\r\n loop {\r\n match rc_out.read(&mut buf) {\r\n Ok(0) => break,\r\n Ok(n) => {\r\n acc.push_str(&String::from_utf8_lossy(&buf[..n]));\r\n if acc.contains(\"DUMMY_HARNESS_TICK\") {\r\n let _ = tx.send(acc.clone());\r\n break;\r\n }\r\n }\r\n Err(_) => break,\r\n }\r\n }\r\n let _ = tx.send(acc);\r\n });\r\n let rc_captured = rx.recv_timeout(Duration::from_secs(10)).unwrap_or_default();\r\n let rc_saw_tick = rc_captured.contains(\"DUMMY_HARNESS_TICK\");\r","truncated":true,"truncatedBy":"lines","totalLines":640,"totalBytes":11410,"outputLines":243,"outputBytes":11410,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":640,"displayContent":{"text":"//! Wave 1 (v0.12.1) — the DUMMY-HARNESS fixture smoke test. The permanent\r\n//! real-harness regression fixture the v0.12.0 mock tests never had: it drives the\r\n//! REAL spt-hosted bringup path end-to-end —\r\n//! `spt endpoint start` → `launch_harness_brokered_in` → broker PTY → `spt rc` attach\r\n//! — against a REAL detached `spt daemon run`, NOT an in-proc `reconcile_once` and\r\n//! NOT a mock that exits immediately.\r\n//!\r\n//! The dummy harness (`mock-session --mode dummy`) binds its perch on startup (the\r\n//! harness contract), prints a stdout heartbeat on an interval, and stays alive\r\n//! until killed — so \"broker wedged / endpoint died\" is cleanly separable from \"a\r\n//! real harness failed to launch.\" Wave 2's lifecycle gates (VIEWER-CLOSE-DETACH,\r\n//! ATTACH-WEDGE, daemon-stop) build on exactly this bring-up.\r\n//!\r\n//! Asserts: `endpoint create` + `endpoint start` bring the dummy up, its perch goes ONLINE, the\r\n//! PTY child stays alive (heartbeating), and `spt rc ` attaches and receives the\r\n//! live heartbeat output. Bounded; all spawned pids reaped scoped (never\r\n//! machine-wide — shared runner).\r\n\r\nuse std::io::Read;\r\nuse std::path::{Path, PathBuf};\r\nuse std::process::{Child, Command, Stdio};\r\nuse std::sync::Mutex;\r\nuse std::time::{Duration, Instant};\r\n\r\nmod common;\r\nuse common::CommandNoWindowExt;\r\n\r\nuse spt_store::perch::{self, ParentHint};\r\n\r\n// Both tests in this file set the PROCESS-GLOBAL env var SPT_HOME then do in-proc\r\n// reads of it (perch::spt_home / adapters_dir, registry::register, psychebin\r\n// fs::copy staging). One file = one test binary → the two tests otherwise run on\r\n// parallel threads and their set_var/reads race (register lands in the wrong home\r\n// → ENDPOINT_RUN_ADAPTER_UNREGISTERED; psychebin staging → os-32 sharing\r\n// collision). Serialize the whole body of each on one file-local lock — the exact\r\n// isolated-home pattern of contract_e2e.rs:26 / gateway_e2e.rs:35. Child procs\r\n// already inherit the right home via explicit `.env(\"SPT_HOME\", …)`; only the\r\n// in-proc reads leak, so serializing the two bodies is sufficient.\r\nstatic E2E_LOCK: Mutex<()> = Mutex::new(());\r\n\r\nfn kill_pid(pid: u32) {\r\n #[cfg(windows)]\r\n let _ = Command::new(\"taskkill\")\r\n .no_window()\r\n .args([\"/PID\", &pid.to_string(), \"/F\", \"/T\"])\r\n .output();\r\n #[cfg(unix)]\r\n let _ = Command::new(\"kill\").args([\"-9\", &pid.to_string()]).output();\r\n}\r\n\r\n\r\n\r\nfn ready_pid(path: &Path) -> Option {\r\n let s = std::fs::read_to_string(path).ok()?;\r\n serde_json::from_str::(&s)\r\n .ok()?\r\n .get(\"pid\")?\r\n .as_u64()\r\n .map(|p| p as u32)\r\n}\r\n\r\nfn wait_for_ready_pid(path: &Path, budget: Duration) -> Option {\r\n let deadline = Instant::now() + budget;\r\n while Instant::now() < deadline {\r\n if let Some(p) = ready_pid(path) {\r\n return Some(p);\r\n }\r\n std::thread::sleep(Duration::from_millis(50));\r\n }\r\n None\r\n}\r\n\r\n\r\n\r\n#[test]\r\nfn endpoint_run_brings_up_a_long_lived_dummy_harness_and_rc_attaches() {\r\n // Serialize against the sister test — shared process-global SPT_HOME.\r\n let _serial = E2E_LOCK.lock().unwrap_or_else(|e| e.into_inner());\r\n // ── (1) Isolated SPT_HOME. NET-ENABLED (the daemon self-initializes a real node\r\n // identity): `spt rc` attaches over a broker-minted LOOPBACK conn that surfaces\r\n // as net-stream events, so it requires a net-bound broker — a net-less broker\r\n // refuses the loopback dial (\"net disabled\"). Unlike the livehost/reconcile\r\n // tests (which only inspect perch state), the rc-attach path needs net up. ──\r\n let home = tempfile::tempdir().unwrap();\r\n std::env::set_var(\"SPT_HOME\", home.path());\r\n\r\n let spt_bin = PathBuf::from(env!(\"CARGO_BIN_EXE_spt\"));\r\n let exe_suffix = spt_bin\r\n .extension()\r\n .map(|e| format!(\".{}\", e.to_string_lossy()))\r\n .unwrap_or_default();\r\n let mock_session = common::sibling_bin(\"mock-session\");\r\n assert!(\r\n mock_session.exists(),\r\n \"the dummy-harness program must be built: {} \\\r\n (pre-build: cargo build -p mock-adapter --bin mock-session)\",\r\n mock_session.display()\r\n );\r\n\r\n // ── (2) Register the DUMMY-HARNESS adapter: a kind=harness adapter whose\r\n // [session.self] runs the long-lived dummy. The broker fills {id}/{session_id};\r\n // the program token is the absolute mock-session path. The dummy shells the\r\n // same `spt` to bind (via --spt). ──\r\n let spt_for_cmd = spt_bin.to_string_lossy().replace('\\\\', \"/\");\r\n let mock_for_cmd = mock_session.to_string_lossy().replace('\\\\', \"/\");\r\n let self_cmd = format!(\r\n \"{mock_for_cmd} --mode dummy --id {{id}} --session-id {{session_id}} \\\r\n --spt {spt_for_cmd} --mock-adapter dummyharness --type live_agent --heartbeat-ms 200\"\r\n );\r\n // A faithful live_agent fixture DECLARES `[session.psyche_init]`: cmd_bind only\r\n // marks status=online for `live_agent && psyche_init.is_some()` (startup.rs:464 —\r\n // the online signal is gated to the host predicate), so the declaration is what\r\n // this test needs for the online path. A psyche binary fixture (a copy of `spt`)\r\n // is staged too; under F-030 the Psyche is a bounded PER-EVENT TURN, not a\r\n // resident process the reconcile hosts — no resident `{id}-psyche` is expected,\r\n // so the psyche-perch reap at teardown (step 6) is belt-and-suspenders.\r\n let src = perch::spt_home().join(\"srcs\").join(\"dummyharness\");\r\n std::fs::create_dir_all(&src).unwrap();\r\n let psyche_bin = src.join(format!(\"psychebin{exe_suffix}\"));\r\n std::fs::copy(&spt_bin, &psyche_bin).expect(\"stage the psyche binary fixture\");\r\n let drops = home.path().join(\"drops\");\r\n std::fs::create_dir_all(&drops).unwrap();\r\n let dir = drops.to_string_lossy().replace('\\\\', \"/\");\r\n let manifest_toml = format!(\r\n \"[adapter]\\nname=\\\"dummyharness\\\"\\nkind=\\\"harness\\\"\\nversion=\\\"1\\\"\\n\\\r\n min_spt_core_version=\\\"0\\\"\\n\\n[session.self]\\ncommand='{self_cmd}'\\n\\n\\\r\n [session]\\ncommune_dir=\\\"{dir}\\\"\\nsignoff_dir=\\\"{dir}\\\"\\n\\n\\\r\n [session.psyche_init]\\ncommand='psychebin ready {{id}}'\\ncwd=\\\"{{psyche_dir}}\\\"\\nkeys=[]\\n\"\r\n );\r\n std::fs::write(src.join(\"manifest.toml\"), &manifest_toml).unwrap();\r\n spt_runtime::registry::register(&perch::adapters_dir(), &src, 1000).unwrap();\r\n\r\n // ── (3) The REAL daemon broker process. ──\r\n let brain_log = home.path().join(\"brain.stderr.log\");\r\n let brain_log_file = std::fs::File::create(&brain_log).expect(\"create brain stderr log\");\r\n let mut broker: Child = Command::new(&spt_bin)\r\n .no_window()\r\n .args([\"daemon\", \"run\"])\r\n .env(\"SPT_HOME\", home.path())\r\n // Rig daemon: the advisory well-known ports belong to this box's resident\r\n // fleet, never to a test tree (REQ-TEST-DAEMON-EPHEMERAL-ADVISORY-PORTS).\r\n .env(\r\n spt_daemon::docshost::TEST_EPHEMERAL_ADVISORY_PORTS_ENV,\r\n \"1\",\r\n )\r\n .stdout(Stdio::null())\r\n .stderr(Stdio::from(brain_log_file))\r\n .spawn()\r\n .expect(\"spawn spt daemon run (broker process)\");\r\n let brain_pid = match wait_for_ready_pid(&home.path().join(\"brain.ready\"), Duration::from_secs(30))\r\n {\r\n Some(p) => p,\r\n None => {\r\n let _ = broker.kill();\r\n let _ = broker.wait();\r\n panic!(\r\n \"PRECONDITION: brain never came up.\\n{}\",\r\n common::daemon_stderr_panel(&brain_log)\r\n );\r\n }\r\n };\r\n\r\n // ── (4) The REAL spt-hosted bringup: endpoint create + start (broker spawns the\r\n // dummy into a PTY; the dummy binds its perch + heartbeats). ──\r\n let id = \"dummy7\";\r\n // U3: the mint and the first session are separate verbs.\r\n common::create_endpoint(&spt_bin, home.path(), id, \"dummyharness\");\r\n let run = {\r\n let mut cmd = Command::new(&spt_bin);\r\n cmd.no_window()\r\n .args([\"endpoint\", \"start\", id])\r\n .env(\"SPT_HOME\", home.path());\r\n common::output_bounded(cmd, Duration::from_secs(45))\r\n };\r\n\r\n let self_perch = perch::resolve_perch_path(id, ParentHint::Infer);\r\n let status = || spt_store::info::read_info(&self_perch).and_then(|i| i.status);\r\n\r\n // The dummy binds its perch live within a few seconds of the broker PTY spawn.\r\n let mut online = false;\r\n let deadline = Instant::now() + Duration::from_secs(20);\r\n while Instant::now() < deadline {\r\n if status().as_deref() == Some(spt_store::liveness::STATUS_ONLINE) {\r\n online = true;\r\n break;\r\n }\r\n std::thread::sleep(Duration::from_millis(150));\r\n }\r\n\r\n // The broker-spawned harness pid (from the terse `ENDPOINT_RUN:… pid=NNN`\r\n // machine token) — the long-lived PTY child itself, NOT the transient `spt api\r\n // bind` subprocess that stamps info.json's pid. It must stay alive (heartbeating).\r\n let run_stderr = String::from_utf8_lossy(&run.stderr).to_string();\r\n let harness_pid: Option = run_stderr\r\n .split(\"pid=\")\r\n .nth(1)\r\n .and_then(|s| s.split_whitespace().next())\r\n .and_then(|s| s.trim().parse().ok());\r\n let alive_after = {\r\n std::thread::sleep(Duration::from_millis(700));\r\n harness_pid.map(spt_store::proc::is_process_alive).unwrap_or(false)\r\n };\r\n\r\n // ── (5) rc ATTACH: stream the live PTY output; assert the heartbeat arrives. ──\r\n let rc_err = home.path().join(\"rc.stderr.log\");\r\n let rc_err_file = std::fs::File::create(&rc_err).expect(\"create rc stderr log\");\r\n let mut rc: Child = Command::new(&spt_bin)\r\n .no_window()\r\n .args([\"rc\", id])\r\n .env(\"SPT_HOME\", home.path())\r\n // This rig's attach-CONNECTS proof reads PUMP_IPC_READER off rc's\r\n // stderr, which is now SILENT by default — a client must not write\r\n // diagnostics into a terminal it owns (REQ-RC-DISPLAY-SOLE-WRITER).\r\n // A RIG may opt in: here stderr is a captured FILE, not a display.\r\n .env(\"SPT_PUMP_TRACE\", \"1\")\r\n .stdout(Stdio::piped())\r\n .stderr(Stdio::from(rc_err_file))\r\n .stdin(Stdio::piped()) // keep stdin OPEN — a closed stdin makes the rc pump EOF-detach before streaming\r\n .spawn()\r\n .expect(\"spawn spt rc \");\r\n let _rc_stdin = rc.stdin.take(); // hold the write end open for the attach window\r\n let mut rc_out = rc.stdout.take().unwrap();\r\n let (tx, rx) = std::sync::mpsc::channel::();\r\n std::thread::spawn(move || {\r\n let mut buf = [0u8; 4096];\r\n let mut acc = String::new();\r\n loop {\r\n match rc_out.read(&mut buf) {\r\n Ok(0) => break,\r\n Ok(n) => {\r\n acc.push_str(&String::from_utf8_lossy(&buf[..n]));\r\n if acc.contains(\"DUMMY_HARNESS_TICK\") {\r\n let _ = tx.send(acc.clone());\r\n break;\r\n }\r\n }\r\n Err(_) => break,\r\n }\r\n }\r\n let _ = tx.send(acc);\r\n });\r\n let rc_captured = rx.recv_timeout(Duration::from_secs(10)).unwrap_or_default();\r\n let rc_saw_tick = rc_captured.contains(\"DUMMY_HARNESS_TICK\");\r\n…\n}","startLine":1,"lineNumbers":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,null,322]},"fileSize":31522,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\spt\\tests\\dummy_harness_e2e.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":640,"totalBytes":11410,"outputLines":243,"outputBytes":11410,"shownRange":{"start":1,"end":243},"nextOffset":244}}},"isError":false,"timestamp":1790029745803}}
{"type":"message","id":"bac02f88","parentId":"1d18976e","timestamp":"2026-09-21T22:29:05.806Z","message":{"role":"toolResult","toolCallId":"call_VoC90R5GoRl1BFlqjckuC05T|fc_0c7d22595484f800016ab1afb1b1cc87d283f0f03c715bd12c","toolName":"read","content":[{"type":"text","text":" Seed {\n #[arg(long)]\n pid: u32,\n #[arg(long)]\n session_id: String,\n },\n /// Consume a seed and hold the perch + relay loop (blocks).\n Listen {\n id: String,\n /// Override the parent-pid anchor (defaults to the self-discovered PPID).\n #[arg(long)]\n parent_pid: Option,\n /// Drain backlog + one receive cycle, then exit (testability).\n #[arg(long)]\n once: bool,\n /// Anchor subnet for a NEW endpoint (required on a multi-subnet\n /// node — the anchor is assigned at creation, never guessed).\n #[arg(long)]\n subnet: Option,\n /// Bind from this session id when the ephemeral seed is gone (a session\n /// going live late, or after a daemon restart). With no live seed and\n /// no session id, listen refuses (NO_SEED).\n #[arg(long)]\n session_id: Option,\n },\n /// Post-spawn bind of a session to its perch.\n Bind {\n id: String,\n /// The session id discovered post-spawn, written into the perch record.\n #[arg(long = \"set-session-id\")]\n bind_session: Option,\n /// Anchor subnet for a NEW endpoint (see `listen`).\n #[arg(long)]\n subnet: Option,\n /// The endpoint type tag (info.json `state`). Defaults to `live_agent`\n /// (the agent host); a non-agent endpoint — e.g. a `gateway` — binds\n /// with its own open-type tag. A revive keeps the\n /// prior type unless this overrides it.\n #[arg(long = \"type\", default_value = \"live_agent\")]\n endpoint_type: String,\n #[command(flatten)]\n auth: AuthFlags,\n },\n /// Shell-binary bind: the type=Shell flavor of `bind`. Resolves\n /// the instance **by link token alone** (the spawn template carries only\n /// `{link_token}` — \"owner from the link\") and flips it online. The\n /// credential IS the auth: no token, no bind.\n BindShell {\n /// The link token the broker minted at launch.\n #[arg(long = \"link\")]\n link_token: String,\n },\n /// Set activity state busy|idle (also arms the echo-gate sentinel).\n ///\n /// Optionally carries the turn's IO payload for the event funnel: `busy`\n /// carries the USER_INPUT payload, `idle` the AGENT_OUTPUT end-of-turn\n /// payload. With no payload the call behaves\n /// exactly as it always has and emits nothing.\n State {\n #[arg(value_parser = [\"busy\", \"idle\"])]\n state: String,\n id: String,\n #[arg(long)]\n no_gate: bool,\n /// Read the IO payload from **stdin**. Explicit because this verb is\n /// fired by adapters on every hook: sniffing a non-tty stdin would\n /// block forever on an inherited-but-idle pipe, wedging the hook.\n #[arg(long = \"payload-stdin\")]\n payload_stdin: bool,\n /// Read the IO payload from a file.\n #[arg(long = \"payload-file\")]\n payload_file: Option,\n /// This payload is a MID-TURN span of agent output, not the turn's\n /// close: it is reported `busy` (the agent is still working) and is\n /// still `AGENT_OUTPUT`. Refused at `idle`, and refused with no\n /// payload — both are contradictions rather than events.\n #[arg(long = \"mid\")]\n mid: bool,\n #[command(flatten)]\n auth: AuthFlags,\n },\n /// Manage the echo-gate sentinel directly.\n EchoGate {\n #[arg(value_parser = [\"set\", \"clear\"])]\n action: String,\n id: String,\n #[command(flatten)]\n auth: AuthFlags,\n },\n /// Drain delivered messages (hook channel). With `--link` this is\n /// the shell-flavored relay drain: the link token is the auth, and\n /// the drained rows are the\n /// shell's MAC-stamped command/text/file frames.\n Poll {\n id: String,\n #[arg(long)]\n include_deferred: bool,\n /// Shell link token (the relay command-receipt drain).\n #[arg(long)]\n link: Option,\n #[command(flatten)]\n auth: AuthFlags,\n },\n /// Emit the agent's resume context (durable role/live/project tiers + any\n /// not-yet-synthesized commune/signoff drop as pending slices) to stdout, for\n /// the harness adapter's SessionStart hook to inject as additional context.\n PsycheDownload {\n id: String,\n // The harness session id rides `auth` (`--session-id`), which doubles as the\n // auth credential AND the contract's session id; no separate field. The\n // Tier-1 handler resolves project context from the perch's bound cwd.\n #[command(flatten)]\n auth: AuthFlags,\n },\n /// Create a nested worker perch under a parent. The worker id is minted by\n /// spt-core (`{parent}-w{N}`) and echoed as the bare id on stdout — the caller\n /// does NOT pass one. `--agent-id`/`--agent-type` are optional correlation\n /// metadata, never the perch identity.\n WorkerStart {\n parent: String,\n /// Adapter's own agent id (correlation metadata only).\n #[arg(long = \"agent-id\")]\n agent_id: Option,\n /// Adapter's own agent type (correlation metadata only).\n #[arg(long = \"agent-type\")]\n agent_type: Option,\n #[command(flatten)]\n auth: AuthFlags,\n },\n /// Tear down a worker perch.\n WorkerStop {\n id: String,\n #[command(flatten)]\n auth: AuthFlags,\n },\n /// Drain a worker perch's messages.\n WorkerPoll {\n id: String,\n #[command(flatten)]\n auth: AuthFlags,\n },\n /// Rebind the perch to a new session_id, preserving identity (a context clear/compact boundary).\n Boundary {\n #[arg(value_parser = [\"clear\", \"compact\"])]\n mode: String,\n id: String,\n /// The new session id to rebind the perch to.\n #[arg(long = \"to-session-id\")]\n to_session: String,\n #[command(flatten)]\n auth: AuthFlags,\n },\n /// Soft teardown (spool/history preserved); `--erase` hard-wipes.\n SessionEnd {\n id: String,\n #[arg(long)]\n erase: bool,\n #[command(flatten)]\n auth: AuthFlags,\n },\n /// Report user/agent presence at this endpoint.\n Presence {\n id: String,\n #[command(flatten)]\n auth: AuthFlags,\n },\n /// Report which node (if any) is remote-driving this endpoint.\n DrivenBy {\n id: String,\n #[command(flatten)]\n auth: AuthFlags,\n },\n /// Emit an endpoint's identity, where it runs, and which node (if any) is\n /// driving it, as JSON. With no id, reports the caller's own endpoint (like\n /// whoami); an explicit id reports that endpoint. Read-only.\n EndpointInfo {\n /// The endpoint id to report on. Omit to self-resolve the caller's perch.\n id: Option,\n },\n /// Wax seals: read a durable, citable proof of user authority over\n /// specific content. Read-only; answers on any member node of the seal's\n /// binding subnet.\n // No auth gate on either verb (the endpoint-info precedent): the store\n // replicates subnet-scoped so membership already bounds who can answer,\n // and neither verb mutates anything.\n // [impl->REQ-SEAL-DESCRIBE]\n // [impl->REQ-SEAL-VERIFY-CONTENT-BOUND]\n Seal {\n #[command(subcommand)]\n cmd: SealCmd,\n },\n /// Append normalized history (body on stdin) to the native history store.\n HistoryLog {\n id: String,\n #[command(flatten)]\n auth: AuthFlags,\n },\n /// Push one digest-record (the published contract JSON line, on stdin) for a\n /// log-less adapter — appended to the perch's digest store, tailed by the\n /// session-digest projection.\n DigestEntry {\n id: String,\n #[command(flatten)]\n auth: AuthFlags,\n },\n /// Emit a Shell sensory payload to the owner's **live** session.\n /// REST-only by definition: never spooled, dropped with a diagnostic when\n /// the owner isn't live. The link token is the auth.\n Emit {\n id: String,\n #[arg(long)]\n r#type: String,\n /// The sensory payload (descriptive text / encoded blob reference).\n payload: String,\n /// Shell link token (the per-link credential from launch).\n #[arg(long)]\n link: String,\n },\n /// Take-and-clear a Shell's pending ephemeral frames: the shell-side drain of\n /// the owner→shell control channel AND of the owner's pushed busy/idle state.\n /// REST-only, exactly-once — the daemon serves the single latest frame of\n /// each kind and ONLY when the link matches that slot's write-time stamp (no\n /// stale-control replay on relink). The link token is the auth (mirrors\n /// `emit`). Each pending frame prints to stdout on its own line, in class\n /// order: the drive frame, then the activity frame, then the attachment\n /// frame — so a poll may print none, one, or several. STDOUT carries frames\n\n[Showing lines 64-288 of 1432. Use :289 to continue]"}],"details":{"truncation":{"content":" #[arg(long)]\r\n pid: u32,\r\n #[arg(long)]\r\n session_id: String,\r\n },\r\n /// Consume a seed and hold the perch + relay loop (blocks).\r\n Listen {\r\n id: String,\r\n /// Override the parent-pid anchor (defaults to the self-discovered PPID).\r\n #[arg(long)]\r\n parent_pid: Option,\r\n /// Drain backlog + one receive cycle, then exit (testability).\r\n #[arg(long)]\r\n once: bool,\r\n /// Anchor subnet for a NEW endpoint (required on a multi-subnet\r\n /// node — the anchor is assigned at creation, never guessed).\r\n #[arg(long)]\r\n subnet: Option,\r\n /// Bind from this session id when the ephemeral seed is gone (a session\r\n /// going live late, or after a daemon restart). With no live seed and\r\n /// no session id, listen refuses (NO_SEED).\r\n #[arg(long)]\r\n session_id: Option,\r\n },\r\n /// Post-spawn bind of a session to its perch.\r\n Bind {\r\n id: String,\r\n /// The session id discovered post-spawn, written into the perch record.\r\n #[arg(long = \"set-session-id\")]\r\n bind_session: Option,\r\n /// Anchor subnet for a NEW endpoint (see `listen`).\r\n #[arg(long)]\r\n subnet: Option,\r\n /// The endpoint type tag (info.json `state`). Defaults to `live_agent`\r\n /// (the agent host); a non-agent endpoint — e.g. a `gateway` — binds\r\n /// with its own open-type tag. A revive keeps the\r\n /// prior type unless this overrides it.\r\n #[arg(long = \"type\", default_value = \"live_agent\")]\r\n endpoint_type: String,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Shell-binary bind: the type=Shell flavor of `bind`. Resolves\r\n /// the instance **by link token alone** (the spawn template carries only\r\n /// `{link_token}` — \"owner from the link\") and flips it online. The\r\n /// credential IS the auth: no token, no bind.\r\n BindShell {\r\n /// The link token the broker minted at launch.\r\n #[arg(long = \"link\")]\r\n link_token: String,\r\n },\r\n /// Set activity state busy|idle (also arms the echo-gate sentinel).\r\n ///\r\n /// Optionally carries the turn's IO payload for the event funnel: `busy`\r\n /// carries the USER_INPUT payload, `idle` the AGENT_OUTPUT end-of-turn\r\n /// payload. With no payload the call behaves\r\n /// exactly as it always has and emits nothing.\r\n State {\r\n #[arg(value_parser = [\"busy\", \"idle\"])]\r\n state: String,\r\n id: String,\r\n #[arg(long)]\r\n no_gate: bool,\r\n /// Read the IO payload from **stdin**. Explicit because this verb is\r\n /// fired by adapters on every hook: sniffing a non-tty stdin would\r\n /// block forever on an inherited-but-idle pipe, wedging the hook.\r\n #[arg(long = \"payload-stdin\")]\r\n payload_stdin: bool,\r\n /// Read the IO payload from a file.\r\n #[arg(long = \"payload-file\")]\r\n payload_file: Option,\r\n /// This payload is a MID-TURN span of agent output, not the turn's\r\n /// close: it is reported `busy` (the agent is still working) and is\r\n /// still `AGENT_OUTPUT`. Refused at `idle`, and refused with no\r\n /// payload — both are contradictions rather than events.\r\n #[arg(long = \"mid\")]\r\n mid: bool,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Manage the echo-gate sentinel directly.\r\n EchoGate {\r\n #[arg(value_parser = [\"set\", \"clear\"])]\r\n action: String,\r\n id: String,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Drain delivered messages (hook channel). With `--link` this is\r\n /// the shell-flavored relay drain: the link token is the auth, and\r\n /// the drained rows are the\r\n /// shell's MAC-stamped command/text/file frames.\r\n Poll {\r\n id: String,\r\n #[arg(long)]\r\n include_deferred: bool,\r\n /// Shell link token (the relay command-receipt drain).\r\n #[arg(long)]\r\n link: Option,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Emit the agent's resume context (durable role/live/project tiers + any\r\n /// not-yet-synthesized commune/signoff drop as pending slices) to stdout, for\r\n /// the harness adapter's SessionStart hook to inject as additional context.\r\n PsycheDownload {\r\n id: String,\r\n // The harness session id rides `auth` (`--session-id`), which doubles as the\r\n // auth credential AND the contract's session id; no separate field. The\r\n // Tier-1 handler resolves project context from the perch's bound cwd.\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Create a nested worker perch under a parent. The worker id is minted by\r\n /// spt-core (`{parent}-w{N}`) and echoed as the bare id on stdout — the caller\r\n /// does NOT pass one. `--agent-id`/`--agent-type` are optional correlation\r\n /// metadata, never the perch identity.\r\n WorkerStart {\r\n parent: String,\r\n /// Adapter's own agent id (correlation metadata only).\r\n #[arg(long = \"agent-id\")]\r\n agent_id: Option,\r\n /// Adapter's own agent type (correlation metadata only).\r\n #[arg(long = \"agent-type\")]\r\n agent_type: Option,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Tear down a worker perch.\r\n WorkerStop {\r\n id: String,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Drain a worker perch's messages.\r\n WorkerPoll {\r\n id: String,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Rebind the perch to a new session_id, preserving identity (a context clear/compact boundary).\r\n Boundary {\r\n #[arg(value_parser = [\"clear\", \"compact\"])]\r\n mode: String,\r\n id: String,\r\n /// The new session id to rebind the perch to.\r\n #[arg(long = \"to-session-id\")]\r\n to_session: String,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Soft teardown (spool/history preserved); `--erase` hard-wipes.\r\n SessionEnd {\r\n id: String,\r\n #[arg(long)]\r\n erase: bool,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Report user/agent presence at this endpoint.\r\n Presence {\r\n id: String,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Report which node (if any) is remote-driving this endpoint.\r\n DrivenBy {\r\n id: String,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Emit an endpoint's identity, where it runs, and which node (if any) is\r\n /// driving it, as JSON. With no id, reports the caller's own endpoint (like\r\n /// whoami); an explicit id reports that endpoint. Read-only.\r\n EndpointInfo {\r\n /// The endpoint id to report on. Omit to self-resolve the caller's perch.\r\n id: Option,\r\n },\r\n /// Wax seals: read a durable, citable proof of user authority over\r\n /// specific content. Read-only; answers on any member node of the seal's\r\n /// binding subnet.\r\n // No auth gate on either verb (the endpoint-info precedent): the store\r\n // replicates subnet-scoped so membership already bounds who can answer,\r\n // and neither verb mutates anything.\r\n // [impl->REQ-SEAL-DESCRIBE]\r\n // [impl->REQ-SEAL-VERIFY-CONTENT-BOUND]\r\n Seal {\r\n #[command(subcommand)]\r\n cmd: SealCmd,\r\n },\r\n /// Append normalized history (body on stdin) to the native history store.\r\n HistoryLog {\r\n id: String,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Push one digest-record (the published contract JSON line, on stdin) for a\r\n /// log-less adapter — appended to the perch's digest store, tailed by the\r\n /// session-digest projection.\r\n DigestEntry {\r\n id: String,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Emit a Shell sensory payload to the owner's **live** session.\r\n /// REST-only by definition: never spooled, dropped with a diagnostic when\r\n /// the owner isn't live. The link token is the auth.\r\n Emit {\r\n id: String,\r\n #[arg(long)]\r\n r#type: String,\r\n /// The sensory payload (descriptive text / encoded blob reference).\r\n payload: String,\r\n /// Shell link token (the per-link credential from launch).\r\n #[arg(long)]\r\n link: String,\r\n },\r\n /// Take-and-clear a Shell's pending ephemeral frames: the shell-side drain of\r\n /// the owner→shell control channel AND of the owner's pushed busy/idle state.\r\n /// REST-only, exactly-once — the daemon serves the single latest frame of\r\n /// each kind and ONLY when the link matches that slot's write-time stamp (no\r\n /// stale-control replay on relink). The link token is the auth (mirrors\r\n /// `emit`). Each pending frame prints to stdout on its own line, in class\r\n /// order: the drive frame, then the activity frame, then the attachment\r\n /// frame — so a poll may print none, one, or several. STDOUT carries frames\r","truncated":true,"truncatedBy":"lines","totalLines":1369,"totalBytes":9275,"outputLines":225,"outputBytes":9275,"lastLinePartial":false,"firstLineExceedsLimit":false},"totalLines":1432,"displayContent":{"text":" Seed {\n #[arg(long)]\r\n pid: u32,\r\n #[arg(long)]\r\n session_id: String,\r\n },\r\n /// Consume a seed and hold the perch + relay loop (blocks).\r\n Listen {\r\n id: String,\r\n /// Override the parent-pid anchor (defaults to the self-discovered PPID).\r\n #[arg(long)]\r\n parent_pid: Option,\r\n /// Drain backlog + one receive cycle, then exit (testability).\r\n #[arg(long)]\r\n once: bool,\r\n /// Anchor subnet for a NEW endpoint (required on a multi-subnet\r\n /// node — the anchor is assigned at creation, never guessed).\r\n #[arg(long)]\r\n subnet: Option,\r\n /// Bind from this session id when the ephemeral seed is gone (a session\r\n /// going live late, or after a daemon restart). With no live seed and\r\n /// no session id, listen refuses (NO_SEED).\r\n #[arg(long)]\r\n session_id: Option,\r\n },\r\n /// Post-spawn bind of a session to its perch.\r\n Bind {\r\n id: String,\r\n /// The session id discovered post-spawn, written into the perch record.\r\n #[arg(long = \"set-session-id\")]\r\n bind_session: Option,\r\n /// Anchor subnet for a NEW endpoint (see `listen`).\r\n #[arg(long)]\r\n subnet: Option,\r\n /// The endpoint type tag (info.json `state`). Defaults to `live_agent`\r\n /// (the agent host); a non-agent endpoint — e.g. a `gateway` — binds\r\n /// with its own open-type tag. A revive keeps the\r\n /// prior type unless this overrides it.\r\n #[arg(long = \"type\", default_value = \"live_agent\")]\r\n endpoint_type: String,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Shell-binary bind: the type=Shell flavor of `bind`. Resolves\r\n /// the instance **by link token alone** (the spawn template carries only\r\n /// `{link_token}` — \"owner from the link\") and flips it online. The\r\n /// credential IS the auth: no token, no bind.\r\n BindShell {\r\n /// The link token the broker minted at launch.\r\n #[arg(long = \"link\")]\r\n link_token: String,\r\n },\r\n /// Set activity state busy|idle (also arms the echo-gate sentinel).\r\n ///\r\n /// Optionally carries the turn's IO payload for the event funnel: `busy`\r\n /// carries the USER_INPUT payload, `idle` the AGENT_OUTPUT end-of-turn\r\n /// payload. With no payload the call behaves\r\n /// exactly as it always has and emits nothing.\r\n State {\r\n #[arg(value_parser = [\"busy\", \"idle\"])]\r\n state: String,\r\n id: String,\r\n #[arg(long)]\r\n no_gate: bool,\r\n /// Read the IO payload from **stdin**. Explicit because this verb is\r\n /// fired by adapters on every hook: sniffing a non-tty stdin would\r\n /// block forever on an inherited-but-idle pipe, wedging the hook.\r\n #[arg(long = \"payload-stdin\")]\r\n payload_stdin: bool,\r\n /// Read the IO payload from a file.\r\n #[arg(long = \"payload-file\")]\r\n payload_file: Option,\r\n /// This payload is a MID-TURN span of agent output, not the turn's\r\n /// close: it is reported `busy` (the agent is still working) and is\r\n /// still `AGENT_OUTPUT`. Refused at `idle`, and refused with no\r\n /// payload — both are contradictions rather than events.\r\n #[arg(long = \"mid\")]\r\n mid: bool,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Manage the echo-gate sentinel directly.\r\n EchoGate {\r\n #[arg(value_parser = [\"set\", \"clear\"])]\r\n action: String,\r\n id: String,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Drain delivered messages (hook channel). With `--link` this is\r\n /// the shell-flavored relay drain: the link token is the auth, and\r\n /// the drained rows are the\r\n /// shell's MAC-stamped command/text/file frames.\r\n Poll {\r\n id: String,\r\n #[arg(long)]\r\n include_deferred: bool,\r\n /// Shell link token (the relay command-receipt drain).\r\n #[arg(long)]\r\n link: Option,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Emit the agent's resume context (durable role/live/project tiers + any\r\n /// not-yet-synthesized commune/signoff drop as pending slices) to stdout, for\r\n /// the harness adapter's SessionStart hook to inject as additional context.\r\n PsycheDownload {\r\n id: String,\r\n // The harness session id rides `auth` (`--session-id`), which doubles as the\r\n // auth credential AND the contract's session id; no separate field. The\r\n // Tier-1 handler resolves project context from the perch's bound cwd.\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Create a nested worker perch under a parent. The worker id is minted by\r\n /// spt-core (`{parent}-w{N}`) and echoed as the bare id on stdout — the caller\r\n /// does NOT pass one. `--agent-id`/`--agent-type` are optional correlation\r\n /// metadata, never the perch identity.\r\n WorkerStart {\r\n parent: String,\r\n /// Adapter's own agent id (correlation metadata only).\r\n #[arg(long = \"agent-id\")]\r\n agent_id: Option,\r\n /// Adapter's own agent type (correlation metadata only).\r\n #[arg(long = \"agent-type\")]\r\n agent_type: Option,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Tear down a worker perch.\r\n WorkerStop {\r\n id: String,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Drain a worker perch's messages.\r\n WorkerPoll {\r\n id: String,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Rebind the perch to a new session_id, preserving identity (a context clear/compact boundary).\r\n Boundary {\r\n #[arg(value_parser = [\"clear\", \"compact\"])]\r\n mode: String,\r\n id: String,\r\n /// The new session id to rebind the perch to.\r\n #[arg(long = \"to-session-id\")]\r\n to_session: String,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Soft teardown (spool/history preserved); `--erase` hard-wipes.\r\n SessionEnd {\r\n id: String,\r\n #[arg(long)]\r\n erase: bool,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Report user/agent presence at this endpoint.\r\n Presence {\r\n id: String,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Report which node (if any) is remote-driving this endpoint.\r\n DrivenBy {\r\n id: String,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Emit an endpoint's identity, where it runs, and which node (if any) is\r\n /// driving it, as JSON. With no id, reports the caller's own endpoint (like\r\n /// whoami); an explicit id reports that endpoint. Read-only.\r\n EndpointInfo {\r\n /// The endpoint id to report on. Omit to self-resolve the caller's perch.\r\n id: Option,\r\n },\r\n /// Wax seals: read a durable, citable proof of user authority over\r\n /// specific content. Read-only; answers on any member node of the seal's\r\n /// binding subnet.\r\n // No auth gate on either verb (the endpoint-info precedent): the store\r\n // replicates subnet-scoped so membership already bounds who can answer,\r\n // and neither verb mutates anything.\r\n // [impl->REQ-SEAL-DESCRIBE]\r\n // [impl->REQ-SEAL-VERIFY-CONTENT-BOUND]\r\n Seal {\r\n #[command(subcommand)]\r\n cmd: SealCmd,\r\n },\r\n /// Append normalized history (body on stdin) to the native history store.\r\n HistoryLog {\r\n id: String,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Push one digest-record (the published contract JSON line, on stdin) for a\r\n /// log-less adapter — appended to the perch's digest store, tailed by the\r\n /// session-digest projection.\r\n DigestEntry {\r\n id: String,\r\n #[command(flatten)]\r\n auth: AuthFlags,\r\n },\r\n /// Emit a Shell sensory payload to the owner's **live** session.\r\n /// REST-only by definition: never spooled, dropped with a diagnostic when\r\n /// the owner isn't live. The link token is the auth.\r\n Emit {\r\n id: String,\r\n #[arg(long)]\r\n r#type: String,\r\n /// The sensory payload (descriptive text / encoded blob reference).\r\n payload: String,\r\n /// Shell link token (the per-link credential from launch).\r\n #[arg(long)]\r\n link: String,\r\n },\r\n /// Take-and-clear a Shell's pending ephemeral frames: the shell-side drain of\r\n /// the owner→shell control channel AND of the owner's pushed busy/idle state.\r\n /// REST-only, exactly-once — the daemon serves the single latest frame of\r\n /// each kind and ONLY when the link matches that slot's write-time stamp (no\r\n /// stale-control replay on relink). The link token is the auth (mirrors\r\n /// `emit`). Each pending frame prints to stdout on its own line, in class\r\n /// order: the drive frame, then the activity frame, then the attachment\r\n /// frame — so a poll may print none, one, or several. STDOUT carries frames\r","startLine":63,"lineNumbers":[63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288]},"fileSize":65009,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\spt\\src\\api\\mod.rs"},"truncation":{"direction":"head","truncatedBy":"lines","totalLines":1432,"totalBytes":9275,"outputLines":225,"outputBytes":9275,"shownRange":{"start":64,"end":288},"nextOffset":289}}},"isError":false,"timestamp":1790029745805}}
{"type":"message","id":"06ab9505","parentId":"bac02f88","timestamp":"2026-09-21T22:29:05.816Z","message":{"role":"toolResult","toolCallId":"call_W807lonhGChWxAYV1eW05zY7|fc_0c7d22595484f800016ab1afb1b1bc87d296321259721308f3","toolName":"grep","content":[{"type":"text","text":"# crates/spt-daemon/src/\n## attach.rs\n 149|/// gate-armed for the endpoint's own pulse loop). Best-effort exactly like\n*150|/// [`mark_driven_by`]: a session served without a perch has no resting\n 151|/// record to move.\n 152|// [impl->REQ-INST-3]\n 153|fn feed_rest(endpoint: &str, event: crate::resting::RestEvent) {\n...\n 162| /// REQ-RCVIEW-1) — nothing was served. The operator's `rc` renders the\n*163| /// busy guidance client-side from the endpoint's `driven_by`.\n 164| Refused,\n 165| /// The session's child exited; the `Exit` record was sent and the stream\n 166| /// finished.\n...\n 364|/// viewer / busy / take by intent + origin and replies a `Subscribed`;\n*365|/// driven_by / viewer_count are BROKER-owned (single writer). A VIEWER\n 366|/// attach ARMS snap-above at the floor (REQ-HAZARD-VIEWER-RING-ROLL-SNAP);\n 367|/// the CONTROLLER keeps strict reject-gap (exactly-once resume, B2).\n 368|// [impl->REQ-RC-CROSS-NODE-ATTACH]\n...\n 510| // The attached session — captured from the Request so the terminal paths can\n*511| // explicitly release this worker's role (clearing driven_by / viewer_count\n 512| // promptly, not only on connection drop).\n 513| let mut attached_session: Option = None;\n 514| // This worker's attach GENERATION (ADR-0038 Amendment fix 6) — set when\n...\n 763| // ever reached it; the buffer is discarded). The rc\n*764| // renders the busy guidance client-side from driven_by.\n 765| wire.net_stream_send(stream_id, &[], None, true)?;\n 766| return Ok(AttachServeOutcome::Refused);\n 767| }\n...\n 872| // ORDER MATTERS: feed the resting edge FIRST (it read-modify-writes\n*873| // info.json, carrying the current driven_by through), THEN release\n*874| // the role over IPC so the broker's driven_by=None is the LAST\n 875| // write — otherwise a concurrent resting RMW restores the stale\n 876| // marker (the clear-race the broker-single-writer model averts).\n 877| if role == Some(ServeRole::Controller) {\n## brain.rs\n 2334| // [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\n*2335| pub fn report_user_input(\n 2336| &mut self,\n*2337| report: crate::msg::UserInputReport,\n*2338| ) -> io::Result {\n 2339| self.send(\n 2340| crate::msg::KIND_USER_INPUT_REPORT,\n*2341| serde_json::to_value(report).expect(\"UserInputReport serializes\"),\n 2342| )?;\n 2343| let deadline = self.call_deadline();\n 2344| loop {\n...\n 2487| /// (REQ-RCVIEW-1) — the explicit detach a `serve_attach` worker sends when\n*2488| /// the viewport ends so the broker clears `driven_by` / `viewer_count`\n 2489| /// promptly. Best-effort: a dropped connection clears the role anyway.\n 2490| pub fn detach_session(&mut self, session_id: u64) -> io::Result<()> {\n 2491| self.detach_session_gen(session_id, None)\n## broker.rs\n 142| /// correct write path, not a new source. **In-memory, and that bound is part\n*143| /// of the requirement:** the DURABLE control triple (`driven_by` /\n 144| /// `controlled` / `viewer_count`) is UNCHANGED, and this value never reaches\n 145| /// a file. Durable viewer identity, if it is ever wanted, is its own request\n 146| /// — kin to the register's IR-72 custody-surface gap. Noted, not built toward.\n...\n 219|/// output, so `append`/`mark_controller_gone` never runs, and the stalled\n*220|/// controller would otherwise latch `driven_by` forever (reattach refused, `--take`\n 221|/// blocked). The brain aggregates every session + psyche + WAN feed, so its drain\n 222|/// is bursty; 15 s tolerates a normal burst-stall while still bounding the wedge.\n 223|/// A slow-but-DRAINING brain never trips it — the clock only advances while a write\n...\n 1031| /// The owning endpoint (the spawn's label; empty = unlabeled / raw test).\n*1032| /// The broker is the SINGLE writer of `driven_by` + `viewer_count` on this\n 1033| /// perch (REQ-RCVIEW-1, resolves the clear-race); empty ⇒ nowhere to stamp.\n 1034| endpoint: String,\n 1035| /// Last-known PTY size — seeded at spawn, updated on a controller resize.\n...\n 1126|/// (REQ-HAZARD-CONTROL-STAMP-CONVERGENCE): does the perch's RECORDED\n*1127|/// (`driven_by`, `controlled`, `viewer_count`) differ from the live session TRUTH?\n 1128|/// Returns `(control_write_needed, viewer_write_needed)` — the divergence gate that\n 1129|/// keeps the per-poll re-assert from writing (fsync) when nothing changed.\n 1130|// [impl->REQ-HAZARD-CONTROL-STAMP-CONVERGENCE]\n 1131|fn stamp_divergence(\n*1132| rec_driven_by: Option<&str>,\n 1133| rec_controlled: bool,\n 1134| rec_viewers: u32,\n*1135| want_driven_by: Option<&str>,\n 1136| want_controlled: bool,\n 1137| want_viewers: u32,\n 1138|) -> (bool, bool) {\n*1139| let control = rec_driven_by != want_driven_by || rec_controlled != want_controlled;\n 1140| let viewer = rec_viewers != want_viewers;\n 1141| (control, viewer)\n 1142|}\n...\n 1194| endpoint: &str,\n*1195| want_driven_by: Option<&str>,\n 1196| want_controlled: bool,\n 1197| want_viewers: u32,\n 1198| snap_gen: u64,\n...\n 1215| let (control, viewer) = stamp_divergence(\n*1216| rec.driven_by.as_deref(),\n 1217| rec.controlled,\n 1218| rec.viewer_count.unwrap_or(0),\n*1219| want_driven_by,\n 1220| want_controlled,\n 1221| want_viewers,\n 1222| );\n...\n 1232| if control {\n*1233| let _ = spt_store::info::set_driven_by(&perch, want_driven_by);\n 1234| let _ = spt_store::info::set_controlled(&perch, want_controlled);\n 1235| // The THIRD engine-room drop edge (ADR-0052 §3a). The two in-memory\n 1236| // reap paths (`reap_dead_controller`, the stall-evict) deliberately do\n...\n 1659| /// single live writer per connection and a monotonic on-wire seq stream,\n*1660| /// [`REQ-HAZARD-CONTROLLER-WRITER-REORDER`]). Stamps `driven_by` to the new\n 1661| /// controller's identity.\n 1662| /// The engine room's rc locks against one subscribe, or `None` if they have\n 1663| /// nothing to say (every endpoint but the reserved one, and the attaches the\n...\n 2689| });\n*2690| self.stamp_driven_by();\n 2691| // The seat changed hands (or was filled): the incoming controller does\n 2692| // not inherit the outgoing one's authority. An equal-generation re-serve\n 2693| // is the SAME lease and keeps it.\n...\n 2742| /// the W1↔W5 synergy) W5's reconcile self-heal. Dropping the sink ends its\n*2743| /// writer thread; clearing the slot re-stamps `driven_by` to `None` (so an\n 2744| /// `ONLINE+CONTROLLED` latch cannot outlive a gone controller).\n 2745| ///\n 2746| /// `cause` is the CALLER'S OWN knowledge of which edge closed the slot, and it\n...\n 2771| }\n*2772| self.stamp_driven_by();\n 2773| // Detach is a drop edge: the posture goes offline (derived from the\n 2774| // stamp just written) and the empowerments go with it.\n 2775| self.on_control_edge(prev_gen, None);\n...\n 2786| /// EXISTING [`converge_perch_stamps`] clears the now-stale info.json\n*2787| /// `driven_by`/`controlled` stamp — no new detach path, no new query.\n 2788| ///\n 2789| /// LOCK-SAFE: this runs UNDER the log lock in the snapshot closure, so it must do\n 2790| /// NO file I/O (the lock-across-effect discipline, KH 7.12/5.16). It drops the\n 2791| /// sink in-memory ONLY (like [`become_controller`]'s prior-drop) and does NOT\n*2792| /// [`stamp_driven_by`] — the OFF-lock `converge_perch_stamps` writes the honest\n 2793| /// stamp. Returns true iff it reaped.\n 2794| ///\n 2795| /// SCOPE (doyle B-2 reduction): catches a writer that FAILED A WRITE (output was\n...\n 2801| /// deliberately NOT built here. KH 7.15 held by construction: only ever CLEARS,\n*2802| /// never latches `driven_by`.\n 2803| // [impl->REQ-CONTROLLER-LIVENESS-REAP]\n 2804| fn reap_dead_controller(&mut self) -> bool {\n 2805| let dead = self\n...\n 2817| // BRAIN_WRITE_DEADLINE is also reaped here, so the honest `KIND_SESSIONS`\n*2818| // truth + the off-lock converge_perch_stamps release its stale `driven_by`\n 2819| // stamp even when nobody take/reattaches. Deferred stamp: the reap runs in\n 2820| // the multi-session snapshot closure (no I/O under the shared sessions lock).\n 2821| self.stall_evict_controller(Instant::now(), StampMode::Deferred)\n...\n 2864| /// Stall-evict a controller wedged past [`BRAIN_WRITE_DEADLINE`]: clear the slot\n*2865| /// and re-stamp `driven_by`/`controlled` (the BROKER-side release — no brain\n 2866| /// round-trip, so `controlled-by` can never latch behind a dead transit) and\n 2867| /// record the evict for observability (broker log now; W3 persists the stderr,\n 2868| /// the tally surfaces on `daemon status`). The take/reattach path and the\n## livehost.rs\n 807| // classification quirk (ready_agent hybrid, legacy `None`, relay) can\n*808| // never shield stale `controlled`/`driven_by`/`viewer_count` (the sticky\n 809| // stamp that survived clean-exit AND a daemon restart — perri F-b).\n 810| // All THREE fields clear (decision 4's no-session rule) — `attached_node`\n 811| // derives from them, so this clears it too. Divergence-gated: rows with\n...\n 820| if !has_session\n*821| && (info.controlled || info.driven_by.is_some() || info.viewer_count.is_some())\n 822| {\n 823| let _ = spt_store::info::set_controlled(&perch, false);\n*824| let _ = spt_store::info::set_driven_by(&perch, None);\n 825| let _ = spt_store::info::set_viewer_count(&perch, 0);\n 826| spt_proto::emit_line_err!(\n*827| \"CONTROL_REAP_NO_SESSION:{id}: cleared stale controlled/driven_by/viewer_count (no broker session)\"\n 828| );\n 829| }\n 830|\n...\n 981| let _ = spt_store::resume_custody::clear(&perch);\n*982| // W5 Gap B (driven_by self-heal): an offlined endpoint can ALSO carry\n*983| // a stale `driven_by = Some` — its broker session (the single writer)\n 984| // is gone, so the `clear_controller` re-stamp can never fire to unlatch\n 985| // it. The split cleanup above already cleared every no-session row;\n 986| // this belt stays for the same-tick read (info is a pre-cleanup\n...\n 988| // [impl->REQ-HAZARD-DRIVEN-BY-SELFHEAL]\n*989| if info.driven_by.is_some() {\n*990| let _ = spt_store::info::set_driven_by(&perch, None);\n*991| spt_proto::emit_line_err!(\"DRIVEN_BY_SELFHEAL_OFFLINE:{id}: cleared stale driven_by (no session)\");\n 992| }\n 993| spt_proto::emit_line_err!(\"LIVENESS_RECONCILE_OFFLINE:{id}: no live broker session (dead harness)\");\n 994| offlined.push(id);\n...\n 1601| // ALSO covers W5 Gap B (REQ-HAZARD-DRIVEN-BY-SELFHEAL): each spt-hosted perch is\n*1602| // pre-stamped `driven_by = Some(\"node\")` (the lost-detach latch). After the\n*1603| // reconcile the sessionless `dead` perch must have driven_by CLEARED to None\n 1604| // (an OFFLINE endpoint must never render phantom CONTROLLED), while the\n*1605| // session-backed `alive` perch keeps driven_by UNTOUCHED (the live-session\n 1606| // clear is the deferred broker-side path, not this reconcile read).\n 1607| //\n 1608| // W2 UPDATE (ADR-0041 decision 2, REQ-ENDPOINT-ONLINE-TRUTH): control cleanup\n...\n 1684| };\n*1685| // Pre-stamp the driven_by + controlled latch on every spt-hosted live_agent\n 1686| // perch so the Gap-B clear, the B3 control-reap, and the must-not-touch\n 1687| // invariants are all observable.\n 1688| let latch = |id: &str| {\n 1689| let perch = perch::resolve_perch_path(id, ParentHint::Infer);\n*1690| spt_store::info::set_driven_by(&perch, Some(node)).unwrap();\n 1691| spt_store::info::set_controlled(&perch, true).unwrap();\n 1692| };\n 1693| seed(\"alive\", \"live_agent\", Some(true)); // has a session → stays\n...\n 1697| seed(\"ready\", \"ready_agent\", Some(false)); // PID-model listener (live pid) → stays online\n*1698| latch(\"alive\"); // live session → driven_by must NOT be cleared\n*1699| latch(\"dead\"); // sessionless → driven_by MUST be cleared (Gap B)\n*1700| latch(\"relay\"); // exempt → driven_by must NOT be cleared\n 1701|\n 1702| let mut live = BTreeSet::new();\n 1703| live.insert(\"alive\".to_string());\n...\n 1730| // [unit->REQ-HAZARD-DRIVEN-BY-SELFHEAL] Gap B: the reconcile clears the\n*1731| // stale driven_by latch on the offlined sessionless perch, but must NOT\n 1732| // touch a live-session perch (deferred to broker-side eviction —\n 1733| // REQ-HAZARD-DRIVEN-BY-IDLE-REMOTE-EVICT) nor an exempt relay.\n*1734| let driven_by = |id: &str| {\n 1735| spt_store::info::read_info(&perch::resolve_perch_path(id, ParentHint::Infer))\n*1736| .and_then(|i| i.driven_by)\n 1737| };\n 1738| assert_eq!(\n## msg.rs\n 42|/// (W2.5, REQ-RCVIEW-1) — the explicit detach a `serve_attach` worker sends when\n*43|/// the operator's viewport ends, so `driven_by` / `viewer_count` clear promptly\n 44|/// even if the serving brain connection lives on (a connection drop also clears\n 45|/// the role, so this is idempotent belt-and-braces).\n 46|pub const KIND_UNSUBSCRIBE: &str = \"unsubscribe\";\n...\n 79|/// operator (busy). A normal reply, not a new wire frame (the busy refusal is\n*80|/// rendered client-side by `rc` from the endpoint's `driven_by`).\n 81|pub const KIND_SUBSCRIBED: &str = \"subscribed\";\n 82|/// Broker→brain: the current PTY size of a session, pushed to a VIEWER on\n 83|/// attach and to every viewer on a controller resize (REQ-RCVIEW-1). The\n...\n 464|#[derive(Debug, Clone, Serialize, Deserialize)]\n*465|pub struct UserInputReport {\n 466| pub endpoint: String,\n 467| pub session: String,\n 468| pub payload: String,\n...\n 474|#[derive(Debug, Clone, Serialize, Deserialize)]\n*475|pub struct UserInputReported {\n 476| /// Empty on admitted or duplicate reports. Non-grants name their condition.\n 477| pub declined: Option,\n 478|}\n...\n 1536| /// `by = None`. So `controller_by == None` does NOT by itself mean \"no\n*1537| /// controller\" — it cannot be used as a standalone `driven_by` clear trigger\n 1538| /// without false-clearing a live, locally-driven session.\n 1539| ///\n 1540| /// Currently consumed by the W5 self-heal CHARACTERIZATION (the real-broker\n## registryhost.rs\n 638| // picker keys on).\n*639| // - controller_node: the broker-owned `driven_by` (the driving node),\n 640| // if any → the remote blue \"controlled\" + `controlled by ` pin.\n 641| // - harness_only: a LiveAgent with no broker PTY seat — mirrors the\n 642| // picker's `controllable != Some(true)` for a `live_agent` (a legacy\n...\n 648| // remote one. A LOCALLY-SPAWNED controller (dispatch_spawn's by=None) sets\n*649| // the separate `controlled` flag with `driven_by=None`, and its driving\n*650| // node IS this node — so advertise `self.node_hex`. (`driven_by` = the\n 651| // controlling node incl own per CONTEXT.md:386; an own-node net-path rc\n 652| // latches its hex — a different path from the by=None spawn.) A remote\n 653| // controller keeps\n...\n 657| let controller_node = gossip_controller_node(\n*658| info.as_ref().and_then(|i| i.driven_by.as_deref()),\n 659| info.as_ref().is_some_and(|i| i.controlled),\n 660| &self.node_hex,\n 661| );\n...\n 677| // - controlled: the raw any-controller marker (NOT controller_node.is_some();\n*678| // a local controller has driven_by=None so that WHO datum undercounts it).\n 679| // [impl->REQ-GOSSIP-ADAPTER-PROJECTS]\n 680| let adapter = info.as_ref().and_then(|i| i.adapter.clone());\n 681| let controlled = info.as_ref().is_some_and(|i| i.controlled);\n...\n 1078|/// The controlling node to gossip on an Instance (#3, REQ-GOSSIP-CONTROLLED-ANY).\n*1079|/// A REMOTE controller keeps its own `driven_by` origin. A LOCAL controller (the\n*1080|/// separate `controlled` flag, with `driven_by` = None per KH 7.15) is driven from\n 1081|/// THIS node, so it gossips `self_node`. An undriven endpoint gossips `None`. Pure\n 1082|/// over its inputs so the any-controller mapping is unit-tested.\n 1083|// [impl->REQ-GOSSIP-CONTROLLED-ANY]\n 1084|fn gossip_controller_node(\n*1085| driven_by: Option<&str>,\n 1086| controlled: bool,\n 1087| self_node: &str,\n 1088|) -> Option {\n*1089| match driven_by {\n 1090| Some(remote) => Some(remote.to_string()),\n 1091| None if controlled => Some(self_node.to_string()),\n 1092| None => None,\n...\n 1496| // [unit->REQ-GOSSIP-CONTROLLED-ANY] bug #3: a locally-controlled endpoint\n*1497| // (driven_by = None per KH 7.15, `controlled` = true) gossips THIS node as its\n 1498| // controller so a remote viewer sees CONTROLLED, not \"ready to control\"; a\n 1499| // remote controller keeps its own origin; an undriven endpoint gossips None.\n 1500| #[test]\n 1501| fn gossip_controller_node_covers_any_controller() {\n*1502| // Local controller: driven_by None + controlled → this node (the fix).\n 1503| assert_eq!(\n 1504| gossip_controller_node(None, true, \"selfhex\"),\n 1505| Some(\"selfhex\".to_string()),\n...\n 1507| );\n*1508| // Remote controller: keep the remote origin (driven_by wins).\n 1509| assert_eq!(\n 1510| gossip_controller_node(Some(\"remotehex\"), true, \"selfhex\"),\n 1511| Some(\"remotehex\".to_string())"}],"details":{"scopePath":"crates/spt-daemon/src","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates\\spt-daemon\\src","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":69,"fileCount":6,"files":["crates/spt-daemon/src/attach.rs","crates/spt-daemon/src/brain.rs","crates/spt-daemon/src/broker.rs","crates/spt-daemon/src/livehost.rs","crates/spt-daemon/src/msg.rs","crates/spt-daemon/src/registryhost.rs"],"fileMatches":[{"path":"crates/spt-daemon/src/attach.rs","count":7},{"path":"crates/spt-daemon/src/brain.rs","count":5},{"path":"crates/spt-daemon/src/broker.rs","count":20},{"path":"crates/spt-daemon/src/livehost.rs","count":20},{"path":"crates/spt-daemon/src/msg.rs","count":5},{"path":"crates/spt-daemon/src/registryhost.rs","count":12}],"truncated":true,"perFileLimitReached":20,"displayContent":"# crates/spt-daemon/src/\n## attach.rs\n 149│/// gate-armed for the endpoint's own pulse loop). Best-effort exactly like\n*150│/// [`mark_driven_by`]: a session served without a perch has no resting\n 151│/// record to move.\n 152│// [impl->REQ-INST-3]\n 153│fn feed_rest(endpoint: &str, event: crate::resting::RestEvent) {\n │...\n 162│ /// REQ-RCVIEW-1) — nothing was served. The operator's `rc` renders the\n*163│ /// busy guidance client-side from the endpoint's `driven_by`.\n 164│ Refused,\n 165│ /// The session's child exited; the `Exit` record was sent and the stream\n 166│ /// finished.\n │...\n 364│/// viewer / busy / take by intent + origin and replies a `Subscribed`;\n*365│/// driven_by / viewer_count are BROKER-owned (single writer). A VIEWER\n 366│/// attach ARMS snap-above at the floor (REQ-HAZARD-VIEWER-RING-ROLL-SNAP);\n 367│/// the CONTROLLER keeps strict reject-gap (exactly-once resume, B2).\n 368│// [impl->REQ-RC-CROSS-NODE-ATTACH]\n │...\n 510│ // The attached session — captured from the Request so the terminal paths can\n*511│ // explicitly release this worker's role (clearing driven_by / viewer_count\n 512│ // promptly, not only on connection drop).\n 513│ let mut attached_session: Option = None;\n 514│ // This worker's attach GENERATION (ADR-0038 Amendment fix 6) — set when\n │...\n 763│ // ever reached it; the buffer is discarded). The rc\n*764│ // renders the busy guidance client-side from driven_by.\n 765│ wire.net_stream_send(stream_id, &[], None, true)?;\n 766│ return Ok(AttachServeOutcome::Refused);\n 767│ }\n │...\n 872│ // ORDER MATTERS: feed the resting edge FIRST (it read-modify-writes\n*873│ // info.json, carrying the current driven_by through), THEN release\n*874│ // the role over IPC so the broker's driven_by=None is the LAST\n 875│ // write — otherwise a concurrent resting RMW restores the stale\n 876│ // marker (the clear-race the broker-single-writer model averts).\n 877│ if role == Some(ServeRole::Controller) {\n## brain.rs\n 2334│ // [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\n*2335│ pub fn report_user_input(\n 2336│ &mut self,\n*2337│ report: crate::msg::UserInputReport,\n*2338│ ) -> io::Result {\n 2339│ self.send(\n 2340│ crate::msg::KIND_USER_INPUT_REPORT,\n*2341│ serde_json::to_value(report).expect(\"UserInputReport serializes\"),\n 2342│ )?;\n 2343│ let deadline = self.call_deadline();\n 2344│ loop {\n │...\n 2487│ /// (REQ-RCVIEW-1) — the explicit detach a `serve_attach` worker sends when\n*2488│ /// the viewport ends so the broker clears `driven_by` / `viewer_count`\n 2489│ /// promptly. Best-effort: a dropped connection clears the role anyway.\n 2490│ pub fn detach_session(&mut self, session_id: u64) -> io::Result<()> {\n 2491│ self.detach_session_gen(session_id, None)\n## broker.rs\n 142│ /// correct write path, not a new source. **In-memory, and that bound is part\n *143│ /// of the requirement:** the DURABLE control triple (`driven_by` /\n 144│ /// `controlled` / `viewer_count`) is UNCHANGED, and this value never reaches\n 145│ /// a file. Durable viewer identity, if it is ever wanted, is its own request\n 146│ /// — kin to the register's IR-72 custody-surface gap. Noted, not built toward.\n │...\n 219│/// output, so `append`/`mark_controller_gone` never runs, and the stalled\n *220│/// controller would otherwise latch `driven_by` forever (reattach refused, `--take`\n 221│/// blocked). The brain aggregates every session + psyche + WAN feed, so its drain\n 222│/// is bursty; 15 s tolerates a normal burst-stall while still bounding the wedge.\n 223│/// A slow-but-DRAINING brain never trips it — the clock only advances while a write\n │...\n 1031│ /// The owning endpoint (the spawn's label; empty = unlabeled / raw test).\n*1032│ /// The broker is the SINGLE writer of `driven_by` + `viewer_count` on this\n 1033│ /// perch (REQ-RCVIEW-1, resolves the clear-race); empty ⇒ nowhere to stamp.\n 1034│ endpoint: String,\n 1035│ /// Last-known PTY size — seeded at spawn, updated on a controller resize.\n │...\n 1126│/// (REQ-HAZARD-CONTROL-STAMP-CONVERGENCE): does the perch's RECORDED\n*1127│/// (`driven_by`, `controlled`, `viewer_count`) differ from the live session TRUTH?\n 1128│/// Returns `(control_write_needed, viewer_write_needed)` — the divergence gate that\n 1129│/// keeps the per-poll re-assert from writing (fsync) when nothing changed.\n 1130│// [impl->REQ-HAZARD-CONTROL-STAMP-CONVERGENCE]\n 1131│fn stamp_divergence(\n*1132│ rec_driven_by: Option<&str>,\n 1133│ rec_controlled: bool,\n 1134│ rec_viewers: u32,\n*1135│ want_driven_by: Option<&str>,\n 1136│ want_controlled: bool,\n 1137│ want_viewers: u32,\n 1138│) -> (bool, bool) {\n*1139│ let control = rec_driven_by != want_driven_by || rec_controlled != want_controlled;\n 1140│ let viewer = rec_viewers != want_viewers;\n 1141│ (control, viewer)\n 1142│}\n │...\n 1194│ endpoint: &str,\n*1195│ want_driven_by: Option<&str>,\n 1196│ want_controlled: bool,\n 1197│ want_viewers: u32,\n 1198│ snap_gen: u64,\n │...\n 1215│ let (control, viewer) = stamp_divergence(\n*1216│ rec.driven_by.as_deref(),\n 1217│ rec.controlled,\n 1218│ rec.viewer_count.unwrap_or(0),\n*1219│ want_driven_by,\n 1220│ want_controlled,\n 1221│ want_viewers,\n 1222│ );\n │...\n 1232│ if control {\n*1233│ let _ = spt_store::info::set_driven_by(&perch, want_driven_by);\n 1234│ let _ = spt_store::info::set_controlled(&perch, want_controlled);\n 1235│ // The THIRD engine-room drop edge (ADR-0052 §3a). The two in-memory\n 1236│ // reap paths (`reap_dead_controller`, the stall-evict) deliberately do\n │...\n 1659│ /// single live writer per connection and a monotonic on-wire seq stream,\n*1660│ /// [`REQ-HAZARD-CONTROLLER-WRITER-REORDER`]). Stamps `driven_by` to the new\n 1661│ /// controller's identity.\n 1662│ /// The engine room's rc locks against one subscribe, or `None` if they have\n 1663│ /// nothing to say (every endpoint but the reserved one, and the attaches the\n │...\n 2689│ });\n*2690│ self.stamp_driven_by();\n 2691│ // The seat changed hands (or was filled): the incoming controller does\n 2692│ // not inherit the outgoing one's authority. An equal-generation re-serve\n 2693│ // is the SAME lease and keeps it.\n │...\n 2742│ /// the W1↔W5 synergy) W5's reconcile self-heal. Dropping the sink ends its\n*2743│ /// writer thread; clearing the slot re-stamps `driven_by` to `None` (so an\n 2744│ /// `ONLINE+CONTROLLED` latch cannot outlive a gone controller).\n 2745│ ///\n 2746│ /// `cause` is the CALLER'S OWN knowledge of which edge closed the slot, and it\n │...\n 2771│ }\n*2772│ self.stamp_driven_by();\n 2773│ // Detach is a drop edge: the posture goes offline (derived from the\n 2774│ // stamp just written) and the empowerments go with it.\n 2775│ self.on_control_edge(prev_gen, None);\n │...\n 2786│ /// EXISTING [`converge_perch_stamps`] clears the now-stale info.json\n*2787│ /// `driven_by`/`controlled` stamp — no new detach path, no new query.\n 2788│ ///\n 2789│ /// LOCK-SAFE: this runs UNDER the log lock in the snapshot closure, so it must do\n 2790│ /// NO file I/O (the lock-across-effect discipline, KH 7.12/5.16). It drops the\n 2791│ /// sink in-memory ONLY (like [`become_controller`]'s prior-drop) and does NOT\n*2792│ /// [`stamp_driven_by`] — the OFF-lock `converge_perch_stamps` writes the honest\n 2793│ /// stamp. Returns true iff it reaped.\n 2794│ ///\n 2795│ /// SCOPE (doyle B-2 reduction): catches a writer that FAILED A WRITE (output was\n │...\n 2801│ /// deliberately NOT built here. KH 7.15 held by construction: only ever CLEARS,\n*2802│ /// never latches `driven_by`.\n 2803│ // [impl->REQ-CONTROLLER-LIVENESS-REAP]\n 2804│ fn reap_dead_controller(&mut self) -> bool {\n 2805│ let dead = self\n │...\n 2817│ // BRAIN_WRITE_DEADLINE is also reaped here, so the honest `KIND_SESSIONS`\n*2818│ // truth + the off-lock converge_perch_stamps release its stale `driven_by`\n 2819│ // stamp even when nobody take/reattaches. Deferred stamp: the reap runs in\n 2820│ // the multi-session snapshot closure (no I/O under the shared sessions lock).\n 2821│ self.stall_evict_controller(Instant::now(), StampMode::Deferred)\n │...\n 2864│ /// Stall-evict a controller wedged past [`BRAIN_WRITE_DEADLINE`]: clear the slot\n*2865│ /// and re-stamp `driven_by`/`controlled` (the BROKER-side release — no brain\n 2866│ /// round-trip, so `controlled-by` can never latch behind a dead transit) and\n 2867│ /// record the evict for observability (broker log now; W3 persists the stderr,\n 2868│ /// the tally surfaces on `daemon status`). The take/reattach path and the\n## livehost.rs\n 807│ // classification quirk (ready_agent hybrid, legacy `None`, relay) can\n *808│ // never shield stale `controlled`/`driven_by`/`viewer_count` (the sticky\n 809│ // stamp that survived clean-exit AND a daemon restart — perri F-b).\n 810│ // All THREE fields clear (decision 4's no-session rule) — `attached_node`\n 811│ // derives from them, so this clears it too. Divergence-gated: rows with\n │...\n 820│ if !has_session\n *821│ && (info.controlled || info.driven_by.is_some() || info.viewer_count.is_some())\n 822│ {\n 823│ let _ = spt_store::info::set_controlled(&perch, false);\n *824│ let _ = spt_store::info::set_driven_by(&perch, None);\n 825│ let _ = spt_store::info::set_viewer_count(&perch, 0);\n 826│ spt_proto::emit_line_err!(\n *827│ \"CONTROL_REAP_NO_SESSION:{id}: cleared stale controlled/driven_by/viewer_count (no broker session)\"\n 828│ );\n 829│ }\n 830│\n │...\n 981│ let _ = spt_store::resume_custody::clear(&perch);\n *982│ // W5 Gap B (driven_by self-heal): an offlined endpoint can ALSO carry\n *983│ // a stale `driven_by = Some` — its broker session (the single writer)\n 984│ // is gone, so the `clear_controller` re-stamp can never fire to unlatch\n 985│ // it. The split cleanup above already cleared every no-session row;\n 986│ // this belt stays for the same-tick read (info is a pre-cleanup\n │...\n 988│ // [impl->REQ-HAZARD-DRIVEN-BY-SELFHEAL]\n *989│ if info.driven_by.is_some() {\n *990│ let _ = spt_store::info::set_driven_by(&perch, None);\n *991│ spt_proto::emit_line_err!(\"DRIVEN_BY_SELFHEAL_OFFLINE:{id}: cleared stale driven_by (no session)\");\n 992│ }\n 993│ spt_proto::emit_line_err!(\"LIVENESS_RECONCILE_OFFLINE:{id}: no live broker session (dead harness)\");\n 994│ offlined.push(id);\n │...\n 1601│ // ALSO covers W5 Gap B (REQ-HAZARD-DRIVEN-BY-SELFHEAL): each spt-hosted perch is\n*1602│ // pre-stamped `driven_by = Some(\"node\")` (the lost-detach latch). After the\n*1603│ // reconcile the sessionless `dead` perch must have driven_by CLEARED to None\n 1604│ // (an OFFLINE endpoint must never render phantom CONTROLLED), while the\n*1605│ // session-backed `alive` perch keeps driven_by UNTOUCHED (the live-session\n 1606│ // clear is the deferred broker-side path, not this reconcile read).\n 1607│ //\n 1608│ // W2 UPDATE (ADR-0041 decision 2, REQ-ENDPOINT-ONLINE-TRUTH): control cleanup\n │...\n 1684│ };\n*1685│ // Pre-stamp the driven_by + controlled latch on every spt-hosted live_agent\n 1686│ // perch so the Gap-B clear, the B3 control-reap, and the must-not-touch\n 1687│ // invariants are all observable.\n 1688│ let latch = |id: &str| {\n 1689│ let perch = perch::resolve_perch_path(id, ParentHint::Infer);\n*1690│ spt_store::info::set_driven_by(&perch, Some(node)).unwrap();\n 1691│ spt_store::info::set_controlled(&perch, true).unwrap();\n 1692│ };\n 1693│ seed(\"alive\", \"live_agent\", Some(true)); // has a session → stays\n │...\n 1697│ seed(\"ready\", \"ready_agent\", Some(false)); // PID-model listener (live pid) → stays online\n*1698│ latch(\"alive\"); // live session → driven_by must NOT be cleared\n*1699│ latch(\"dead\"); // sessionless → driven_by MUST be cleared (Gap B)\n*1700│ latch(\"relay\"); // exempt → driven_by must NOT be cleared\n 1701│\n 1702│ let mut live = BTreeSet::new();\n 1703│ live.insert(\"alive\".to_string());\n │...\n 1730│ // [unit->REQ-HAZARD-DRIVEN-BY-SELFHEAL] Gap B: the reconcile clears the\n*1731│ // stale driven_by latch on the offlined sessionless perch, but must NOT\n 1732│ // touch a live-session perch (deferred to broker-side eviction —\n 1733│ // REQ-HAZARD-DRIVEN-BY-IDLE-REMOTE-EVICT) nor an exempt relay.\n*1734│ let driven_by = |id: &str| {\n 1735│ spt_store::info::read_info(&perch::resolve_perch_path(id, ParentHint::Infer))\n*1736│ .and_then(|i| i.driven_by)\n 1737│ };\n 1738│ assert_eq!(\n## msg.rs\n 42│/// (W2.5, REQ-RCVIEW-1) — the explicit detach a `serve_attach` worker sends when\n *43│/// the operator's viewport ends, so `driven_by` / `viewer_count` clear promptly\n 44│/// even if the serving brain connection lives on (a connection drop also clears\n 45│/// the role, so this is idempotent belt-and-braces).\n 46│pub const KIND_UNSUBSCRIBE: &str = \"unsubscribe\";\n │...\n 79│/// operator (busy). A normal reply, not a new wire frame (the busy refusal is\n *80│/// rendered client-side by `rc` from the endpoint's `driven_by`).\n 81│pub const KIND_SUBSCRIBED: &str = \"subscribed\";\n 82│/// Broker→brain: the current PTY size of a session, pushed to a VIEWER on\n 83│/// attach and to every viewer on a controller resize (REQ-RCVIEW-1). The\n │...\n 464│#[derive(Debug, Clone, Serialize, Deserialize)]\n *465│pub struct UserInputReport {\n 466│ pub endpoint: String,\n 467│ pub session: String,\n 468│ pub payload: String,\n │...\n 474│#[derive(Debug, Clone, Serialize, Deserialize)]\n *475│pub struct UserInputReported {\n 476│ /// Empty on admitted or duplicate reports. Non-grants name their condition.\n 477│ pub declined: Option,\n 478│}\n │...\n 1536│ /// `by = None`. So `controller_by == None` does NOT by itself mean \"no\n*1537│ /// controller\" — it cannot be used as a standalone `driven_by` clear trigger\n 1538│ /// without false-clearing a live, locally-driven session.\n 1539│ ///\n 1540│ /// Currently consumed by the W5 self-heal CHARACTERIZATION (the real-broker\n## registryhost.rs\n 638│ // picker keys on).\n *639│ // - controller_node: the broker-owned `driven_by` (the driving node),\n 640│ // if any → the remote blue \"controlled\" + `controlled by ` pin.\n 641│ // - harness_only: a LiveAgent with no broker PTY seat — mirrors the\n 642│ // picker's `controllable != Some(true)` for a `live_agent` (a legacy\n │...\n 648│ // remote one. A LOCALLY-SPAWNED controller (dispatch_spawn's by=None) sets\n *649│ // the separate `controlled` flag with `driven_by=None`, and its driving\n *650│ // node IS this node — so advertise `self.node_hex`. (`driven_by` = the\n 651│ // controlling node incl own per CONTEXT.md:386; an own-node net-path rc\n 652│ // latches its hex — a different path from the by=None spawn.) A remote\n 653│ // controller keeps\n │...\n 657│ let controller_node = gossip_controller_node(\n *658│ info.as_ref().and_then(|i| i.driven_by.as_deref()),\n 659│ info.as_ref().is_some_and(|i| i.controlled),\n 660│ &self.node_hex,\n 661│ );\n │...\n 677│ // - controlled: the raw any-controller marker (NOT controller_node.is_some();\n *678│ // a local controller has driven_by=None so that WHO datum undercounts it).\n 679│ // [impl->REQ-GOSSIP-ADAPTER-PROJECTS]\n 680│ let adapter = info.as_ref().and_then(|i| i.adapter.clone());\n 681│ let controlled = info.as_ref().is_some_and(|i| i.controlled);\n │...\n 1078│/// The controlling node to gossip on an Instance (#3, REQ-GOSSIP-CONTROLLED-ANY).\n*1079│/// A REMOTE controller keeps its own `driven_by` origin. A LOCAL controller (the\n*1080│/// separate `controlled` flag, with `driven_by` = None per KH 7.15) is driven from\n 1081│/// THIS node, so it gossips `self_node`. An undriven endpoint gossips `None`. Pure\n 1082│/// over its inputs so the any-controller mapping is unit-tested.\n 1083│// [impl->REQ-GOSSIP-CONTROLLED-ANY]\n 1084│fn gossip_controller_node(\n*1085│ driven_by: Option<&str>,\n 1086│ controlled: bool,\n 1087│ self_node: &str,\n 1088│) -> Option {\n*1089│ match driven_by {\n 1090│ Some(remote) => Some(remote.to_string()),\n 1091│ None if controlled => Some(self_node.to_string()),\n 1092│ None => None,\n │...\n 1496│ // [unit->REQ-GOSSIP-CONTROLLED-ANY] bug #3: a locally-controlled endpoint\n*1497│ // (driven_by = None per KH 7.15, `controlled` = true) gossips THIS node as its\n 1498│ // controller so a remote viewer sees CONTROLLED, not \"ready to control\"; a\n 1499│ // remote controller keeps its own origin; an undriven endpoint gossips None.\n 1500│ #[test]\n 1501│ fn gossip_controller_node_covers_any_controller() {\n*1502│ // Local controller: driven_by None + controlled → this node (the fix).\n 1503│ assert_eq!(\n 1504│ gossip_controller_node(None, true, \"selfhex\"),\n 1505│ Some(\"selfhex\".to_string()),\n │...\n 1507│ );\n*1508│ // Remote controller: keep the remote origin (driven_by wins).\n 1509│ assert_eq!(\n 1510│ gossip_controller_node(Some(\"remotehex\"), true, \"selfhex\"),\n 1511│ Some(\"remotehex\".to_string())"},"isError":false,"timestamp":1790029745816}}
{"type":"message","id":"b7c2cf6e","parentId":"06ab9505","timestamp":"2026-09-21T22:29:05.840Z","message":{"role":"toolResult","toolCallId":"call_4BVDZdFMlS8cR9CCfPfKgqaa|fc_0c7d22595484f800016ab1afb1b1c487d2b4eb66a998a3cd8a","toolName":"grep","content":[{"type":"text","text":"# crates/spt/tests/\n## webserve_attachment_e2e.rs\n 16|//!\n*17|//! ## The arms (one `#[test]`, sequential — `SPT_HOME` is process-global)\n 18|//!\n 19|//! send with an attachment → the ATTACHED line names the URL · fetch it back\n 20|//! byte-equal · the source EDITED after the send does not change what is served\n...\n 45|/// suite test talking to the box's live daemon.\n*46|/// (2) `SPT_TEST_EPHEMERAL_ADVISORY_PORTS=1` does NOT fix that: it moves the\n 47|/// listener but not the minted URL, because `serveverb::node_and_port` reads\n 48|/// the port from config and never asks what was bound (releases#282).\n 49|/// (3) A FIXED private port then failed differently and worse: this rig\n 50|/// autostarts a daemon and never stopped it, so the NEXT run was answered by\n*51|/// the PREVIOUS run's daemon — same port, different `SPT_HOME`. The registry\n 52|/// showed the entry and the surface 404'd, which is exactly the pair of\n 53|/// symptoms a stale listener produces. Hence a per-run port AND the teardown\n 54|/// below: leaving a daemon behind is what made a fixed port unsafe.\n...\n 97| .args(args)\n*98| .env(\"SPT_HOME\", home)\n 99| // A PRIVATE DOCS PORT, and this is not tidiness. The daemon this rig\n 100| // autostarts otherwise binds the box's standing advisory port 5474 —\n 101| // which the LIVE FLEET daemon already owns — so the URL the attachment\n...\n 107| // `serveverb::node_and_port` mints the port from `DaemonConfig`/\n*108| // `SPT_DOCS_PORT` and never asks what the listener actually bound. So an\n 109| // ephemeral daemon still advertises 5474. Pinning ONE port for both\n 110| // sides is what makes the minted URL and the bound listener the same\n 111| // number. (Measured: with the ephemeral switch alone the URL still read\n...\n 120| // IR-78, and the reason this rig reds in GOLDEN while it is green here:\n*121| // `golden.yml` sets `SPT_TEST_EPHEMERAL_ADVISORY_PORTS=1` at JOB scope,\n 122| // and `resolve_daemon_docs_port` answers 0 when that flag is set —\n*123| // BEFORE it consults the `SPT_DOCS_PORT` override this rig pins. The\n 124| // autostarted daemon would then bind an ephemeral port while the port\n 125| // above is minted into every URL, so ARM 2 fetches a listener that does\n 126| // not exist. The daemon inherits this env through `spawn_detached`, so\n 127| // removing it HERE is what keeps the two numbers the same one.\n*128| .env_remove(\"SPT_TEST_EPHEMERAL_ADVISORY_PORTS\");\n 129| match stdin {\n 130| Some(body) => {\n 131| use std::io::Write;\n...\n 144|///\n*145|/// The URL side of this rig is minted from `SPT_DOCS_PORT`; this reads the\n 146|/// LISTENER side. Asserting they are the same number is what turns releases#282\n 147|/// from a defect that reappears as an unexplained 404 into one line that names\n 148|/// itself — a fetch failure and a port disagreement look identical from ARM 2.\n...\n 318|\n*319| // The URL above was minted from `SPT_DOCS_PORT`. Prove the daemon BOUND that\n 320| // same number before any arm fetches it, so releases#282 (or a stray\n 321| // ephemeral-ports flag in the job env) fails HERE, naming itself, instead of\n 322| // surfacing as an unexplained 404 two arms later.\n...\n 583| // does that on its own. This arm is about the disk: without a reaper on the\n*584| // daemon's pulse, `$SPT_HOME/serve/snapshots/` grows forever and the entry\n 585| // never leaves the registry. The REQ promises both, deleted together, with\n 586| // the count logged.\n 587| //\n## dummy_harness_e2e.rs\n 3|//! REAL spt-hosted bringup path end-to-end —\n*4|//! `spt endpoint start` → `launch_harness_brokered_in` → broker PTY → `spt rc` attach\n 5|//! — against a REAL detached `spt daemon run`, NOT an in-proc `reconcile_once` and\n 6|//! NOT a mock that exits immediately.\n 7|//!\n...\n 14|//! Asserts: `endpoint create` + `endpoint start` bring the dummy up, its perch goes ONLINE, the\n*15|//! PTY child stays alive (heartbeating), and `spt rc ` attaches and receives the\n 16|//! live heartbeat output. Bounded; all spawned pids reaped scoped (never\n 17|//! machine-wide — shared runner).\n 18|\n...\n 29|\n*30|// Both tests in this file set the PROCESS-GLOBAL env var SPT_HOME then do in-proc\n 31|// reads of it (perch::spt_home / adapters_dir, registry::register, psychebin\n 32|// fs::copy staging). One file = one test binary → the two tests otherwise run on\n 33|// parallel threads and their set_var/reads race (register lands in the wrong home\n...\n 36|// isolated-home pattern of contract_e2e.rs:26 / gateway_e2e.rs:35. Child procs\n*37|// already inherit the right home via explicit `.env(\"SPT_HOME\", …)`; only the\n 38|// in-proc reads leak, so serializing the two bodies is sufficient.\n 39|static E2E_LOCK: Mutex<()> = Mutex::new(());\n 40|\n...\n 76|fn endpoint_run_brings_up_a_long_lived_dummy_harness_and_rc_attaches() {\n*77| // Serialize against the sister test — shared process-global SPT_HOME.\n 78| let _serial = E2E_LOCK.lock().unwrap_or_else(|e| e.into_inner());\n*79| // ── (1) Isolated SPT_HOME. NET-ENABLED (the daemon self-initializes a real node\n*80| // identity): `spt rc` attaches over a broker-minted LOOPBACK conn that surfaces\n 81| // as net-stream events, so it requires a net-bound broker — a net-less broker\n 82| // refuses the loopback dial (\"net disabled\"). Unlike the livehost/reconcile\n 83| // tests (which only inspect perch state), the rc-attach path needs net up. ──\n 84| let home = tempfile::tempdir().unwrap();\n*85| std::env::set_var(\"SPT_HOME\", home.path());\n 86|\n 87| let spt_bin = PathBuf::from(env!(\"CARGO_BIN_EXE_spt\"));\n 88| let exe_suffix = spt_bin\n...\n 138| .args([\"daemon\", \"run\"])\n*139| .env(\"SPT_HOME\", home.path())\n 140| // Rig daemon: the advisory well-known ports belong to this box's resident\n 141| // fleet, never to a test tree (REQ-TEST-DAEMON-EPHEMERAL-ADVISORY-PORTS).\n 142| .env(\n...\n 171| .args([\"endpoint\", \"start\", id])\n*172| .env(\"SPT_HOME\", home.path());\n 173| common::output_bounded(cmd, Duration::from_secs(45))\n 174| };\n 175|\n...\n 209| .args([\"rc\", id])\n*210| .env(\"SPT_HOME\", home.path())\n 211| // This rig's attach-CONNECTS proof reads PUMP_IPC_READER off rc's\n 212| // stderr, which is now SILENT by default — a client must not write\n 213| // diagnostics into a terminal it owns (REQ-RC-DISPLAY-SOLE-WRITER).\n...\n 219| .spawn()\n*220| .expect(\"spawn spt rc \");\n 221| let _rc_stdin = rc.stdin.take(); // hold the write end open for the attach window\n 222| let mut rc_out = rc.stdout.take().unwrap();\n 223| let (tx, rx) = std::sync::mpsc::channel::();\n...\n 275| let mut cmd = Command::new(&spt_bin);\n*276| cmd.no_window().args([\"daemon\", \"stop\"]).env(\"SPT_HOME\", home.path());\n 277| common::output_bounded(cmd, Duration::from_secs(20))\n 278| };\n 279| kill_pid(brain_pid);\n...\n 304| let _ = rc_connected;\n*305| // KEYSTONE GATE (v0.12.1 Wave 2 L0): a clean `spt rc` attach to this LIVE,\n 306| // ALREADY-PRODUCING (non-empty OutputLog ring) endpoint-run harness DELIVERS its\n 307| // `[session.self]` stdout — the operator's \"attach shows no output\" is fixed. This\n 308| // is the exact case the v0.12.0 mock suite + the loopback E2Es lacked (they only\n...\n 315| rc_saw_tick,\n*316| \"`spt rc ` must RECEIVE the live endpoint-run harness's DUMMY_HARNESS_TICK \\\n 317| output (got {} bytes) — the broker must forward an already-producing harness's \\\n 318| PTY to the attach without the replay-vs-forward deadlock.\\n=== rc stderr ===\\n{rc_stderr}\\\n 319| \\n{brain_stderr}\",\n...\n 343|//\n*344|// Same isolated-SPT_HOME + dummyharness fixture + scoped full-tree reap as the\n 345|// sister test above; the ONLY behavioural difference is dropping `--start` so the\n 346|// SAME process runs both bringup AND attach (the bug surface), captured bounded.\n 347|// [int->REQ-HAZARD-RC-ATTACH-ONLINE-RACE]\n...\n 354|fn endpoint_run_attach_awaits_online_before_attaching() {\n*355| // Serialize against the sister test — shared process-global SPT_HOME.\n 356| let _serial = E2E_LOCK.lock().unwrap_or_else(|e| e.into_inner());\n*357| // ── (1) Isolated, NET-ENABLED SPT_HOME (rc attach rides a broker loopback\n 358| // conn that needs a net-bound broker — identical to the sister test). ──\n 359| let home = tempfile::tempdir().unwrap();\n*360| std::env::set_var(\"SPT_HOME\", home.path());\n 361|\n 362| let spt_bin = PathBuf::from(env!(\"CARGO_BIN_EXE_spt\"));\n 363| let exe_suffix = spt_bin\n...\n 407| .args([\"daemon\", \"run\"])\n*408| .env(\"SPT_HOME\", home.path())\n 409| // Rig daemon: the advisory well-known ports belong to this box's resident\n 410| // fleet, never to a test tree (REQ-TEST-DAEMON-EPHEMERAL-ADVISORY-PORTS).\n 411| .env(\n\n# docs-site/src/\n## SUMMARY.md\n 21| - [Knocking: asking to be let in](networking/knocking.md)\n*22| - [Monics and the trust warning](networking/monics.md)\n 23|- [Serving resources](serving/overview.md)\n 24| - [Cross-node serving](serving/cross-node.md)\n 25| - [Attachments and `spt fetch`](serving/attachments.md)\n## changelog.md\n 25|\n*26|- Attached sessions reached through `spt rc` no longer pause during pairing or\n 27| repeated router discovery on Windows. Automatic UPnP, NAT-PMP and PCP router\n 28| mappings are disabled; relay-assisted connections and NAT hole-punching remain\n 29| available. Updating only the background service is insufficient: the running\n...\n 39| or installed directory remains the fallback.\n*40|- Active `spt rc` sessions resume input after `spt node refresh` or an update's\n 41| service restart instead of freezing.\n 42|\n 43|## [0.70.0] - 2026-09-13\n...\n 47|- Quoting an absolute or home-relative filepath while controlling an agent through\n*48| remote `spt rc` can now offer that agent a fetch command for the live file on the\n 49| controller node. Access is limited to that agent for up to 24 hours; repeated reports\n 50| neither extend access nor repeat the notice. Missing files and local or read-only\n 51| input stay quiet. No adapter changes are needed.\n...\n 64|\n*65|- `Ctrl+B`, then `d`, now detaches a read-only `spt rc --view` session without\n 66| stopping the agent or disconnecting its controller.\n 67|\n 68|- Older console clients now receive guidance to reopen or update when a known\n...\n 227| declared; the environment a supervised process is started with\n*228| (`SPT_SERVICE_OPTION`, `SPT_SERVICE_DIR`, `SPT_BIN`, `SPT_HOME`); the\n 229| `stop-requested`, `status-advisory` and `startup.capture` files in its\n 230| runtime directory; how a cooperative stop, an update hold and a startup\n 231| fault behave; and what `spt adapter service list` and `spt adapter service\n...\n 507| adapters failed and the finish then refused, the command reported the\n*508| refusal. Scripts branching on `3` can now trust it to mean \"nothing changed\".\n 509|- An access rule about an endpoint is now honoured the same way by every local\n 510| delivery verb. `spt ring` used to judge such a rule against whatever\n 511| `--from` label the caller typed, and notifications against a display label\n...\n 762|- A briefing whose pending state cannot be read is no longer treated as absent.\n*763|- A trust warning now arrives on the message it is about. Previously it came as\n 764| a separate message that had to be matched to the one it described.\n 765|\n 766|### Internal\n...\n 810| and could exhaust the budget before a code was ever entered.\n*811|- `spt rc` no longer refuses to attach to an endpoint that has just been\n 812| released. Previously the refusal could persist until the daemon next caught\n 813| up with that endpoint's state.\n 814|\n...\n 1055|\n*1056|- **`spt rc engine-room` brings the room back up after it has been shut down.**\n 1057| Quitting the harness inside the engine room's session leaves the endpoint\n*1058| cleanly offline — and, until now, unreachable: the next `spt rc engine-room`\n 1059| asked for a code, then answered *\"offline — nothing to attach to\"* for the\n 1060| same command that had brought the room up minutes earlier. With a code in\n 1061| hand the engine room is now brought up from that state, which is exactly what\n 1062| its bring-up is for. Every other endpoint's offline answer is unchanged.\n*1063|- **Refusals point at the engine room's real door.** When `spt rc` does refuse\n*1064| an engine-room attach, it now names `spt rc engine-room` — which asks for a\n 1065| member or admin code — rather than a bring-up verb the engine room\n 1066| deliberately refuses.\n 1067|- **`spt knock` no longer reports success for a target it could not reach.**\n...\n 1107|\n*1108|The trust warning follows the same shift: it joins incoming messages from\n 1109|endpoints with no matching monic held for them, rather than ones never\n 1110|\"classified\".\n 1111|\n...\n 1121| reporting success.\n*1122|- `spt endpoint --help` describes what `monic` and `trust-warning` actually do.\n 1123|- Fixed a daemon that could consume whole processor cores indefinitely.\n 1124| Previously, each change to a machine's network connection left behind work\n 1125| that never finished, and the cost accumulated over days until several cores\n...\n 1309| classified wherever that agent runs next.\n*1310|- A **trust warning** now accompanies a message whose sender was admitted by an\n 1311| access rule while the recipient holds no note about them. It states that the\n 1312| sender arrived through a rule rather than through anything the recipient\n 1313| decided, and advises care with secrets and state-changing requests until they\n*1314| decide something. `spt endpoint trust-warning` shows the caution and can\n 1315| reword it: the wording is configurable, the fact of an unclassified sender is\n 1316| not.\n 1317|- Access rules can be written node-wide — `allow`, `deny` and `remove` now\n...\n 1396| engine room requires elevation; agents cannot run it at all.\n*1397|- Bare `spt rc engine-room` now opens an interactive code prompt (Esc cancels);\n 1398| `--code` remains for direct entry, with the caveat that command-line\n 1399| arguments are readable by other processes while the code is still valid.\n 1400|- `spt endpoint access []` is a roster: who has rules about the\n...\n 1438|- Remote control now distinguishes watching from driving. A rule can admit a\n*1439| viewer and still refuse control or a takeover, because `spt rc` says which of\n 1440| the two it is asking for.\n 1441|- Endpoints you may not reach are no longer resolved or advertised to you, and\n 1442| the resources an endpoint lists are filtered to what the asking viewer is\n...\n 1451|- Each node now has one reserved **engine room** endpoint: a seat that governs\n*1452| the machine's access rules. Sitting down is `spt rc --code\n 1453| `, at the machine, with a current member or admin code for the node's\n 1454| home subnet. A wrong code is refused without saying which key would have\n 1455| worked, wrong codes throttle with a doubling delay, and past the third\n...\n 1961|- Attached sessions no longer show corrupted output while connecting. Startup\n*1962| diagnostics are no longer written into the screen `spt rc` owns — previously a\n 1963| line such as \"Reconnecting to local daemon...\" could appear spliced together\n 1964| with internal startup text.\n 1965|\n\n## cli/\n### reference.md\n 110| installed one and, when newer, fetch the release archive, verify it against the\n*111| declared signing key if any (else trusting HTTPS + GitHub), and re-register. With\n 112| no name, sweeps every gh_release adapter; with a name, updates just that one\n 113| use Set or clear the active-profile pointer — the default [:profile] a\n 114| harness session binds to when no --adapter is given. spt adapter use\n...\n 398|\"gh_release\"` adapter's latest release version against the installed one and, when newer, fetch the\n*399|release archive, verify it against the declared signing key if any (else trusting HTTPS + GitHub),\n 400|and re-register. With no name, sweeps every gh_release adapter; with a name, updates just that one\n 401|\n 402|Usage: spt adapter update [OPTIONS] [NAME]\n...\n 1360|\n*1361|## spt rc\n 1362|\n 1363|```text\n 1364|Attach a local terminal to a broker-held endpoint PTY.\n...\n 1370|\n*1371|Usage: spt rc [OPTIONS] \n 1372|\n 1373|Arguments:\n 1374| \n...\n 1525| join Pair this machine into an existing subnet (guided)\n*1526| leave Exit a subnet: drop its membership and trust material from this node\n*1527| prune Remove a dead node identity's trust rows (and registry rows)\n 1528| revoke Revoke node(s) fleet-wide and rotate the subnet seed\n 1529| detach Stop serving a held subnet (the daemon keeps running)\n 1530| attach Resume serving a detached subnet\n...\n 1680|```text\n*1681|Exit a subnet: drop its membership and trust material from this node.\n 1682|\n*1683|Removes the subnet's seed, its trust rows, its serve-state, and its registry snapshot here. Gated\n*1684|behind OS elevation (membership exit destroys trust material). The remaining members still hold the\n 1685|old seed — rotate it there if this machine should not rejoin.\n 1686|\n 1687|Usage: spt subnet leave [OPTIONS] \n...\n 1705|```text\n*1706|Remove a dead node identity's trust rows (and registry rows).\n 1707|\n 1708|The cleanup verb for a machine that re-paired under a new identity or is gone for good: its stale\n*1709|trust rows cost a dial every pump tick. Takes a full pubkey hex, an unambiguous prefix, or a node\n*1710|label. Gated behind OS elevation (trust mutation).\n 1711|\n 1712|Usage: spt subnet prune [OPTIONS] \n 1713|\n...\n 2938| session\n*2939| trust-warning A hidden warning which joins incoming messages from unknown endpoints. Senders'\n*2940| endpoint IDs with a matching monic omit the trust warning\n 2941| help Print this message or the help of the given subcommand(s)\n 2942|\n 2943|Options:\n...\n 3189|Re-activates the existing seat (state's already there — no fresh spawn), resurfaces undismissed\n*3190|notifications, and requests an immediate context freshness pull from trusted peers. Accepts a\n 3191|qualified id@node for an instance on a paired peer. The siblings are start (a NEW session on\n 3192|an endpoint that is offline) and resume (its latest session back).\n 3193|\n...\n 3326|Deletes the perch tree (including its nested companion/worker perches and shells), the registry\n*3327|address, the endpoint's context branches, and its node-local trust rows. Local only. Offline-only:\n 3328|refuses while the endpoint is online — stop it first, or pass --force to stop-then-purge.\n 3329|Irreversible; confirms interactively unless --yes.\n 3330|\n...\n 3982|\n*3983|### spt endpoint trust-warning\n 3984|\n 3985|```text\n 3986|A hidden warning which joins incoming messages from unknown endpoints. Senders' endpoint IDs with a\n*3987|matching monic omit the trust warning.\n 3988|\n 3989|When a peer gets through an access rule and this endpoint holds no monic whose sender trigger\n 3990|matches them, spt delivers a system-authored warning alongside their message. This verb shows that\n*3991|text and — with elevation — replaces the ADVISORY part of it with your own. Bare trust-warning\n 3992|shows it.\n 3993|\n*3994|Usage: spt endpoint trust-warning [OPTIONS] [COMMAND]\n 3995|\n 3996|Commands:\n 3997| show Show the warning this endpoint would be given, as it would read\n\n## concepts/\n### overview.md\n 136|\n*137|Releases are signed (Ed25519, two-key trust anchor baked into every binary)\n 138|and propagate peer-to-peer: one machine fetches a release, its peers verify\n 139|and stage it from each other. Updates apply with the broker/brain split, so\n 140|no endpoint process terminates or suspends during a self-update — the\n\n## harness-contract/\n### api.md\n 136|> session id can present it and revive that perch. Treat session ids as\n*137|> secrets: never log or publish them. (The local surface already trusts local\n 138|> callers — `--parent-pid` is an override — so this is a contract\n 139|> qualification for adapter authors, not a sandbox.)\n 140|\n### install-on-demand.md\n 43| # current shell may not see the PATH update yet:\n*44| SPT=\"${SPT_HOME:-$HOME/.spt-core}/bin/spt\"\n 45|else\n 46| SPT=\"spt\"\n 47|fi\n...\n 100|source-free and **versioned by tag** (`--tag`, default the latest release), and\n*101|first-acquisition trusts gh's authenticated TLS + GitHub exactly like the\n 102|bootstrap's first binary fetch. A development **monorepo stays a monorepo**: your\n 103|release CI packs the archive (`tar -czf adapter.spt manifest.toml strings/ bin/…`)\n 104|and uploads it as a release asset, so the adapter ships straight from your\n...\n 194|\n*195|First fetch trusts gh's authenticated TLS + the private channel's access\n 196|control (check the download against the release's `SHA256SUMS` for a belt on\n 197|the braces). From then on, `spt update` performs full Ed25519 signature\n*198|verification against the two-key trust anchor embedded in every binary — so\n 199|the bootstrap is the strong link only once.\n### integration-checklist.md\n 94|| **`[session.resume]` template** (spt-hosted) | The **native-resume** sibling of `[session.self]`: spt-core picks it over `[session.self]` when a bringup carries a prior session (`spt endpoint resume`, `spt go` on an offline endpoint, or the picker's *Resume from history*). Declare your harness's native-resume verb (e.g. `claude -r {session_id}`) — **skip it and a resume re-runs the fresh command → a blank transcript.** spt-core lands the PTY in the session's recorded project cwd (a harness resolves...\n*95|| **`[message-idle-translation-binary]`** (spt-hosted) | A lifecycle-managed `stdin→stdout` JSON-lines binary that turns inbound `` messages into keystroke-commands spt-core applies to the PTY **atomically** (coexists with a live `spt rc` controller). The agnostic way to deliver messages into an **idle** spt-hosted session; busy delivery stays your `[inject]` hook path. Declare it with a `command` (program + args; adapter-static `{adapter_dir}`/`{adapter_name}` subst only — **no** session keys...\n 96|| **`api now-signal --session `** (inject its stdout at every turn boundary) | The one situational-awareness funnel: peers named in the turn, monics fired, shell status, last messages, on/offline edges, and the **only** confirmation channel for shortform dispatches and `;;` seal mints. Delta-only per session, so a poll with nothing new prints nothing and a quiet turn costs zero context. Tune it from [`[io.now_signal]`](manifest.md#ionow_signal--standing-now-signal-tuning) with `--spec-manifest`...\n 97|| **`api state busy\\|idle --payload-stdin`** (the turn's text) | Feeds the [IO funnel](../shells/frames.md#io--the-sessions-io-events-durable) — `USER_INPUT` / `AGENT_OUTPUT` events shell binaries and (from releases#234) other consumers read. Purely additive: the same call with no payload behaves exactly as before. Report every payload span **exactly once across the turn** — core does not deduplicate. Add `--mid` to report a MID-TURN span of agent output on the `busy` arm (still an `AGENT_OUTPUT` eve...\n 98|\n### manifest.md\n 91|\n*92|**Served output.** Core creates `$SPT_HOME/adapters//web/` before\n 93|committing activation, even if the daemon is stopped. Write only intended\n 94|served output there; core never exposes the adapter's install tree, manifest,\n 95|records, or strings on its behalf. The daemon reconciles one `dir` entry per\n...\n 510|the inbound `` message feed and reads back keystroke-commands, which it\n*511|applies to the broker-held PTY **atomically** — a live `spt rc` controller's input\n 512|is buffered during the emitted sequence and flushed after, so idle injection\n 513|coexists with an attached operator (spt-core owns every PTY write). **Idle delivery\n 514|only** — busy / mid-turn delivery stays your `[inject]` hook path.\n...\n 541|- **stdout** (binary → spt-core, one per line): `{\"key\":\"ctrl+s\"}` · `{\"delay_ms\":50}` · `{\"text\":\"\"}` · `{\"key\":\"enter\"}` · `{\"commit\":true}`, … (extensible vocabulary).\n*542|- **`{\"commit\":true}` is the mandatory sequence terminator — and you MUST send it for EVERY `{\"type\":\"event\"}`.** While your emitted sequence is in flight, spt-core buffers a live `spt rc` controller's keystrokes (the *inject floor*) and applies your commands to the PTY atomically; `{\"commit\":true}` — emitted as the **last** record — releases that floor and flushes the buffered controller input *after* your sequence. The submit keystroke is **not** the terminator: `{\"key\":\"enter\"}` (or a trailing `...\n 543|- **Missed commit → the sequence is tolerated, not fatal.** If no `{\"commit\":true}` arrives within the **commit deadline (5 s)**, spt-core still flushes the buffered operator input (never stranded) and re-spools that one message once so it is not lost — but it does **NOT** terminate a healthy binary. A single miss is tolerated; the binary is preserved and the next event delivers through it as normal. Only after **3 consecutive** missed commits (a genuinely wedged binary), or a real binary death, does...\n 544|- Unknown fields are **not** rejected here — a newer adapter declaring a future key against an older spt-core parses fine (the key is ignored), so the contract degrades gracefully.\n 545|- `{\"text\":…}` is applied to the PTY **verbatim** — bytes are typed exactly, with **no** control-character stripping. A trailing `\\r` *inside* a text payload (`{\"text\":\"…\\r\"}`) therefore **submits**, identical to a following `{\"key\":\"enter\"}` (`enter`→`\\r`). Submit either way; just don't do both. Corollary: neutralize any CR/LF *inside* the message body before the trailing submit, or an embedded newline fires the input early.\n...\n 579| identically once running. The key is required rather than defaulted because\n*580| the choice decides whether a least-trusted third-party binary rises with the\n 581| daemon itself — an adapter author says so explicitly.\n 582|- **Registration reports what it did, and never fails over the service.** After\n 583| a successful `spt adapter add` or `spt adapter update`, the CLI asks the daemon\n...\n 606| | `SPT_BIN` | absolute path to the `spt` executable to call (see below) |\n*607| | `SPT_HOME` | the state root that `spt` must be run against |\n 608|\n 609| The option is the raw string an operator types, not a path encoding. The\n 610| runtime dir is per-option, so two options of one adapter never share a\n...\n 618| service calls is never a different build than the supervisor that owns it.\n*619| `SPT_HOME` is likewise pinned to the home the daemon resolved rather than left\n 620| for the child to re-derive from a per-account platform default. Both are\n 621| absolute. `SPT_BIN` is the one variable here that can be **absent** — if core\n 622| cannot read its own image path it says nothing rather than handing out a\n...\n 644| reconcile, hold, kill or adoption reads it — because core deciding on it would\n*645| put a least-trusted binary's self-report in the control path, and a service\n 646| that stopped updating it would silently become whatever it last claimed. The\n 647| read is **bounded** (the first line, capped) and an unreadable file is simply\n 648| no advisory: nothing here ever requires reading a file the service holds an\n...\n 832|**Trust is opt-in signing, fail-closed.** Declare no `signing_key` and the\n*833|fetched `.spt` is trusted on HTTPS + GitHub, exactly like first acquisition.\n 834|Declare a `signing_key` and the fetched `.spt` is verified against a **detached\n 835|signature** you publish as a sibling release asset named `.sig` — a\n 836|lowercase-hex Ed25519 signature over the raw archive bytes. Verification runs\n\n## instances/\n### overview.md\n 92|\"you may suspend my agent\" or \"you may transfer files\" would hand over\n*93|mind-cloning to anyone trusted with either.\n 94|\n 95|**A `FORK` grant on its own cannot be exercised.** Listing an endpoint's\n 96|surfaces closes every surface not listed, so a `FORK`-only grant denies\n\n## lifecycle/\n### overview.md\n 22| Between the session starting and that bind the endpoint is **unbound**: a\n*23| live, attachable session — `spt rc ` connects to it to watch or clear a\n 24| bringup prompt *before* bind — that is not yet message-addressable (a `send`\n 25| waits for online). The picker and `spt endpoint list` show it as a\n 26| distinct **unbound** row — see the status-square legend below — not a true\n...\n 79|| blue ■ | online · controlled | someone is driving it (the detail pane names the controlling node) |\n*80|| red ■ | online · unbound | a live session not yet message-bound — attachable with `spt rc`, needs attention |\n 81|| amber ▢ | online · harness-only | visible but has no control seat, so it cannot be controlled |\n 82|| gray ■ | suspended | cold but its machine is up — wakeable |\n 83|| gray ▢ | offline | the machine is down (only ever seen for remote endpoints) |\n\n## messaging/\n### overview.md\n 161| construction. A receiver-composed attribute can carry newlines — the\n*162| `trust-warning` block runs to several — and the envelope is line-framed, so an\n 163| unencoded newline would split one delivery into several lines of which most\n 164| are not envelopes.\n 165|- Decode only the **extracted body substring** after parsing the envelope\n...\n 179|alarm's times — not one of the receiver-composed attributes\n*180|([`trust-warning`, `mnemonics-json`](../networking/monics.md)) your node\n 181|strips off inbound bodies before attaching its own. The seal attribute rides\n 182|**end-to-end intact** through that strip: it is the sender's own evidence\n 183|citation, and stripping it would delete the citation at every ingress.\n...\n 185|**For adapter authors: this attribute must be surfaced** — the same obligation\n*186|`trust-warning` carries. A pipeline that re-renders a delivery has to carry\n 187|the token through and show it, or the receiving agent loses the pointer to\n 188|evidence the sender deliberately attached. And the mirror rule: the attribute\n 189|is a **citation, never an authorization subject**. Nothing may branch\n...\n 205| only closed list in this contract is the receiver-composed **strip** class\n*206| (`trust-warning`, `mnemonics-json`), and it is a strip list, not a render\n 207| list; everything else rides.\n 208|- **\"Consume\" means the attribute's distinction is re-expressed, not merely\n 209| read.** A pipeline consumes an attribute when its handling puts the value's\n### wax-seal.md\n 124|Nothing is parked waiting for a controller to appear; have the operator attach\n*125|(`spt rc `) and ask again.\n 126|\n 127|## The FIDO2 ceremony\n 128|\n...\n 167|stay daemon-side. The offer rides the existing ceremony records as additive\n*168|fields, so an older `spt rc` simply renders the plain TOTP overlay — nothing\n 169|hangs, nothing to update before the next mint.\n 170|\n 171|### `E` — enroll and seal in one ceremony\n\n## networking/\n### engine-room-setup.md\n 36|```text\n*37|spt rc engine-room\n 38|```\n 39|\n 40|A bare attach opens an interactive prompt for the anchor subnet's current\n### knocking.md\n 328|unclassified peer, and their first message carries the\n*329|[trust warning](monics.md#the-trust-warning).\n 330|\n 331|## Refusals you can predict\n 332|\n### monics.md\n*1|# Monics and the trust warning\n 2|\n 3|A **monic** is a **reactionary string**: a set of **triggers** plus a **body**\n 4|that is revealed when something in your session matches one of them. A monic is\n...\n 7|\n*8|Classifying a peer is still the headline use, and it is what the **trust\n 9|warning** reads: an access rule says a peer **may speak**; a monic that matches\n 10|their id says what you have concluded about them. Those are different questions,\n*11|and the gap between them is what the trust warning exists to close.\n 12|\n 13|```text\n 14|spt endpoint monic # what do I hold?\n...\n 162|\n*163|The one gate in this family is on the trust warning's **override text**, below,\n 164|and for a reason that does not apply to a classification.\n 165|\n*166|## The trust warning\n 167|\n 168|\n 169|\n 170|When a message reaches you because an **access entry** admitted its sender, and\n*171|you hold **no monic** about that sender, spt composes a system-authored trust\n 172|warning and delivers it alongside the message:\n 173|\n 174|```text\n...\n 213|The caution and the message it is about reach you in **one arrival**. The warning\n*214|rides that message's envelope as a `trust-warning` attribute, composed by **the\n 215|receiving node** — yours — exactly as a matched monic's `mnemonics-json` is:\n 216|\n 217|```text\n*218|\n 219|```\n 220|\n 221|An attribute is not the body, so the sender authors this text in neither design:\n...\n 230|> the same, though, and the difference is the point: a dropped monic costs you a\n*231|> note you wrote, while a **dropped trust warning is a security caution that\n 232|> silently did not happen**. For this attribute, being ignored *is* the failure —\n 233|> so \"unknown attributes are safely ignored\" is exactly the behaviour that must\n 234|> not apply here.\n...\n 245|**Anything a sender writes into this attribute is inert.** A typed envelope rides\n*246|verbatim from the wire to your context, so a peer *can* put a `trust-warning`\n 247|into one and hand it over. Every point where a sender-supplied body enters your\n 248|node strips the receiver-composed attributes before your own are attached, so\n 249|what you read is your node's by construction rather than by the sender's\n...\n 260||---|---|\n*261|| **same-node** | inside your node's own trust unit |\n 262|| **a reply** | correlated to your own outbound — traffic you invited |\n 263|| **posture-open** | no entry named this peer; the endpoint simply is not refusing anyone |\n 264|\n...\n 355|```text\n*356|spt endpoint trust-warning # show what this endpoint is told\n*357|spt endpoint trust-warning set \"…\" # replace the advisory (elevated)\n*358|spt endpoint trust-warning reset # back to the default (elevated)\n 359|```\n 360|\n 361|**The scope is partial, by ratification.** Custom text replaces the **advisory\n...\n 428|adapter's own frame level, never inside the peer's rendered body) — the same\n*429|reasoning that gives the trust warning a system author no peer can legally\n 430|write under.\n 431|\n 432|> **Forward guidance for adapter authors:** the envelope attribute is the\n...\n 446|reads nothing and gets no attribute. An unreadable record rides nothing, the\n*447|same fail-safe reading the trust warning takes; the two never disagree, so you\n 448|can never be warned about a stranger whose monic you were handed in the same\n 449|envelope.\n 450|\n...\n 480|**Matching a message is not the same as classifying its sender.** Only a\n*481|`sender` trigger answers the trust warning's question. A `content` trigger can\n 482|ride you a monic on a message from someone you have never classified — and that\n 483|peer still draws the stranger warning, because you have not said anything about\n 484|*them*.\n...\n 490|traffic: a message whose sender could not be proven is re-stamped at the WAN\n*491|edge into a typed envelope, so that sender's monic does not ride. **The trust\n 492|warning still fires for them** — it is composed at that edge from the gate's\n 493|verdict — so what is lost is the note, never the caution.\n 494|\n### overview.md\n 33| wrong guess learns nothing. Both sides pin each other's node keys on\n*34| success (trust-on-first-use; key changes warn and never auto-apply).\n 35| Every member machine answers join attempts automatically — no arming step\n 36| on the existing fleet. *(two-phase join since v0.17.0)*\n 37|- **Elevation gates** — `subnet create` (reveals a fresh subnet's joining\n\n## reference/\n### install.md\n 7|authenticates with an account that can read it; there is nothing else to\n*8|trust on first fetch beyond gh's authenticated TLS.\n 9|\n 10|## Steps\n 11|\n...\n 62|Thereafter `spt update` performs full Ed25519 verification against the\n*63|[two-key trust anchor](../self-update/overview.md#the-trust-chain) embedded\n 64|in the binary — the update carrier is also gh, and the signature chain is\n 65|carrier-independent.\n 66|\n\n## self-update/\n### overview.md\n 3|spt-core keeps itself current without ever interrupting your agents, and\n*4|without trusting anything unsigned.\n 5|\n 6|## The invariant\n 7|\n...\n 12|\n*13|## The trust chain\n 14|\n 15|- Every release ships `SignedRelease` metadata: an Ed25519 signature over the\n 16| release's artifact digests.\n*17|- Every binary embeds the **two-key trusted set** — an active primary and a\n 18| never-used offline recovery key. Verification requires a valid signature\n*19| from a trusted key *and* a matching artifact digest; an unverified binary\n 20| never reaches the apply step.\n 21|- Losing the primary key is a non-event: the next release is signed with the\n*22| recovery key (already trusted by every deployed binary) and rotates in a\n 23| fresh primary.\n 24|- **Adapters sign their own content.** A `file_pull` adapter update is\n 25| verified against the adapter author's key from its manifest; a `delegated`\n*26| update is trusted only when the manifest attests the delegated updater\n 27| verifies its own content (`self_verifies`). spt-core's release keys never\n 28| vouch for adapter bytes.\n 29|\n\nShowing files 1-20 of 25+. Use skip=20 for the next page, or narrow paths/pattern.\n\n[Some lines truncated to 512 chars]"}],"details":{"scopePath":"crates/spt/tests/webserve_attachment_e2e.rs, crates/spt/tests/dummy_harness_e2e.rs, docs-site/src","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":125,"fileCount":20,"files":["crates/spt/tests/webserve_attachment_e2e.rs","crates/spt/tests/dummy_harness_e2e.rs","docs-site/src/SUMMARY.md","docs-site/src/changelog.md","docs-site/src/cli/reference.md","docs-site/src/concepts/overview.md","docs-site/src/harness-contract/api.md","docs-site/src/harness-contract/install-on-demand.md","docs-site/src/harness-contract/integration-checklist.md","docs-site/src/harness-contract/manifest.md","docs-site/src/instances/overview.md","docs-site/src/lifecycle/overview.md","docs-site/src/messaging/overview.md","docs-site/src/messaging/wax-seal.md","docs-site/src/networking/engine-room-setup.md","docs-site/src/networking/knocking.md","docs-site/src/networking/monics.md","docs-site/src/networking/overview.md","docs-site/src/reference/install.md","docs-site/src/self-update/overview.md"],"fileMatches":[{"path":"crates/spt/tests/webserve_attachment_e2e.rs","count":11},{"path":"crates/spt/tests/dummy_harness_e2e.rs","count":20},{"path":"docs-site/src/SUMMARY.md","count":1},{"path":"docs-site/src/changelog.md","count":20},{"path":"docs-site/src/cli/reference.md","count":20},{"path":"docs-site/src/concepts/overview.md","count":1},{"path":"docs-site/src/harness-contract/api.md","count":1},{"path":"docs-site/src/harness-contract/install-on-demand.md","count":4},{"path":"docs-site/src/harness-contract/integration-checklist.md","count":1},{"path":"docs-site/src/harness-contract/manifest.md","count":8},{"path":"docs-site/src/instances/overview.md","count":1},{"path":"docs-site/src/lifecycle/overview.md","count":2},{"path":"docs-site/src/messaging/overview.md","count":4},{"path":"docs-site/src/messaging/wax-seal.md","count":2},{"path":"docs-site/src/networking/engine-room-setup.md","count":1},{"path":"docs-site/src/networking/knocking.md","count":1},{"path":"docs-site/src/networking/monics.md","count":18},{"path":"docs-site/src/networking/overview.md","count":1},{"path":"docs-site/src/reference/install.md","count":2},{"path":"docs-site/src/self-update/overview.md","count":6}],"truncated":true,"fileLimitReached":20,"perFileLimitReached":20,"displayContent":"# crates/spt/tests/\n## webserve_attachment_e2e.rs\n 16│//!\n *17│//! ## The arms (one `#[test]`, sequential — `SPT_HOME` is process-global)\n 18│//!\n 19│//! send with an attachment → the ATTACHED line names the URL · fetch it back\n 20│//! byte-equal · the source EDITED after the send does not change what is served\n │...\n 45│/// suite test talking to the box's live daemon.\n *46│/// (2) `SPT_TEST_EPHEMERAL_ADVISORY_PORTS=1` does NOT fix that: it moves the\n 47│/// listener but not the minted URL, because `serveverb::node_and_port` reads\n 48│/// the port from config and never asks what was bound (releases#282).\n 49│/// (3) A FIXED private port then failed differently and worse: this rig\n 50│/// autostarts a daemon and never stopped it, so the NEXT run was answered by\n *51│/// the PREVIOUS run's daemon — same port, different `SPT_HOME`. The registry\n 52│/// showed the entry and the surface 404'd, which is exactly the pair of\n 53│/// symptoms a stale listener produces. Hence a per-run port AND the teardown\n 54│/// below: leaving a daemon behind is what made a fixed port unsafe.\n │...\n 97│ .args(args)\n *98│ .env(\"SPT_HOME\", home)\n 99│ // A PRIVATE DOCS PORT, and this is not tidiness. The daemon this rig\n 100│ // autostarts otherwise binds the box's standing advisory port 5474 —\n 101│ // which the LIVE FLEET daemon already owns — so the URL the attachment\n │...\n 107│ // `serveverb::node_and_port` mints the port from `DaemonConfig`/\n*108│ // `SPT_DOCS_PORT` and never asks what the listener actually bound. So an\n 109│ // ephemeral daemon still advertises 5474. Pinning ONE port for both\n 110│ // sides is what makes the minted URL and the bound listener the same\n 111│ // number. (Measured: with the ephemeral switch alone the URL still read\n │...\n 120│ // IR-78, and the reason this rig reds in GOLDEN while it is green here:\n*121│ // `golden.yml` sets `SPT_TEST_EPHEMERAL_ADVISORY_PORTS=1` at JOB scope,\n 122│ // and `resolve_daemon_docs_port` answers 0 when that flag is set —\n*123│ // BEFORE it consults the `SPT_DOCS_PORT` override this rig pins. The\n 124│ // autostarted daemon would then bind an ephemeral port while the port\n 125│ // above is minted into every URL, so ARM 2 fetches a listener that does\n 126│ // not exist. The daemon inherits this env through `spawn_detached`, so\n 127│ // removing it HERE is what keeps the two numbers the same one.\n*128│ .env_remove(\"SPT_TEST_EPHEMERAL_ADVISORY_PORTS\");\n 129│ match stdin {\n 130│ Some(body) => {\n 131│ use std::io::Write;\n │...\n 144│///\n*145│/// The URL side of this rig is minted from `SPT_DOCS_PORT`; this reads the\n 146│/// LISTENER side. Asserting they are the same number is what turns releases#282\n 147│/// from a defect that reappears as an unexplained 404 into one line that names\n 148│/// itself — a fetch failure and a port disagreement look identical from ARM 2.\n │...\n 318│\n*319│ // The URL above was minted from `SPT_DOCS_PORT`. Prove the daemon BOUND that\n 320│ // same number before any arm fetches it, so releases#282 (or a stray\n 321│ // ephemeral-ports flag in the job env) fails HERE, naming itself, instead of\n 322│ // surfacing as an unexplained 404 two arms later.\n │...\n 583│ // does that on its own. This arm is about the disk: without a reaper on the\n*584│ // daemon's pulse, `$SPT_HOME/serve/snapshots/` grows forever and the entry\n 585│ // never leaves the registry. The REQ promises both, deleted together, with\n 586│ // the count logged.\n 587│ //\n## dummy_harness_e2e.rs\n 3│//! REAL spt-hosted bringup path end-to-end —\n *4│//! `spt endpoint start` → `launch_harness_brokered_in` → broker PTY → `spt rc` attach\n 5│//! — against a REAL detached `spt daemon run`, NOT an in-proc `reconcile_once` and\n 6│//! NOT a mock that exits immediately.\n 7│//!\n │...\n 14│//! Asserts: `endpoint create` + `endpoint start` bring the dummy up, its perch goes ONLINE, the\n *15│//! PTY child stays alive (heartbeating), and `spt rc ` attaches and receives the\n 16│//! live heartbeat output. Bounded; all spawned pids reaped scoped (never\n 17│//! machine-wide — shared runner).\n 18│\n │...\n 29│\n *30│// Both tests in this file set the PROCESS-GLOBAL env var SPT_HOME then do in-proc\n 31│// reads of it (perch::spt_home / adapters_dir, registry::register, psychebin\n 32│// fs::copy staging). One file = one test binary → the two tests otherwise run on\n 33│// parallel threads and their set_var/reads race (register lands in the wrong home\n │...\n 36│// isolated-home pattern of contract_e2e.rs:26 / gateway_e2e.rs:35. Child procs\n *37│// already inherit the right home via explicit `.env(\"SPT_HOME\", …)`; only the\n 38│// in-proc reads leak, so serializing the two bodies is sufficient.\n 39│static E2E_LOCK: Mutex<()> = Mutex::new(());\n 40│\n │...\n 76│fn endpoint_run_brings_up_a_long_lived_dummy_harness_and_rc_attaches() {\n *77│ // Serialize against the sister test — shared process-global SPT_HOME.\n 78│ let _serial = E2E_LOCK.lock().unwrap_or_else(|e| e.into_inner());\n *79│ // ── (1) Isolated SPT_HOME. NET-ENABLED (the daemon self-initializes a real node\n *80│ // identity): `spt rc` attaches over a broker-minted LOOPBACK conn that surfaces\n 81│ // as net-stream events, so it requires a net-bound broker — a net-less broker\n 82│ // refuses the loopback dial (\"net disabled\"). Unlike the livehost/reconcile\n 83│ // tests (which only inspect perch state), the rc-attach path needs net up. ──\n 84│ let home = tempfile::tempdir().unwrap();\n *85│ std::env::set_var(\"SPT_HOME\", home.path());\n 86│\n 87│ let spt_bin = PathBuf::from(env!(\"CARGO_BIN_EXE_spt\"));\n 88│ let exe_suffix = spt_bin\n │...\n 138│ .args([\"daemon\", \"run\"])\n*139│ .env(\"SPT_HOME\", home.path())\n 140│ // Rig daemon: the advisory well-known ports belong to this box's resident\n 141│ // fleet, never to a test tree (REQ-TEST-DAEMON-EPHEMERAL-ADVISORY-PORTS).\n 142│ .env(\n │...\n 171│ .args([\"endpoint\", \"start\", id])\n*172│ .env(\"SPT_HOME\", home.path());\n 173│ common::output_bounded(cmd, Duration::from_secs(45))\n 174│ };\n 175│\n │...\n 209│ .args([\"rc\", id])\n*210│ .env(\"SPT_HOME\", home.path())\n 211│ // This rig's attach-CONNECTS proof reads PUMP_IPC_READER off rc's\n 212│ // stderr, which is now SILENT by default — a client must not write\n 213│ // diagnostics into a terminal it owns (REQ-RC-DISPLAY-SOLE-WRITER).\n │...\n 219│ .spawn()\n*220│ .expect(\"spawn spt rc \");\n 221│ let _rc_stdin = rc.stdin.take(); // hold the write end open for the attach window\n 222│ let mut rc_out = rc.stdout.take().unwrap();\n 223│ let (tx, rx) = std::sync::mpsc::channel::();\n │...\n 275│ let mut cmd = Command::new(&spt_bin);\n*276│ cmd.no_window().args([\"daemon\", \"stop\"]).env(\"SPT_HOME\", home.path());\n 277│ common::output_bounded(cmd, Duration::from_secs(20))\n 278│ };\n 279│ kill_pid(brain_pid);\n │...\n 304│ let _ = rc_connected;\n*305│ // KEYSTONE GATE (v0.12.1 Wave 2 L0): a clean `spt rc` attach to this LIVE,\n 306│ // ALREADY-PRODUCING (non-empty OutputLog ring) endpoint-run harness DELIVERS its\n 307│ // `[session.self]` stdout — the operator's \"attach shows no output\" is fixed. This\n 308│ // is the exact case the v0.12.0 mock suite + the loopback E2Es lacked (they only\n │...\n 315│ rc_saw_tick,\n*316│ \"`spt rc ` must RECEIVE the live endpoint-run harness's DUMMY_HARNESS_TICK \\\n 317│ output (got {} bytes) — the broker must forward an already-producing harness's \\\n 318│ PTY to the attach without the replay-vs-forward deadlock.\\n=== rc stderr ===\\n{rc_stderr}\\\n 319│ \\n{brain_stderr}\",\n │...\n 343│//\n*344│// Same isolated-SPT_HOME + dummyharness fixture + scoped full-tree reap as the\n 345│// sister test above; the ONLY behavioural difference is dropping `--start` so the\n 346│// SAME process runs both bringup AND attach (the bug surface), captured bounded.\n 347│// [int->REQ-HAZARD-RC-ATTACH-ONLINE-RACE]\n │...\n 354│fn endpoint_run_attach_awaits_online_before_attaching() {\n*355│ // Serialize against the sister test — shared process-global SPT_HOME.\n 356│ let _serial = E2E_LOCK.lock().unwrap_or_else(|e| e.into_inner());\n*357│ // ── (1) Isolated, NET-ENABLED SPT_HOME (rc attach rides a broker loopback\n 358│ // conn that needs a net-bound broker — identical to the sister test). ──\n 359│ let home = tempfile::tempdir().unwrap();\n*360│ std::env::set_var(\"SPT_HOME\", home.path());\n 361│\n 362│ let spt_bin = PathBuf::from(env!(\"CARGO_BIN_EXE_spt\"));\n 363│ let exe_suffix = spt_bin\n │...\n 407│ .args([\"daemon\", \"run\"])\n*408│ .env(\"SPT_HOME\", home.path())\n 409│ // Rig daemon: the advisory well-known ports belong to this box's resident\n 410│ // fleet, never to a test tree (REQ-TEST-DAEMON-EPHEMERAL-ADVISORY-PORTS).\n 411│ .env(\n\n# docs-site/src/\n## SUMMARY.md\n 21│ - [Knocking: asking to be let in](networking/knocking.md)\n*22│ - [Monics and the trust warning](networking/monics.md)\n 23│- [Serving resources](serving/overview.md)\n 24│ - [Cross-node serving](serving/cross-node.md)\n 25│ - [Attachments and `spt fetch`](serving/attachments.md)\n## changelog.md\n 25│\n *26│- Attached sessions reached through `spt rc` no longer pause during pairing or\n 27│ repeated router discovery on Windows. Automatic UPnP, NAT-PMP and PCP router\n 28│ mappings are disabled; relay-assisted connections and NAT hole-punching remain\n 29│ available. Updating only the background service is insufficient: the running\n │...\n 39│ or installed directory remains the fallback.\n *40│- Active `spt rc` sessions resume input after `spt node refresh` or an update's\n 41│ service restart instead of freezing.\n 42│\n 43│## [0.70.0] - 2026-09-13\n │...\n 47│- Quoting an absolute or home-relative filepath while controlling an agent through\n *48│ remote `spt rc` can now offer that agent a fetch command for the live file on the\n 49│ controller node. Access is limited to that agent for up to 24 hours; repeated reports\n 50│ neither extend access nor repeat the notice. Missing files and local or read-only\n 51│ input stay quiet. No adapter changes are needed.\n │...\n 64│\n *65│- `Ctrl+B`, then `d`, now detaches a read-only `spt rc --view` session without\n 66│ stopping the agent or disconnecting its controller.\n 67│\n 68│- Older console clients now receive guidance to reopen or update when a known\n │...\n 227│ declared; the environment a supervised process is started with\n *228│ (`SPT_SERVICE_OPTION`, `SPT_SERVICE_DIR`, `SPT_BIN`, `SPT_HOME`); the\n 229│ `stop-requested`, `status-advisory` and `startup.capture` files in its\n 230│ runtime directory; how a cooperative stop, an update hold and a startup\n 231│ fault behave; and what `spt adapter service list` and `spt adapter service\n │...\n 507│ adapters failed and the finish then refused, the command reported the\n *508│ refusal. Scripts branching on `3` can now trust it to mean \"nothing changed\".\n 509│- An access rule about an endpoint is now honoured the same way by every local\n 510│ delivery verb. `spt ring` used to judge such a rule against whatever\n 511│ `--from` label the caller typed, and notifications against a display label\n │...\n 762│- A briefing whose pending state cannot be read is no longer treated as absent.\n *763│- A trust warning now arrives on the message it is about. Previously it came as\n 764│ a separate message that had to be matched to the one it described.\n 765│\n 766│### Internal\n │...\n 810│ and could exhaust the budget before a code was ever entered.\n *811│- `spt rc` no longer refuses to attach to an endpoint that has just been\n 812│ released. Previously the refusal could persist until the daemon next caught\n 813│ up with that endpoint's state.\n 814│\n │...\n 1055│\n*1056│- **`spt rc engine-room` brings the room back up after it has been shut down.**\n 1057│ Quitting the harness inside the engine room's session leaves the endpoint\n*1058│ cleanly offline — and, until now, unreachable: the next `spt rc engine-room`\n 1059│ asked for a code, then answered *\"offline — nothing to attach to\"* for the\n 1060│ same command that had brought the room up minutes earlier. With a code in\n 1061│ hand the engine room is now brought up from that state, which is exactly what\n 1062│ its bring-up is for. Every other endpoint's offline answer is unchanged.\n*1063│- **Refusals point at the engine room's real door.** When `spt rc` does refuse\n*1064│ an engine-room attach, it now names `spt rc engine-room` — which asks for a\n 1065│ member or admin code — rather than a bring-up verb the engine room\n 1066│ deliberately refuses.\n 1067│- **`spt knock` no longer reports success for a target it could not reach.**\n │...\n 1107│\n*1108│The trust warning follows the same shift: it joins incoming messages from\n 1109│endpoints with no matching monic held for them, rather than ones never\n 1110│\"classified\".\n 1111│\n │...\n 1121│ reporting success.\n*1122│- `spt endpoint --help` describes what `monic` and `trust-warning` actually do.\n 1123│- Fixed a daemon that could consume whole processor cores indefinitely.\n 1124│ Previously, each change to a machine's network connection left behind work\n 1125│ that never finished, and the cost accumulated over days until several cores\n │...\n 1309│ classified wherever that agent runs next.\n*1310│- A **trust warning** now accompanies a message whose sender was admitted by an\n 1311│ access rule while the recipient holds no note about them. It states that the\n 1312│ sender arrived through a rule rather than through anything the recipient\n 1313│ decided, and advises care with secrets and state-changing requests until they\n*1314│ decide something. `spt endpoint trust-warning` shows the caution and can\n 1315│ reword it: the wording is configurable, the fact of an unclassified sender is\n 1316│ not.\n 1317│- Access rules can be written node-wide — `allow`, `deny` and `remove` now\n │...\n 1396│ engine room requires elevation; agents cannot run it at all.\n*1397│- Bare `spt rc engine-room` now opens an interactive code prompt (Esc cancels);\n 1398│ `--code` remains for direct entry, with the caveat that command-line\n 1399│ arguments are readable by other processes while the code is still valid.\n 1400│- `spt endpoint access []` is a roster: who has rules about the\n │...\n 1438│- Remote control now distinguishes watching from driving. A rule can admit a\n*1439│ viewer and still refuse control or a takeover, because `spt rc` says which of\n 1440│ the two it is asking for.\n 1441│- Endpoints you may not reach are no longer resolved or advertised to you, and\n 1442│ the resources an endpoint lists are filtered to what the asking viewer is\n │...\n 1451│- Each node now has one reserved **engine room** endpoint: a seat that governs\n*1452│ the machine's access rules. Sitting down is `spt rc --code\n 1453│ `, at the machine, with a current member or admin code for the node's\n 1454│ home subnet. A wrong code is refused without saying which key would have\n 1455│ worked, wrong codes throttle with a doubling delay, and past the third\n │...\n 1961│- Attached sessions no longer show corrupted output while connecting. Startup\n*1962│ diagnostics are no longer written into the screen `spt rc` owns — previously a\n 1963│ line such as \"Reconnecting to local daemon...\" could appear spliced together\n 1964│ with internal startup text.\n 1965│\n\n## cli/\n### reference.md\n 110│ installed one and, when newer, fetch the release archive, verify it against the\n *111│ declared signing key if any (else trusting HTTPS + GitHub), and re-register. With\n 112│ no name, sweeps every gh_release adapter; with a name, updates just that one\n 113│ use Set or clear the active-profile pointer — the default [:profile] a\n 114│ harness session binds to when no --adapter is given. spt adapter use\n │...\n 398│\"gh_release\"` adapter's latest release version against the installed one and, when newer, fetch the\n *399│release archive, verify it against the declared signing key if any (else trusting HTTPS + GitHub),\n 400│and re-register. With no name, sweeps every gh_release adapter; with a name, updates just that one\n 401│\n 402│Usage: spt adapter update [OPTIONS] [NAME]\n │...\n 1360│\n*1361│## spt rc\n 1362│\n 1363│```text\n 1364│Attach a local terminal to a broker-held endpoint PTY.\n │...\n 1370│\n*1371│Usage: spt rc [OPTIONS] \n 1372│\n 1373│Arguments:\n 1374│ \n │...\n 1525│ join Pair this machine into an existing subnet (guided)\n*1526│ leave Exit a subnet: drop its membership and trust material from this node\n*1527│ prune Remove a dead node identity's trust rows (and registry rows)\n 1528│ revoke Revoke node(s) fleet-wide and rotate the subnet seed\n 1529│ detach Stop serving a held subnet (the daemon keeps running)\n 1530│ attach Resume serving a detached subnet\n │...\n 1680│```text\n*1681│Exit a subnet: drop its membership and trust material from this node.\n 1682│\n*1683│Removes the subnet's seed, its trust rows, its serve-state, and its registry snapshot here. Gated\n*1684│behind OS elevation (membership exit destroys trust material). The remaining members still hold the\n 1685│old seed — rotate it there if this machine should not rejoin.\n 1686│\n 1687│Usage: spt subnet leave [OPTIONS] \n │...\n 1705│```text\n*1706│Remove a dead node identity's trust rows (and registry rows).\n 1707│\n 1708│The cleanup verb for a machine that re-paired under a new identity or is gone for good: its stale\n*1709│trust rows cost a dial every pump tick. Takes a full pubkey hex, an unambiguous prefix, or a node\n*1710│label. Gated behind OS elevation (trust mutation).\n 1711│\n 1712│Usage: spt subnet prune [OPTIONS] \n 1713│\n │...\n 2938│ session\n*2939│ trust-warning A hidden warning which joins incoming messages from unknown endpoints. Senders'\n*2940│ endpoint IDs with a matching monic omit the trust warning\n 2941│ help Print this message or the help of the given subcommand(s)\n 2942│\n 2943│Options:\n │...\n 3189│Re-activates the existing seat (state's already there — no fresh spawn), resurfaces undismissed\n*3190│notifications, and requests an immediate context freshness pull from trusted peers. Accepts a\n 3191│qualified id@node for an instance on a paired peer. The siblings are start (a NEW session on\n 3192│an endpoint that is offline) and resume (its latest session back).\n 3193│\n │...\n 3326│Deletes the perch tree (including its nested companion/worker perches and shells), the registry\n*3327│address, the endpoint's context branches, and its node-local trust rows. Local only. Offline-only:\n 3328│refuses while the endpoint is online — stop it first, or pass --force to stop-then-purge.\n 3329│Irreversible; confirms interactively unless --yes.\n 3330│\n │...\n 3982│\n*3983│### spt endpoint trust-warning\n 3984│\n 3985│```text\n 3986│A hidden warning which joins incoming messages from unknown endpoints. Senders' endpoint IDs with a\n*3987│matching monic omit the trust warning.\n 3988│\n 3989│When a peer gets through an access rule and this endpoint holds no monic whose sender trigger\n 3990│matches them, spt delivers a system-authored warning alongside their message. This verb shows that\n*3991│text and — with elevation — replaces the ADVISORY part of it with your own. Bare trust-warning\n 3992│shows it.\n 3993│\n*3994│Usage: spt endpoint trust-warning [OPTIONS] [COMMAND]\n 3995│\n 3996│Commands:\n 3997│ show Show the warning this endpoint would be given, as it would read\n\n## concepts/\n### overview.md\n 136│\n*137│Releases are signed (Ed25519, two-key trust anchor baked into every binary)\n 138│and propagate peer-to-peer: one machine fetches a release, its peers verify\n 139│and stage it from each other. Updates apply with the broker/brain split, so\n 140│no endpoint process terminates or suspends during a self-update — the\n\n## harness-contract/\n### api.md\n 136│> session id can present it and revive that perch. Treat session ids as\n*137│> secrets: never log or publish them. (The local surface already trusts local\n 138│> callers — `--parent-pid` is an override — so this is a contract\n 139│> qualification for adapter authors, not a sandbox.)\n 140│\n### install-on-demand.md\n 43│ # current shell may not see the PATH update yet:\n *44│ SPT=\"${SPT_HOME:-$HOME/.spt-core}/bin/spt\"\n 45│else\n 46│ SPT=\"spt\"\n 47│fi\n │...\n 100│source-free and **versioned by tag** (`--tag`, default the latest release), and\n*101│first-acquisition trusts gh's authenticated TLS + GitHub exactly like the\n 102│bootstrap's first binary fetch. A development **monorepo stays a monorepo**: your\n 103│release CI packs the archive (`tar -czf adapter.spt manifest.toml strings/ bin/…`)\n 104│and uploads it as a release asset, so the adapter ships straight from your\n │...\n 194│\n*195│First fetch trusts gh's authenticated TLS + the private channel's access\n 196│control (check the download against the release's `SHA256SUMS` for a belt on\n 197│the braces). From then on, `spt update` performs full Ed25519 signature\n*198│verification against the two-key trust anchor embedded in every binary — so\n 199│the bootstrap is the strong link only once.\n### integration-checklist.md\n 94│| **`[session.resume]` template** (spt-hosted) | The **native-resume** sibling of `[session.self]`: spt-core picks it over `[session.self]` when a bringup carries a prior session (`spt endpoint resume`, `spt go` on an offline endpoint, or the picker's *Resume from history*). Declare your harness's native-resume verb (e.g. `claude -r {session_id}`) — **skip it and a resume re-runs the fresh command → a blank transcript.** spt-core lands the PTY in the session's recorded project cwd (a harness resolves...\n*95│| **`[message-idle-translation-binary]`** (spt-hosted) | A lifecycle-managed `stdin→stdout` JSON-lines binary that turns inbound `` messages into keystroke-commands spt-core applies to the PTY **atomically** (coexists with a live `spt rc` controller). The agnostic way to deliver messages into an **idle** spt-hosted session; busy delivery stays your `[inject]` hook path. Declare it with a `command` (program + args; adapter-static `{adapter_dir}`/`{adapter_name}` subst only — **no** session keys...\n 96│| **`api now-signal --session `** (inject its stdout at every turn boundary) | The one situational-awareness funnel: peers named in the turn, monics fired, shell status, last messages, on/offline edges, and the **only** confirmation channel for shortform dispatches and `;;` seal mints. Delta-only per session, so a poll with nothing new prints nothing and a quiet turn costs zero context. Tune it from [`[io.now_signal]`](manifest.md#ionow_signal--standing-now-signal-tuning) with `--spec-manifest`...\n 97│| **`api state busy\\|idle --payload-stdin`** (the turn's text) | Feeds the [IO funnel](../shells/frames.md#io--the-sessions-io-events-durable) — `USER_INPUT` / `AGENT_OUTPUT` events shell binaries and (from releases#234) other consumers read. Purely additive: the same call with no payload behaves exactly as before. Report every payload span **exactly once across the turn** — core does not deduplicate. Add `--mid` to report a MID-TURN span of agent output on the `busy` arm (still an `AGENT_OUTPUT` eve...\n 98│\n### manifest.md\n 91│\n *92│**Served output.** Core creates `$SPT_HOME/adapters//web/` before\n 93│committing activation, even if the daemon is stopped. Write only intended\n 94│served output there; core never exposes the adapter's install tree, manifest,\n 95│records, or strings on its behalf. The daemon reconciles one `dir` entry per\n │...\n 510│the inbound `` message feed and reads back keystroke-commands, which it\n*511│applies to the broker-held PTY **atomically** — a live `spt rc` controller's input\n 512│is buffered during the emitted sequence and flushed after, so idle injection\n 513│coexists with an attached operator (spt-core owns every PTY write). **Idle delivery\n 514│only** — busy / mid-turn delivery stays your `[inject]` hook path.\n │...\n 541│- **stdout** (binary → spt-core, one per line): `{\"key\":\"ctrl+s\"}` · `{\"delay_ms\":50}` · `{\"text\":\"\"}` · `{\"key\":\"enter\"}` · `{\"commit\":true}`, … (extensible vocabulary).\n*542│- **`{\"commit\":true}` is the mandatory sequence terminator — and you MUST send it for EVERY `{\"type\":\"event\"}`.** While your emitted sequence is in flight, spt-core buffers a live `spt rc` controller's keystrokes (the *inject floor*) and applies your commands to the PTY atomically; `{\"commit\":true}` — emitted as the **last** record — releases that floor and flushes the buffered controller input *after* your sequence. The submit keystroke is **not** the terminator: `{\"key\":\"enter\"}` (or a trailing `...\n 543│- **Missed commit → the sequence is tolerated, not fatal.** If no `{\"commit\":true}` arrives within the **commit deadline (5 s)**, spt-core still flushes the buffered operator input (never stranded) and re-spools that one message once so it is not lost — but it does **NOT** terminate a healthy binary. A single miss is tolerated; the binary is preserved and the next event delivers through it as normal. Only after **3 consecutive** missed commits (a genuinely wedged binary), or a real binary death, does...\n 544│- Unknown fields are **not** rejected here — a newer adapter declaring a future key against an older spt-core parses fine (the key is ignored), so the contract degrades gracefully.\n 545│- `{\"text\":…}` is applied to the PTY **verbatim** — bytes are typed exactly, with **no** control-character stripping. A trailing `\\r` *inside* a text payload (`{\"text\":\"…\\r\"}`) therefore **submits**, identical to a following `{\"key\":\"enter\"}` (`enter`→`\\r`). Submit either way; just don't do both. Corollary: neutralize any CR/LF *inside* the message body before the trailing submit, or an embedded newline fires the input early.\n │...\n 579│ identically once running. The key is required rather than defaulted because\n*580│ the choice decides whether a least-trusted third-party binary rises with the\n 581│ daemon itself — an adapter author says so explicitly.\n 582│- **Registration reports what it did, and never fails over the service.** After\n 583│ a successful `spt adapter add` or `spt adapter update`, the CLI asks the daemon\n │...\n 606│ | `SPT_BIN` | absolute path to the `spt` executable to call (see below) |\n*607│ | `SPT_HOME` | the state root that `spt` must be run against |\n 608│\n 609│ The option is the raw string an operator types, not a path encoding. The\n 610│ runtime dir is per-option, so two options of one adapter never share a\n │...\n 618│ service calls is never a different build than the supervisor that owns it.\n*619│ `SPT_HOME` is likewise pinned to the home the daemon resolved rather than left\n 620│ for the child to re-derive from a per-account platform default. Both are\n 621│ absolute. `SPT_BIN` is the one variable here that can be **absent** — if core\n 622│ cannot read its own image path it says nothing rather than handing out a\n │...\n 644│ reconcile, hold, kill or adoption reads it — because core deciding on it would\n*645│ put a least-trusted binary's self-report in the control path, and a service\n 646│ that stopped updating it would silently become whatever it last claimed. The\n 647│ read is **bounded** (the first line, capped) and an unreadable file is simply\n 648│ no advisory: nothing here ever requires reading a file the service holds an\n │...\n 832│**Trust is opt-in signing, fail-closed.** Declare no `signing_key` and the\n*833│fetched `.spt` is trusted on HTTPS + GitHub, exactly like first acquisition.\n 834│Declare a `signing_key` and the fetched `.spt` is verified against a **detached\n 835│signature** you publish as a sibling release asset named `.sig` — a\n 836│lowercase-hex Ed25519 signature over the raw archive bytes. Verification runs\n\n## instances/\n### overview.md\n 92│\"you may suspend my agent\" or \"you may transfer files\" would hand over\n*93│mind-cloning to anyone trusted with either.\n 94│\n 95│**A `FORK` grant on its own cannot be exercised.** Listing an endpoint's\n 96│surfaces closes every surface not listed, so a `FORK`-only grant denies\n\n## lifecycle/\n### overview.md\n 22│ Between the session starting and that bind the endpoint is **unbound**: a\n*23│ live, attachable session — `spt rc ` connects to it to watch or clear a\n 24│ bringup prompt *before* bind — that is not yet message-addressable (a `send`\n 25│ waits for online). The picker and `spt endpoint list` show it as a\n 26│ distinct **unbound** row — see the status-square legend below — not a true\n │...\n 79│| blue ■ | online · controlled | someone is driving it (the detail pane names the controlling node) |\n*80│| red ■ | online · unbound | a live session not yet message-bound — attachable with `spt rc`, needs attention |\n 81│| amber ▢ | online · harness-only | visible but has no control seat, so it cannot be controlled |\n 82│| gray ■ | suspended | cold but its machine is up — wakeable |\n 83│| gray ▢ | offline | the machine is down (only ever seen for remote endpoints) |\n\n## messaging/\n### overview.md\n 161│ construction. A receiver-composed attribute can carry newlines — the\n*162│ `trust-warning` block runs to several — and the envelope is line-framed, so an\n 163│ unencoded newline would split one delivery into several lines of which most\n 164│ are not envelopes.\n 165│- Decode only the **extracted body substring** after parsing the envelope\n │...\n 179│alarm's times — not one of the receiver-composed attributes\n*180│([`trust-warning`, `mnemonics-json`](../networking/monics.md)) your node\n 181│strips off inbound bodies before attaching its own. The seal attribute rides\n 182│**end-to-end intact** through that strip: it is the sender's own evidence\n 183│citation, and stripping it would delete the citation at every ingress.\n │...\n 185│**For adapter authors: this attribute must be surfaced** — the same obligation\n*186│`trust-warning` carries. A pipeline that re-renders a delivery has to carry\n 187│the token through and show it, or the receiving agent loses the pointer to\n 188│evidence the sender deliberately attached. And the mirror rule: the attribute\n 189│is a **citation, never an authorization subject**. Nothing may branch\n │...\n 205│ only closed list in this contract is the receiver-composed **strip** class\n*206│ (`trust-warning`, `mnemonics-json`), and it is a strip list, not a render\n 207│ list; everything else rides.\n 208│- **\"Consume\" means the attribute's distinction is re-expressed, not merely\n 209│ read.** A pipeline consumes an attribute when its handling puts the value's\n### wax-seal.md\n 124│Nothing is parked waiting for a controller to appear; have the operator attach\n*125│(`spt rc `) and ask again.\n 126│\n 127│## The FIDO2 ceremony\n 128│\n │...\n 167│stay daemon-side. The offer rides the existing ceremony records as additive\n*168│fields, so an older `spt rc` simply renders the plain TOTP overlay — nothing\n 169│hangs, nothing to update before the next mint.\n 170│\n 171│### `E` — enroll and seal in one ceremony\n\n## networking/\n### engine-room-setup.md\n 36│```text\n*37│spt rc engine-room\n 38│```\n 39│\n 40│A bare attach opens an interactive prompt for the anchor subnet's current\n### knocking.md\n 328│unclassified peer, and their first message carries the\n*329│[trust warning](monics.md#the-trust-warning).\n 330│\n 331│## Refusals you can predict\n 332│\n### monics.md\n *1│# Monics and the trust warning\n 2│\n 3│A **monic** is a **reactionary string**: a set of **triggers** plus a **body**\n 4│that is revealed when something in your session matches one of them. A monic is\n │...\n 7│\n *8│Classifying a peer is still the headline use, and it is what the **trust\n 9│warning** reads: an access rule says a peer **may speak**; a monic that matches\n 10│their id says what you have concluded about them. Those are different questions,\n *11│and the gap between them is what the trust warning exists to close.\n 12│\n 13│```text\n 14│spt endpoint monic # what do I hold?\n │...\n 162│\n*163│The one gate in this family is on the trust warning's **override text**, below,\n 164│and for a reason that does not apply to a classification.\n 165│\n*166│## The trust warning\n 167│\n 168│\n 169│\n 170│When a message reaches you because an **access entry** admitted its sender, and\n*171│you hold **no monic** about that sender, spt composes a system-authored trust\n 172│warning and delivers it alongside the message:\n 173│\n 174│```text\n │...\n 213│The caution and the message it is about reach you in **one arrival**. The warning\n*214│rides that message's envelope as a `trust-warning` attribute, composed by **the\n 215│receiving node** — yours — exactly as a matched monic's `mnemonics-json` is:\n 216│\n 217│```text\n*218│\n 219│```\n 220│\n 221│An attribute is not the body, so the sender authors this text in neither design:\n │...\n 230│> the same, though, and the difference is the point: a dropped monic costs you a\n*231│> note you wrote, while a **dropped trust warning is a security caution that\n 232│> silently did not happen**. For this attribute, being ignored *is* the failure —\n 233│> so \"unknown attributes are safely ignored\" is exactly the behaviour that must\n 234│> not apply here.\n │...\n 245│**Anything a sender writes into this attribute is inert.** A typed envelope rides\n*246│verbatim from the wire to your context, so a peer *can* put a `trust-warning`\n 247│into one and hand it over. Every point where a sender-supplied body enters your\n 248│node strips the receiver-composed attributes before your own are attached, so\n 249│what you read is your node's by construction rather than by the sender's\n │...\n 260│|---|---|\n*261│| **same-node** | inside your node's own trust unit |\n 262│| **a reply** | correlated to your own outbound — traffic you invited |\n 263│| **posture-open** | no entry named this peer; the endpoint simply is not refusing anyone |\n 264│\n │...\n 355│```text\n*356│spt endpoint trust-warning # show what this endpoint is told\n*357│spt endpoint trust-warning set \"…\" # replace the advisory (elevated)\n*358│spt endpoint trust-warning reset # back to the default (elevated)\n 359│```\n 360│\n 361│**The scope is partial, by ratification.** Custom text replaces the **advisory\n │...\n 428│adapter's own frame level, never inside the peer's rendered body) — the same\n*429│reasoning that gives the trust warning a system author no peer can legally\n 430│write under.\n 431│\n 432│> **Forward guidance for adapter authors:** the envelope attribute is the\n │...\n 446│reads nothing and gets no attribute. An unreadable record rides nothing, the\n*447│same fail-safe reading the trust warning takes; the two never disagree, so you\n 448│can never be warned about a stranger whose monic you were handed in the same\n 449│envelope.\n 450│\n │...\n 480│**Matching a message is not the same as classifying its sender.** Only a\n*481│`sender` trigger answers the trust warning's question. A `content` trigger can\n 482│ride you a monic on a message from someone you have never classified — and that\n 483│peer still draws the stranger warning, because you have not said anything about\n 484│*them*.\n │...\n 490│traffic: a message whose sender could not be proven is re-stamped at the WAN\n*491│edge into a typed envelope, so that sender's monic does not ride. **The trust\n 492│warning still fires for them** — it is composed at that edge from the gate's\n 493│verdict — so what is lost is the note, never the caution.\n 494│\n### overview.md\n 33│ wrong guess learns nothing. Both sides pin each other's node keys on\n*34│ success (trust-on-first-use; key changes warn and never auto-apply).\n 35│ Every member machine answers join attempts automatically — no arming step\n 36│ on the existing fleet. *(two-phase join since v0.17.0)*\n 37│- **Elevation gates** — `subnet create` (reveals a fresh subnet's joining\n\n## reference/\n### install.md\n 7│authenticates with an account that can read it; there is nothing else to\n *8│trust on first fetch beyond gh's authenticated TLS.\n 9│\n 10│## Steps\n 11│\n │...\n 62│Thereafter `spt update` performs full Ed25519 verification against the\n*63│[two-key trust anchor](../self-update/overview.md#the-trust-chain) embedded\n 64│in the binary — the update carrier is also gh, and the signature chain is\n 65│carrier-independent.\n 66│\n\n## self-update/\n### overview.md\n 3│spt-core keeps itself current without ever interrupting your agents, and\n *4│without trusting anything unsigned.\n 5│\n 6│## The invariant\n 7│\n │...\n 12│\n*13│## The trust chain\n 14│\n 15│- Every release ships `SignedRelease` metadata: an Ed25519 signature over the\n 16│ release's artifact digests.\n*17│- Every binary embeds the **two-key trusted set** — an active primary and a\n 18│ never-used offline recovery key. Verification requires a valid signature\n*19│ from a trusted key *and* a matching artifact digest; an unverified binary\n 20│ never reaches the apply step.\n 21│- Losing the primary key is a non-event: the next release is signed with the\n*22│ recovery key (already trusted by every deployed binary) and rotates in a\n 23│ fresh primary.\n 24│- **Adapters sign their own content.** A `file_pull` adapter update is\n 25│ verified against the adapter author's key from its manifest; a `delegated`\n*26│ update is trusted only when the manifest attests the delegated updater\n 27│ verifies its own content (`self_verifies`). spt-core's release keys never\n 28│ vouch for adapter bytes.\n 29│","linesTruncated":true,"meta":{"limits":{"columnTruncated":{"maxColumn":512}}}},"isError":false,"timestamp":1790029745839}}
{"type":"message","id":"5a5e8888","parentId":"b7c2cf6e","timestamp":"2026-09-21T22:29:10.812Z","message":{"role":"toolResult","toolCallId":"call_yKpYK0ygrde0occe18ArSpwg|fc_0c7d22595484f800016ab1afb1b1d487d2b1b5d9da3d879ec9","toolName":"glob","content":[{"type":"text","text":"# .spt/preserved/318/\nJIT-PLAN.md\ndispatch-hertz.md\ndispatch-todlando.md\n\nglob timed out after 5s; returning 3 partial matches — results are incomplete, scope to a deeper directory instead of retrying blindly\nSkipped missing paths: tools/*"}],"details":{"scopePath":".spt/preserved/318/*, **/*rc*.md, **/*trust*.md","fileCount":3,"files":[".spt/preserved/318/JIT-PLAN.md",".spt/preserved/318/dispatch-hertz.md",".spt/preserved/318/dispatch-todlando.md"],"truncated":true,"cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","missingPaths":["tools/*"]},"isError":false,"timestamp":1790029750811}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_YyJc2URK1tGhnPXtJH2GU1Oi|fc_0c7d22595484f800016ab1afc2dd2887d2aa822c66ea3ef6ce","toolName":"grep","startedAt":"2026-09-21T22:29:22.973Z","args":{"path":"crates/spt/src/rc.rs;crates/spt-daemon/src/broker.rs;crates/spt-daemon/src/attach.rs;crates/spt-daemon/src/servehost.rs"},"intent":"Finding owner receipt implementation"},"id":"cb8ce796","parentId":"5a5e8888","timestamp":"2026-09-21T22:29:22.973Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_MUNzb2x1guyCJbXa422YAdCE|fc_0c7d22595484f800016ab1afc2dd4087d2a02fb25e84f6abb9","toolName":"read","startedAt":"2026-09-21T22:29:22.973Z","args":{"path":"docs-site/src/cli/reference.md:1361-1418,1538-1680,2960-3100"},"intent":"Reading published control setup commands"},"id":"233d789d","parentId":"cb8ce796","timestamp":"2026-09-21T22:29:22.973Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_m85pOE6fxzRc28g5bZVWIvBv|fc_0c7d22595484f800016ab1afc2dd4c87d2816a627b1fbd02a0","toolName":"grep","startedAt":"2026-09-21T22:29:22.974Z","args":{"path":"crates/spt/src/api/mod.rs;crates/spt-daemon/src/endpoint.rs;crates/spt/tests/common/mod.rs;docs-site/src/harness-contract/manifest.md;docs-site/src/cli/reference.md"},"intent":"Locating standalone fixture commands"},"id":"5fc8edfc","parentId":"233d789d","timestamp":"2026-09-21T22:29:22.974Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_a9ZbAabwoUWlsclRLerq7GUV|fc_0c7d22595484f800016ab1afc2dd5887d288c6d3a40068727c","toolName":"glob","startedAt":"2026-09-21T22:29:22.974Z","args":{"path":"crates/spt/src/*rc*;crates/spt-daemon/src/*input*;crates/mock-adapter/**/*;crates/spt/tests/*inject*;crates/spt/tests/*node*"},"intent":"Locating rc and injection modules"},"id":"3e92bdc0","parentId":"5fc8edfc","timestamp":"2026-09-21T22:29:22.974Z"}
{"type":"message","id":"1319b4cb","parentId":"3e92bdc0","timestamp":"2026-09-21T22:29:22.974Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_YyJc2URK1tGhnPXtJH2GU1Oi|fc_0c7d22595484f800016ab1afc2dd2887d2aa822c66ea3ef6ce","name":"grep","arguments":{"i":"Finding owner receipt implementation","pattern":"input_reference|input_serve|InputReference|InputServe|UserInput|user_input|receipt","path":"crates/spt/src/rc.rs;crates/spt-daemon/src/broker.rs;crates/spt-daemon/src/attach.rs;crates/spt-daemon/src/servehost.rs","case":true,"gitignore":true,"skip":0},"intent":"Finding owner receipt implementation"},{"type":"toolCall","id":"call_MUNzb2x1guyCJbXa422YAdCE|fc_0c7d22595484f800016ab1afc2dd4087d2a02fb25e84f6abb9","name":"read","arguments":{"i":"Reading published control setup commands","path":"docs-site/src/cli/reference.md:1361-1418,1538-1680,2960-3100"},"intent":"Reading published control setup commands"},{"type":"toolCall","id":"call_m85pOE6fxzRc28g5bZVWIvBv|fc_0c7d22595484f800016ab1afc2dd4c87d2816a627b1fbd02a0","name":"grep","arguments":{"i":"Locating standalone fixture commands","pattern":"NowSignal|spec_file|struct AuthFlags|SPT_.*PORT|broker_socket_name|--from|\\[inject\\]","path":"crates/spt/src/api/mod.rs;crates/spt-daemon/src/endpoint.rs;crates/spt/tests/common/mod.rs;docs-site/src/harness-contract/manifest.md;docs-site/src/cli/reference.md","case":true,"gitignore":true,"skip":0},"intent":"Locating standalone fixture commands"},{"type":"toolCall","id":"call_a9ZbAabwoUWlsclRLerq7GUV|fc_0c7d22595484f800016ab1afc2dd5887d288c6d3a40068727c","name":"glob","arguments":{"i":"Locating rc and injection modules","path":"crates/spt/src/*rc*;crates/spt-daemon/src/*input*;crates/mock-adapter/**/*;crates/spt/tests/*inject*;crates/spt/tests/*node*","hidden":true,"gitignore":true,"limit":60},"intent":"Locating rc and injection modules"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":21176,"output":352,"cacheRead":30080,"cacheWrite":0,"totalTokens":51608,"cost":{"input":0.21176,"output":0.0176,"cacheRead":0.03008,"cacheWrite":0,"total":0.25944}},"stopReason":"toolUse","timestamp":1790029750862,"responseId":"resp_0c7d22595484f800016ab1afb7149087d28b71a6c07afa1e56","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0c7d22595484f800016ab1afc2dd2887d2aa822c66ea3ef6ce","type":"function_call","status":"completed","arguments":"{\"i\":\"Finding owner receipt implementation\",\"pattern\":\"input_reference|input_serve|InputReference|InputServe|UserInput|user_input|receipt\",\"path\":\"crates/spt/src/rc.rs;crates/spt-daemon/src/broker.rs;crates/spt-daemon/src/attach.rs;crates/spt-daemon/src/servehost.rs\",\"case\":true,\"gitignore\":true,\"skip\":0}","call_id":"call_YyJc2URK1tGhnPXtJH2GU1Oi","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"grep","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1afc2dd4087d2a02fb25e84f6abb9","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading published control setup commands\",\"path\":\"docs-site/src/cli/reference.md:1361-1418,1538-1680,2960-3100\"}","call_id":"call_MUNzb2x1guyCJbXa422YAdCE","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"read","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1afc2dd4c87d2816a627b1fbd02a0","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating standalone fixture commands\",\"pattern\":\"NowSignal|spec_file|struct AuthFlags|SPT_.*PORT|broker_socket_name|--from|\\\\[inject\\\\]\",\"path\":\"crates/spt/src/api/mod.rs;crates/spt-daemon/src/endpoint.rs;crates/spt/tests/common/mod.rs;docs-site/src/harness-contract/manifest.md;docs-site/src/cli/reference.md\",\"case\":true,\"gitignore\":true,\"skip\":0}","call_id":"call_m85pOE6fxzRc28g5bZVWIvBv","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"grep","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1afc2dd5887d288c6d3a40068727c","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating rc and injection modules\",\"path\":\"crates/spt/src/*rc*;crates/spt-daemon/src/*input*;crates/mock-adapter/**/*;crates/spt/tests/*inject*;crates/spt/tests/*node*\",\"hidden\":true,\"gitignore\":true,\"limit\":60}","call_id":"call_a9ZbAabwoUWlsclRLerq7GUV","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"glob","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}}]},"duration":12106.740099999995,"ttft":12038.002999999997,"completedAt":1790029762970,"contextSnapshot":{"promptTokens":51256,"nonMessageTokens":10457,"compactionEpoch":0}}}
{"type":"message","id":"1d1f5133","parentId":"1319b4cb","timestamp":"2026-09-21T22:29:22.993Z","message":{"role":"toolResult","toolCallId":"call_a9ZbAabwoUWlsclRLerq7GUV|fc_0c7d22595484f800016ab1afc2dd5887d288c6d3a40068727c","toolName":"glob","content":[{"type":"text","text":"# crates/\n## spt/\n### tests/\nwebserve_cross_node_e2e.rs\nknock_mutual_cross_node_e2e.rs\nintra_node_self.rs\nintra_node_degrade.rs\n### src/\nrc.rs\n## spt-daemon/src/\ninputreceipt.rs\n\nSkipped missing paths: crates/mock-adapter/**/*"}],"details":{"scopePath":"crates/spt/src/*rc*, crates/spt-daemon/src/*input*, crates/spt/tests/*inject*, crates/spt/tests/*node*","fileCount":6,"files":["crates/spt/tests/webserve_cross_node_e2e.rs","crates/spt/src/rc.rs","crates/spt-daemon/src/inputreceipt.rs","crates/spt/tests/knock_mutual_cross_node_e2e.rs","crates/spt/tests/intra_node_self.rs","crates/spt/tests/intra_node_degrade.rs"],"truncated":false,"cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","missingPaths":["crates/mock-adapter/**/*"]},"isError":false,"timestamp":1790029762992}}
{"type":"message","id":"d2309a43","parentId":"1d1f5133","timestamp":"2026-09-21T22:29:23.122Z","message":{"role":"toolResult","toolCallId":"call_MUNzb2x1guyCJbXa422YAdCE|fc_0c7d22595484f800016ab1afc2dd4087d2a02fb25e84f6abb9","toolName":"read","content":[{"type":"text","text":"## spt rc\n\n```text\nAttach a local terminal to a broker-held endpoint PTY.\n\nConnects to an spt-hosted session and drives it as a terminal. Local is the degenerate single-node\ncase of the cross-node attach (one pump, loopback peer). Detach with the ctrl-b prefix then d\n(ctrl-b ctrl-b sends a literal ctrl-b); detaching leaves the session running on the broker.\n--view watches read-only.\n\nUsage: spt rc [OPTIONS] \n\nArguments:\n \n The endpoint id whose broker-held session to attach\n\nOptions:\n --json\n Emit machine-readable JSON instead of the human view. Honored by the read/status commands\n (list, whoami, status, description, role, the *-list queries, how-to); action commands\n ignore it\n\n --view\n Read-only: render output, forward no input\n\n --take\n Take control: kick the current controller (a loud notice to them) and drive. Use on an\n endpoint another node controls\n\n --code \n The current six-digit code for the endpoint's subnet, when the endpoint asks for one\n before handing over its controls.\n \n The engine room is the one that does. Either the subnet's member code or its admin code is\n accepted. Wrong codes are rate-limited and, repeated, raise a notification. Omit it to be\n prompted interactively (Esc cancels) — preferred where possible, since a code passed on\n the command line is readable by other processes on this machine while it is still valid.\n\n -h, --help\n Print help (see a summary with '-h')\n```\n\n## spt serve\n\n```text\nRegister local files and directories for node-prefixed HTTP serving\n\nUsage: spt serve [OPTIONS] \n\nCommands:\n add Serve a file or directory at its current path. Edits are visible; removing the source makes\n its URL answer not found\n rm Stop serving an entry by name or id. Does not delete the source\n list List exposed paths and their URLs. Supports --json\n lan Start or stop the LAN bootstrap listener — the opt-in, all-interfaces server that hands the\n spt binary to a machine that is not yet a node. It is NOT the docs server: it serves only\n /bin//spt[.exe], that file's .release.json sidecar, and /install, and the docs\n port stays loopback the whole time\n…\n -h, --help Print help\n```\n…\n\n…\n```text\nSubnet membership: status, create, show-code.\n…\n ignore it\n\n -h, --help\n Print help (see a summary with '-h')\n```\n\n### spt subnet status\n\n```text\nShow subnet membership: name, paired nodes, endpoints.\n\nNever prints seeds, epochs, or pairing codes. Bare spt subnet is the same view.\n\nUsage: spt subnet status [OPTIONS] [NAME]\n\nArguments:\n [NAME]\n Limit to one subnet (all member subnets otherwise)\n\nOptions:\n --json\n Emit machine-readable JSON instead of the human view. Honored by the read/status commands\n (list, whoami, status, description, role, the *-list queries, how-to); action commands\n ignore it\n\n --nodes\n Per-node rows: label, online/offline, [online endpoints/total]\n\n -h, --help\n Print help (see a summary with '-h')\n```\n\n### spt subnet create\n\n```text\nMint a fresh subnet and print its joining material.\n\nThis node becomes the sole seed-holder. Mints BOTH subnet keys — the member key (current 6-digit\ncode, otpauth:// URI, terminal QR) and the admin key, whose provisioning material is shown HERE\nAND NOWHERE ELSE, EVER: scan it now or the subnet has no admin authority. Also states the subnet's\ncontrol-surface mode — asked with no preselection unless --open/--closed says it outright. Gated\nbehind OS elevation (the seed-reveal path).\n\nUsage: spt subnet create [OPTIONS] \n\nArguments:\n \n The new subnet's name\n\nOptions:\n --json\n Emit machine-readable JSON instead of the human view. Honored by the read/status commands\n (list, whoami, status, description, role, the *-list queries, how-to); action commands\n ignore it\n\n --open\n Unlisted subjects are ALLOWED on every control surface (today's fleet posture). Skips the\n mode question — for scripted creation\n\n --closed\n Unlisted subjects are BLOCKED unless an explicit rule allows. Skips the mode question —\n for scripted creation\n\n -h, --help\n Print help (see a summary with '-h')\n\nControl surfaces:\n MSG — direct messages (a grant binds the single sender)\n RC_VIEW — read-only terminal viewing (a grant admits the whole machine)\n RC_ATTACH — interactive terminal control (a grant admits the whole machine)\n DIGEST — cross-node digest pull (a grant admits the whole machine)\n WAKE — waking a resting endpoint (a grant admits the whole machine)\n SUSPEND — suspending a running endpoint (a grant admits the whole machine)\n SHELL_LINK — driving a linked shell (a grant admits the whole machine)\n DISCOVER — being found: resolve, advertise, and the resources blurb (a grant admits the whole\n machine)\n WEB — reading served resources over HTTP (a grant admits the whole machine)\n FORK — forking this endpoint, mind and all (a grant admits the whole machine)\n```\n\n### spt subnet show-code\n\n```text\nShow a subnet's current 6-digit pairing code (+ URI and QR).\n\nThe re-provisioning surface: prints the same joining material as create — current code,\notpauth:// URI, terminal QR, expiry. Gated behind OS elevation (or read the code from your\nauthenticator app). With no name the node's sole subnet is used; if it holds several, the name is\nrequired (never guessed).\n\nUsage: spt subnet show-code [OPTIONS] [NAME]\n\nArguments:\n [NAME]\n Which subnet's code to show. Required only when the node holds several\n\nOptions:\n --json\n Emit machine-readable JSON instead of the human view. Honored by the read/status commands\n (list, whoami, status, description, role, the *-list queries, how-to); action commands\n ignore it\n\n -h, --help\n Print help (see a summary with '-h')\n```\n\n### spt subnet join\n\n```text\nPair this machine into an existing subnet (guided).\n\nFinds a member machine over LAN + relay rendezvous and runs the code-authenticated pairing ceremony\nagainst it. Prompts for the name and code when omitted (interactive terminals). Gated behind OS\nelevation — joining enrolls this whole machine.\n\nUsage: spt subnet join [OPTIONS] [NAME]\n\nArguments:\n [NAME]\n The subnet to join (as named on the member machine)\n\nOptions:\n --code \n The current 6-digit code (spt subnet show-code on a member machine, or your\n authenticator app)\n\n --json\n Emit machine-readable JSON instead of the human view. Honored by the read/status commands\n (list, whoami, status, description, role, the *-list queries, how-to); action commands\n ignore it\n\n --verbose\n Print a detailed discovery trace (rendezvous attempts, elapsed vs deadline, the last\n concrete error) when the search struggles or fails — for diagnosing a join that can't find\n a member\n\n -h, --help\n Print help (see a summary with '-h')\n```\n\n### spt subnet leave\n\n```text\n…\n```\n\n…\n### spt endpoint list\n…\n```text\nMerged endpoint listing (the bare spt endpoint view).\n…\nshows — spt whoami is a thin alias and must see its own perch). --subnet filters the subnet view\nto one subnet; --detail adds each endpoint's description blurb (the resource-registry yellow-pages\nprojection).\n\nUsage: spt endpoint list [OPTIONS]\n\nOptions:\n --json\n Emit machine-readable JSON instead of the human view. Honored by the read/status commands\n (list, whoami, status, description, role, the *-list queries, how-to); action commands\n ignore it\n\n --subnet \n Limit the subnet view to one subnet\n\n --detail\n Add each endpoint's description blurb to the rows\n\n --show-all\n Also show suspended (resting) endpoints, which are hidden by default\n\n --workers\n Also show worker perches, which are hidden by default (they are process-local machinery\n under a parent agent, not standalone endpoints)\n\n -h, --help\n Print help (see a summary with '-h')\n```\n\n### spt endpoint create\n\n```text\nCreate a NEW endpoint and bring its first session up.\n\nThe only way an endpoint is minted. The adapter and working directory recorded here become the\nendpoint's session defaults — every later start lands on them unless told otherwise. The anchor\nsubnet is assigned here and is permanent (the cross-subnet move is fork). An id that already\nexists is REFUSED: bring the existing one up with start, or go straight to it with `spt go\n`.\n\nUsage: spt endpoint create [OPTIONS] \n\nArguments:\n \n The new endpoint's id (charset: alphanumeric, -, _)\n\nOptions:\n --json\n Emit machine-readable JSON instead of the human view. Honored by the read/status commands\n (list, whoami, status, description, role, the *-list queries, how-to); action commands\n ignore it\n\n --subnet \n Home this endpoint to a named subnet. Required on a node that holds more than one subnet\n (the anchor is assigned at creation and is permanent); the sole subnet is used\n automatically when there is one\n\n --adapter \n The harness adapter to host: [:profile] (must be a registered kind=\"harness\"\n adapter on this node). Omit on a node that has exactly one registered harness adapter\n\n --cwd \n The project folder the harness runs in (defaults to the directory this command is run\n from)\n\n -h, --help\n Print help (see a summary with '-h')\n```\n\n### spt endpoint start\n\n```text\nStart a NEW session on an endpoint that already exists.\n\nLands on the endpoint's most-recent adapter in its most-recent project folder — never on the folder\nyou happen to be standing in. --adapter / --cwd override this run AND become the new remembered\ndefaults. An UNKNOWN id is refused rather than minted (that is create's job); the sibling verbs\nare resume (its latest session), wake (an endpoint that is only resting, not offline), and\nspt go (start-and-attach, whatever state it is in).\n\nUsage: spt endpoint start [OPTIONS] \n\nArguments:\n \n The endpoint id to start a new session on\n\nOptions:\n --adapter \n Run this session under a different harness adapter, and remember it as the endpoint's\n adapter from now on\n\n --json\n Emit machine-readable JSON instead of the human view. Honored by the read/status commands\n (list, whoami, status, description, role, the *-list queries, how-to); action commands\n ignore it\n\n --cwd \n Run this session in a different project folder, and remember it as the endpoint's folder\n from now on\n\n -h, --help\n Print help (see a summary with '-h')\n```\n\n### spt endpoint resume\n\n```text\nResume an endpoint's LATEST session.\n\nBrings the endpoint back up on the last session it recorded, in the project folder that session ran\nin. An endpoint that has never recorded a session has nothing to resume — start it instead. The\nsiblings are start (a fresh session), wake (it is only resting, not offline), and `spt go\n` (resume-and-attach).\n\nUsage: spt endpoint resume [OPTIONS] \n\nArguments:\n \n The endpoint id whose latest session to resume\n\nOptions:\n --json\n Emit machine-readable JSON instead of the human view. Honored by the read/status commands\n (list, whoami, status, description, role, the *-list queries, how-to); action commands\n ignore it\n\n -h, --help\n Print help (see a summary with '-h')\n```\n\n### spt endpoint auto-start\n\n```text\nReplay this endpoint at every daemon start.\n\nRecords a startup default: the daemon brings the endpoint up (a fresh session, on its remembered\nadapter and folder) every time it starts, until you turn it off with --off. One entry per endpoint\nid — setting it again replaces the prior one. An endpoint that fails to come up logs the failure and\nnever blocks the daemon.\n\nUsage: spt endpoint auto-start [OPTIONS] \n…\n Print help (see a summary with '-h')\n```\n"}],"details":{"displayContent":{"text":"## spt rc\n\n```text\nAttach a local terminal to a broker-held endpoint PTY.\n\nConnects to an spt-hosted session and drives it as a terminal. Local is the degenerate single-node\ncase of the cross-node attach (one pump, loopback peer). Detach with the ctrl-b prefix then d\n(ctrl-b ctrl-b sends a literal ctrl-b); detaching leaves the session running on the broker.\n--view watches read-only.\n\nUsage: spt rc [OPTIONS] \n\nArguments:\n \n The endpoint id whose broker-held session to attach\n\nOptions:\n --json\n Emit machine-readable JSON instead of the human view. Honored by the read/status commands\n (list, whoami, status, description, role, the *-list queries, how-to); action commands\n ignore it\n\n --view\n Read-only: render output, forward no input\n\n --take\n Take control: kick the current controller (a loud notice to them) and drive. Use on an\n endpoint another node controls\n\n --code \n The current six-digit code for the endpoint's subnet, when the endpoint asks for one\n before handing over its controls.\n \n The engine room is the one that does. Either the subnet's member code or its admin code is\n accepted. Wrong codes are rate-limited and, repeated, raise a notification. Omit it to be\n prompted interactively (Esc cancels) — preferred where possible, since a code passed on\n the command line is readable by other processes on this machine while it is still valid.\n\n -h, --help\n Print help (see a summary with '-h')\n```\n\n## spt serve\n\n```text\nRegister local files and directories for node-prefixed HTTP serving\n\nUsage: spt serve [OPTIONS] \n\nCommands:\n add Serve a file or directory at its current path. Edits are visible; removing the source makes\n its URL answer not found\n rm Stop serving an entry by name or id. Does not delete the source\n list List exposed paths and their URLs. Supports --json\n lan Start or stop the LAN bootstrap listener — the opt-in, all-interfaces server that hands the\n spt binary to a machine that is not yet a node. It is NOT the docs server: it serves only\n /bin//spt[.exe], that file's .release.json sidecar, and /install, and the docs\n port stays loopback the whole time\n…\n -h, --help Print help\n```\n…\n\n…\n```text\nSubnet membership: status, create, show-code.\n…\n ignore it\n\n -h, --help\n Print help (see a summary with '-h')\n```\n\n### spt subnet status\n\n```text\nShow subnet membership: name, paired nodes, endpoints.\n\nNever prints seeds, epochs, or pairing codes. Bare spt subnet is the same view.\n\nUsage: spt subnet status [OPTIONS] [NAME]\n\nArguments:\n [NAME]\n Limit to one subnet (all member subnets otherwise)\n\nOptions:\n --json\n Emit machine-readable JSON instead of the human view. Honored by the read/status commands\n (list, whoami, status, description, role, the *-list queries, how-to); action commands\n ignore it\n\n --nodes\n Per-node rows: label, online/offline, [online endpoints/total]\n\n -h, --help\n Print help (see a summary with '-h')\n```\n\n### spt subnet create\n\n```text\nMint a fresh subnet and print its joining material.\n\nThis node becomes the sole seed-holder. Mints BOTH subnet keys — the member key (current 6-digit\ncode, otpauth:// URI, terminal QR) and the admin key, whose provisioning material is shown HERE\nAND NOWHERE ELSE, EVER: scan it now or the subnet has no admin authority. Also states the subnet's\ncontrol-surface mode — asked with no preselection unless --open/--closed says it outright. Gated\nbehind OS elevation (the seed-reveal path).\n\nUsage: spt subnet create [OPTIONS] \n\nArguments:\n \n The new subnet's name\n\nOptions:\n --json\n Emit machine-readable JSON instead of the human view. Honored by the read/status commands\n (list, whoami, status, description, role, the *-list queries, how-to); action commands\n ignore it\n\n --open\n Unlisted subjects are ALLOWED on every control surface (today's fleet posture). Skips the\n mode question — for scripted creation\n\n --closed\n Unlisted subjects are BLOCKED unless an explicit rule allows. Skips the mode question —\n for scripted creation\n\n -h, --help\n Print help (see a summary with '-h')\n\nControl surfaces:\n MSG — direct messages (a grant binds the single sender)\n RC_VIEW — read-only terminal viewing (a grant admits the whole machine)\n RC_ATTACH — interactive terminal control (a grant admits the whole machine)\n DIGEST — cross-node digest pull (a grant admits the whole machine)\n WAKE — waking a resting endpoint (a grant admits the whole machine)\n SUSPEND — suspending a running endpoint (a grant admits the whole machine)\n SHELL_LINK — driving a linked shell (a grant admits the whole machine)\n DISCOVER — being found: resolve, advertise, and the resources blurb (a grant admits the whole\n machine)\n WEB — reading served resources over HTTP (a grant admits the whole machine)\n FORK — forking this endpoint, mind and all (a grant admits the whole machine)\n```\n\n### spt subnet show-code\n\n```text\nShow a subnet's current 6-digit pairing code (+ URI and QR).\n\nThe re-provisioning surface: prints the same joining material as create — current code,\notpauth:// URI, terminal QR, expiry. Gated behind OS elevation (or read the code from your\nauthenticator app). With no name the node's sole subnet is used; if it holds several, the name is\nrequired (never guessed).\n\nUsage: spt subnet show-code [OPTIONS] [NAME]\n\nArguments:\n [NAME]\n Which subnet's code to show. Required only when the node holds several\n\nOptions:\n --json\n Emit machine-readable JSON instead of the human view. Honored by the read/status commands\n (list, whoami, status, description, role, the *-list queries, how-to); action commands\n ignore it\n\n -h, --help\n Print help (see a summary with '-h')\n```\n\n### spt subnet join\n\n```text\nPair this machine into an existing subnet (guided).\n\nFinds a member machine over LAN + relay rendezvous and runs the code-authenticated pairing ceremony\nagainst it. Prompts for the name and code when omitted (interactive terminals). Gated behind OS\nelevation — joining enrolls this whole machine.\n\nUsage: spt subnet join [OPTIONS] [NAME]\n\nArguments:\n [NAME]\n The subnet to join (as named on the member machine)\n\nOptions:\n --code \n The current 6-digit code (spt subnet show-code on a member machine, or your\n authenticator app)\n\n --json\n Emit machine-readable JSON instead of the human view. Honored by the read/status commands\n (list, whoami, status, description, role, the *-list queries, how-to); action commands\n ignore it\n\n --verbose\n Print a detailed discovery trace (rendezvous attempts, elapsed vs deadline, the last\n concrete error) when the search struggles or fails — for diagnosing a join that can't find\n a member\n\n -h, --help\n Print help (see a summary with '-h')\n```\n\n### spt subnet leave\n\n```text\n…\n```\n\n…\n### spt endpoint list\n…\n```text\nMerged endpoint listing (the bare spt endpoint view).\n…\nshows — spt whoami is a thin alias and must see its own perch). --subnet filters the subnet view\nto one subnet; --detail adds each endpoint's description blurb (the resource-registry yellow-pages\nprojection).\n\nUsage: spt endpoint list [OPTIONS]\n\nOptions:\n --json\n Emit machine-readable JSON instead of the human view. Honored by the read/status commands\n (list, whoami, status, description, role, the *-list queries, how-to); action commands\n ignore it\n\n --subnet \n Limit the subnet view to one subnet\n\n --detail\n Add each endpoint's description blurb to the rows\n\n --show-all\n Also show suspended (resting) endpoints, which are hidden by default\n\n --workers\n Also show worker perches, which are hidden by default (they are process-local machinery\n under a parent agent, not standalone endpoints)\n\n -h, --help\n Print help (see a summary with '-h')\n```\n\n### spt endpoint create\n\n```text\nCreate a NEW endpoint and bring its first session up.\n\nThe only way an endpoint is minted. The adapter and working directory recorded here become the\nendpoint's session defaults — every later start lands on them unless told otherwise. The anchor\nsubnet is assigned here and is permanent (the cross-subnet move is fork). An id that already\nexists is REFUSED: bring the existing one up with start, or go straight to it with `spt go\n`.\n\nUsage: spt endpoint create [OPTIONS] \n\nArguments:\n \n The new endpoint's id (charset: alphanumeric, -, _)\n\nOptions:\n --json\n Emit machine-readable JSON instead of the human view. Honored by the read/status commands\n (list, whoami, status, description, role, the *-list queries, how-to); action commands\n ignore it\n\n --subnet \n Home this endpoint to a named subnet. Required on a node that holds more than one subnet\n (the anchor is assigned at creation and is permanent); the sole subnet is used\n automatically when there is one\n\n --adapter \n The harness adapter to host: [:profile] (must be a registered kind=\"harness\"\n adapter on this node). Omit on a node that has exactly one registered harness adapter\n\n --cwd \n The project folder the harness runs in (defaults to the directory this command is run\n from)\n\n -h, --help\n Print help (see a summary with '-h')\n```\n\n### spt endpoint start\n\n```text\nStart a NEW session on an endpoint that already exists.\n\nLands on the endpoint's most-recent adapter in its most-recent project folder — never on the folder\nyou happen to be standing in. --adapter / --cwd override this run AND become the new remembered\ndefaults. An UNKNOWN id is refused rather than minted (that is create's job); the sibling verbs\nare resume (its latest session), wake (an endpoint that is only resting, not offline), and\nspt go (start-and-attach, whatever state it is in).\n\nUsage: spt endpoint start [OPTIONS] \n\nArguments:\n \n The endpoint id to start a new session on\n\nOptions:\n --adapter \n Run this session under a different harness adapter, and remember it as the endpoint's\n adapter from now on\n\n --json\n Emit machine-readable JSON instead of the human view. Honored by the read/status commands\n (list, whoami, status, description, role, the *-list queries, how-to); action commands\n ignore it\n\n --cwd \n Run this session in a different project folder, and remember it as the endpoint's folder\n from now on\n\n -h, --help\n Print help (see a summary with '-h')\n```\n\n### spt endpoint resume\n\n```text\nResume an endpoint's LATEST session.\n\nBrings the endpoint back up on the last session it recorded, in the project folder that session ran\nin. An endpoint that has never recorded a session has nothing to resume — start it instead. The\nsiblings are start (a fresh session), wake (it is only resting, not offline), and `spt go\n` (resume-and-attach).\n\nUsage: spt endpoint resume [OPTIONS] \n\nArguments:\n \n The endpoint id whose latest session to resume\n\nOptions:\n --json\n Emit machine-readable JSON instead of the human view. Honored by the read/status commands\n (list, whoami, status, description, role, the *-list queries, how-to); action commands\n ignore it\n\n -h, --help\n Print help (see a summary with '-h')\n```\n\n### spt endpoint auto-start\n\n```text\nReplay this endpoint at every daemon start.\n\nRecords a startup default: the daemon brings the endpoint up (a fresh session, on its remembered\nadapter and folder) every time it starts, until you turn it off with --off. One entry per endpoint\nid — setting it again replaces the prior one. An endpoint that fails to come up logs the failure and\nnever blocks the daemon.\n\nUsage: spt endpoint auto-start [OPTIONS] \n…\n Print help (see a summary with '-h')\n```\n","startLine":1361,"lineNumbers":[1361,1362,1363,1364,1365,1366,1367,1368,1369,1370,1371,1372,1373,1374,1375,1376,1377,1378,1379,1380,1381,1382,1383,1384,1385,1386,1387,1388,1389,1390,1391,1392,1393,1394,1395,1396,1397,1398,1399,1400,1401,1402,1403,1404,1405,1406,1407,1408,1409,1410,1411,1412,1413,1414,1415,1416,1417,1418,null,1425,1426,null,1510,null,1513,1514,null,1538,1539,1540,1541,1542,1543,1544,1545,1546,1547,1548,1549,1550,1551,1552,1553,1554,1555,1556,1557,1558,1559,1560,1561,1562,1563,1564,1565,1566,1567,1568,1569,1570,1571,1572,1573,1574,1575,1576,1577,1578,1579,1580,1581,1582,1583,1584,1585,1586,1587,1588,1589,1590,1591,1592,1593,1594,1595,1596,1597,1598,1599,1600,1601,1602,1603,1604,1605,1606,1607,1608,1609,1610,1611,1612,1613,1614,1615,1616,1617,1618,1619,1620,1621,1622,1623,1624,1625,1626,1627,1628,1629,1630,1631,1632,1633,1634,1635,1636,1637,1638,1639,1640,1641,1642,1643,1644,1645,1646,1647,1648,1649,1650,1651,1652,1653,1654,1655,1656,1657,1658,1659,1660,1661,1662,1663,1664,1665,1666,1667,1668,1669,1670,1671,1672,1673,1674,1675,1676,1677,1678,1679,1680,null,1701,1702,null,2953,null,2955,2956,null,2960,2961,2962,2963,2964,2965,2966,2967,2968,2969,2970,2971,2972,2973,2974,2975,2976,2977,2978,2979,2980,2981,2982,2983,2984,2985,2986,2987,2988,2989,2990,2991,2992,2993,2994,2995,2996,2997,2998,2999,3000,3001,3002,3003,3004,3005,3006,3007,3008,3009,3010,3011,3012,3013,3014,3015,3016,3017,3018,3019,3020,3021,3022,3023,3024,3025,3026,3027,3028,3029,3030,3031,3032,3033,3034,3035,3036,3037,3038,3039,3040,3041,3042,3043,3044,3045,3046,3047,3048,3049,3050,3051,3052,3053,3054,3055,3056,3057,3058,3059,3060,3061,3062,3063,3064,3065,3066,3067,3068,3069,3070,3071,3072,3073,3074,3075,3076,3077,3078,3079,3080,3081,3082,3083,3084,3085,3086,3087,3088,3089,3090,3091,3092,3093,3094,3095,3096,3097,3098,3099,3100,null,3116,3117,3118]},"fileSize":184288,"meta":{"source":{"type":"path","value":"C:\\Users\\decid\\Documents\\projects\\spt-core\\docs-site\\src\\cli\\reference.md"}}},"isError":false,"timestamp":1790029763121}}
{"type":"message","id":"20c3be12","parentId":"d2309a43","timestamp":"2026-09-21T22:29:23.130Z","message":{"role":"toolResult","toolCallId":"call_YyJc2URK1tGhnPXtJH2GU1Oi|fc_0c7d22595484f800016ab1afc2dd2887d2aa822c66ea3ef6ce","toolName":"grep","content":[{"type":"text","text":"# crates/\n\n## spt/src/\n### rc.rs\n 3063| InputPathReply {\n*3064| receipt_id: request.receipt_id,\n 3065| results: request.paths.into_iter()\n 3066| .take(spt_store::helperline::MAX_QUOTED_PATHS)\n 3067| .map(|path| InputPathResult {\n...\n 3121| } else {\n*3122| match call_with_timeout(&socket, ServeRequest::AddInputReference {\n 3123| path: std::path::PathBuf::from(&path),\n*3124| receipt_id: request.receipt_id.clone(),\n 3125| audience: audience.to_owned(),\n 3126| received_at_ms: request.received_at_ms,\n 3127| }, remaining.min(Duration::from_secs(1))) {\n...\n 3149| }\n*3150| (InputPathReply { receipt_id: request.receipt_id, results }, timed_out)\n 3151|}\n 3152|\n 3153|/// The full-duplex pump: drain stdin → `send_attach_input`; render inbound\n...\n 3698| #[test]\n*3699| fn declined_input_paths_remain_receipt_bound_and_bounded() {\n 3700| let reply = decline_input_paths(InputPathRequest {\n*3701| receipt_id: \"receipt\".into(),\n 3702| session: \"session\".into(),\n 3703| paths: (0..20).map(|n| format!(\"/file-{n}\")).collect(),\n 3704| received_at_ms: 1,\n 3705| }, \"INPUT_PATH_VIEWER\");\n*3706| assert_eq!(reply.receipt_id, \"receipt\");\n 3707| assert_eq!(reply.results.len(), 5);\n 3708| assert!(reply.results.iter().all(|result| matches!(\n 3709| &result.outcome, InputPathOutcome::Declined { reason } if reason == \"INPUT_PATH_VIEWER\"\n\n## spt-daemon/src/\n### broker.rs\n 3863| Ceremony(Envelope),\n*3864| /// A receipt-bound file request, never output and never a cursor advance.\n 3865| InputPaths(Envelope),\n 3866|}\n 3867|\n...\n 4168| /// Live-reference dedup and reply custody survive a brain restart.\n*4169| input_reports: Arc>,\n 4170| /// The output drain pump (kept so teardown can stop it).\n 4171| #[allow(dead_code)] // held for ownership/teardown; not read directly\n 4172| drain: Drain,\n...\n 6382| crate::msg::KIND_USER_INPUT_REPORT => {\n*6383| let result = self.dispatch_user_input_report(env);\n*6384| let reply = crate::msg::UserInputReported { declined: result.err() };\n 6385| send_frame(&send, &Envelope::new(crate::msg::KIND_USER_INPUT_REPORTED,\n*6386| serde_json::to_value(reply).expect(\"UserInputReported serializes\")));\n 6387| }\n 6388| crate::msg::KIND_USER_INPUT_PATHS_REPLY => {\n 6389| if let Err(reason) = self.dispatch_input_paths_reply(env, &send) {\n...\n 8706| input,\n*8707| input_reports: Arc::new(Mutex::new(crate::inputreceipt::ReceiptBook::default())),\n 8708| drain,\n 8709| log,\n 8710| endpoint: req.endpoint.clone(),\n...\n 9022| // [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\n*9023| fn dispatch_user_input_report(&self, env: Envelope) -> Result<(), String> {\n*9024| let req: crate::msg::UserInputReport = serde_json::from_value(env.payload)\n 9025| .map_err(|e| format!(\"bad USER_INPUT report: {e}\"))?;\n 9026| let (log, input, reports) = {\n 9027| let sessions = recover(&self.sessions);\n...\n 9042| let local_node = crate::access::local_node_hex();\n*9043| if crate::inputreceipt::remote_origin(Some(by.as_deref()), local_node.as_deref())\n 9044| .map_err(str::to_owned)?.is_none()\n 9045| {\n 9046| return Ok(());\n...\n 9054| if req.expires_at_ms <= crate::brain::now_ms() {\n*9055| return Err(\"input report expired before broker receipt\".into());\n 9056| }\n 9057| // Status first: an in-progress physical write has not published its\n 9058| // digest yet. A remote report must not guess while evidence is uncertain.\n...\n 9071| if controller_tx.try_send(CtrlMsg::InputPaths(frame)).is_err() {\n*9072| recover(&reports).cancel_unsent(&request.receipt_id);\n*9073| return Err(\"receipt-bound controller queue unavailable\".into());\n 9074| }\n 9075| // Bounded independently of every rc pump and hook. In-flight admission\n 9076| // is capped by ReceiptBook, so silent clients cannot grow unlimited waiters.\n 9077| thread::spawn(move || {\n*9078| thread::sleep(crate::inputreceipt::REPLY_BOUND);\n*9079| if recover(&reports).timeout(&request.receipt_id) {\n 9080| spt_proto::emit_line_err!(\n*9081| \"HELPER_SERVE_FOR: target={} receipt={} outcome=unanswered reason=controller reply deadline\",\n*9082| req.endpoint, request.receipt_id,\n 9083| );\n 9084| }\n 9085| });\n...\n 9099| let mut book = recover(&reports);\n*9100| if !book.contains(&reply.receipt_id) { continue; }\n 9101| book.complete(&reply, send.id(), crate::brain::now_ms()).map_err(str::to_owned)?\n 9102| };\n 9103| let perch = resolve_perch_path(&endpoint, ParentHint::Infer);\n...\n 9117| }\n*9118| Err(\"reply has no live broker-session receipt\".into())\n 9119| }\n 9120|\n 9121| /// Deliver an inbound message to an spt-hosted endpoint by ENDPOINT ID:\n...\n 10488| #[test]\n*10489| fn input_receipt_local_is_silent_then_remote_stays_bound_across_take() {\n 10490| use spt_net::net::attach::{InputPathOutcome, InputPathReply, InputPathRequest, InputPathResult};\n 10491| crate::test_home::with_home(|_| {\n 10492| struct Child(Arc);\n...\n 10497| let broker = admit_test_broker();\n*10498| let endpoint = \"receipt-seat\";\n 10499| let perch = resolve_perch_path(endpoint, ParentHint::Infer);\n 10500| std::fs::create_dir_all(&perch).unwrap();\n 10501| spt_store::info::write_info(&perch, &spt_store::info::InfoJson::new(\n### servehost.rs\n 56| /// The audience is its established target, never a field supplied by the peer.\n*57| AddInputReference {\n 58| path: PathBuf,\n*59| receipt_id: String,\n 60| audience: String,\n 61| received_at_ms: u64,\n 62| },\n...\n 149| let mut registry = ServingRegistry::load_at(&path).map_err(|error| {\n*150| if matches!(&request, ServeRequest::AddInputReference { .. }) {\n 151| io::Error::new(error.kind(), format!(\"INPUT_PATH_REGISTRY: {error}\"))\n 152| } else {\n 153| error\n...\n 219| }\n*220| ServeRequest::AddInputReference { path: source, receipt_id, audience, received_at_ms } => {\n 221| // Resolve the submitter's home HERE, never on the receiving node.\n 222| let source = if let Some(relative) = source.to_str().and_then(|p| p.strip_prefix(\"~/\")) {\n 223| std::env::home_dir()\n...\n 230| .map(|entry| entry.id.clone());\n*231| match registry.add_input_reference(&source, &receipt_id, &audience, received_at_ms, now_ms)? {\n 232| None => Ok(ServeResult::Missing),\n 233| Some(entry) => {\n 234| if previous_id.as_deref() != Some(entry.id.as_str()) {\n...\n 467|\n*468| fn input_reference(path: &Path, receipt: &str, audience: &str, received_at_ms: u64) -> ServeRequest {\n*469| ServeRequest::AddInputReference {\n 470| path: path.to_owned(),\n*471| receipt_id: receipt.into(),\n 472| audience: audience.into(),\n 473| received_at_ms,\n 474| }\n...\n 477| #[test]\n*478| fn input_reference_missing_is_a_silent_skip_without_registry_publication() {\n 479| let tmp = tempfile::tempdir().unwrap();\n 480| let home = tmp.path().join(\"home\");\n*481| let result = apply_at(&home, input_reference(&tmp.path().join(\"missing\"), \"r1\", \"agent\", 1), 1)\n 482| .unwrap();\n 483| assert!(matches!(result, ServeResult::Missing));\n 484| assert!(!spt_store::perch::serving_registry_file_in(&home).exists());\n...\n 487| #[test]\n*488| fn input_reference_replay_preserves_the_live_entry_and_deadline() {\n 489| let tmp = tempfile::tempdir().unwrap();\n 490| let home = tmp.path().join(\"home\");\n 491| let source = tmp.path().join(\"report.txt\");\n 492| std::fs::write(&source, b\"before\").unwrap();\n*493| let ServeResult::Entry { entry } = apply_at(&home, input_reference(&source, \"r1\", \"agent\", 10), 20)\n 494| .unwrap() else { panic!(\"expected reference\") };\n 495| let ServeResult::Entry { entry: replay } =\n*496| apply_at(&home, input_reference(&source, \"r1\", \"agent\", 50), 50).unwrap()\n 497| else { panic!(\"expected replay\") };\n 498| assert_eq!(replay, entry);\n 499| // A second submission can reuse the same narrow exposure, not renew it.\n 500| let ServeResult::Entry { entry: second } =\n*501| apply_at(&home, input_reference(&source, \"r2\", \"agent\", 60), 60).unwrap()\n 502| else { panic!(\"expected shared live reference\") };\n 503| assert_eq!(second, entry);\n 504| assert_eq!(list(&home), vec![entry]);\n...\n 507| #[test]\n*508| fn input_reference_cannot_rescope_another_audience_or_unrelated_entry() {\n 509| let tmp = tempfile::tempdir().unwrap();\n 510| let home = tmp.path().join(\"home\");\n 511| let source = tmp.path().join(\"report.txt\");\n...\n 514| std::fs::write(&ordinary, b\"ordinary\").unwrap();\n*515| apply_at(&home, input_reference(&source, \"r1\", \"agent\", 10), 10).unwrap();\n 516| apply_at(&home, add(&ordinary), 10).unwrap();\n 517| let before = list(&home);\n 518| for request in [\n*519| input_reference(&source, \"r1\", \"other\", 20),\n*520| input_reference(&ordinary, \"r2\", \"agent\", 20),\n 521| ] {\n 522| let error = apply_at(&home, request, 20).unwrap_err();\n 523| assert_eq!(error.kind(), io::ErrorKind::PermissionDenied);\n...\n 529| #[test]\n*530| fn input_reference_expiry_cannot_be_renewed_by_replay_before_or_after_reaping() {\n 531| let tmp = tempfile::tempdir().unwrap();\n 532| let home = tmp.path().join(\"home\");\n 533| let source = tmp.path().join(\"report.txt\");\n 534| std::fs::write(&source, b\"live\").unwrap();\n*535| let request = input_reference(&source, \"r1\", \"agent\", 10);\n 536| let ServeResult::Entry { entry } = apply_at(&home, request.clone(), 10).unwrap()\n 537| else { panic!(\"expected reference\") };\n 538| let expires = 10 + spt_store::serving::HELPER_ENTRY_TTL_MS;"}],"details":{"scopePath":"crates/spt/src/rc.rs, crates/spt-daemon/src/broker.rs, crates/spt-daemon/src/attach.rs, crates/spt-daemon/src/servehost.rs","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core\\crates","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":47,"fileCount":3,"files":["crates/spt/src/rc.rs","crates/spt-daemon/src/broker.rs","crates/spt-daemon/src/servehost.rs"],"fileMatches":[{"path":"crates/spt/src/rc.rs","count":7},{"path":"crates/spt-daemon/src/broker.rs","count":20},{"path":"crates/spt-daemon/src/servehost.rs","count":20}],"truncated":true,"perFileLimitReached":20,"displayContent":"# crates/\n\n## spt/src/\n### rc.rs\n 3063│ InputPathReply {\n*3064│ receipt_id: request.receipt_id,\n 3065│ results: request.paths.into_iter()\n 3066│ .take(spt_store::helperline::MAX_QUOTED_PATHS)\n 3067│ .map(|path| InputPathResult {\n │...\n 3121│ } else {\n*3122│ match call_with_timeout(&socket, ServeRequest::AddInputReference {\n 3123│ path: std::path::PathBuf::from(&path),\n*3124│ receipt_id: request.receipt_id.clone(),\n 3125│ audience: audience.to_owned(),\n 3126│ received_at_ms: request.received_at_ms,\n 3127│ }, remaining.min(Duration::from_secs(1))) {\n │...\n 3149│ }\n*3150│ (InputPathReply { receipt_id: request.receipt_id, results }, timed_out)\n 3151│}\n 3152│\n 3153│/// The full-duplex pump: drain stdin → `send_attach_input`; render inbound\n │...\n 3698│ #[test]\n*3699│ fn declined_input_paths_remain_receipt_bound_and_bounded() {\n 3700│ let reply = decline_input_paths(InputPathRequest {\n*3701│ receipt_id: \"receipt\".into(),\n 3702│ session: \"session\".into(),\n 3703│ paths: (0..20).map(|n| format!(\"/file-{n}\")).collect(),\n 3704│ received_at_ms: 1,\n 3705│ }, \"INPUT_PATH_VIEWER\");\n*3706│ assert_eq!(reply.receipt_id, \"receipt\");\n 3707│ assert_eq!(reply.results.len(), 5);\n 3708│ assert!(reply.results.iter().all(|result| matches!(\n 3709│ &result.outcome, InputPathOutcome::Declined { reason } if reason == \"INPUT_PATH_VIEWER\"\n\n## spt-daemon/src/\n### broker.rs\n 3863│ Ceremony(Envelope),\n *3864│ /// A receipt-bound file request, never output and never a cursor advance.\n 3865│ InputPaths(Envelope),\n 3866│}\n 3867│\n │...\n 4168│ /// Live-reference dedup and reply custody survive a brain restart.\n *4169│ input_reports: Arc>,\n 4170│ /// The output drain pump (kept so teardown can stop it).\n 4171│ #[allow(dead_code)] // held for ownership/teardown; not read directly\n 4172│ drain: Drain,\n │...\n 6382│ crate::msg::KIND_USER_INPUT_REPORT => {\n *6383│ let result = self.dispatch_user_input_report(env);\n *6384│ let reply = crate::msg::UserInputReported { declined: result.err() };\n 6385│ send_frame(&send, &Envelope::new(crate::msg::KIND_USER_INPUT_REPORTED,\n *6386│ serde_json::to_value(reply).expect(\"UserInputReported serializes\")));\n 6387│ }\n 6388│ crate::msg::KIND_USER_INPUT_PATHS_REPLY => {\n 6389│ if let Err(reason) = self.dispatch_input_paths_reply(env, &send) {\n │...\n 8706│ input,\n *8707│ input_reports: Arc::new(Mutex::new(crate::inputreceipt::ReceiptBook::default())),\n 8708│ drain,\n 8709│ log,\n 8710│ endpoint: req.endpoint.clone(),\n │...\n 9022│ // [impl->REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT]\n *9023│ fn dispatch_user_input_report(&self, env: Envelope) -> Result<(), String> {\n *9024│ let req: crate::msg::UserInputReport = serde_json::from_value(env.payload)\n 9025│ .map_err(|e| format!(\"bad USER_INPUT report: {e}\"))?;\n 9026│ let (log, input, reports) = {\n 9027│ let sessions = recover(&self.sessions);\n │...\n 9042│ let local_node = crate::access::local_node_hex();\n *9043│ if crate::inputreceipt::remote_origin(Some(by.as_deref()), local_node.as_deref())\n 9044│ .map_err(str::to_owned)?.is_none()\n 9045│ {\n 9046│ return Ok(());\n │...\n 9054│ if req.expires_at_ms <= crate::brain::now_ms() {\n *9055│ return Err(\"input report expired before broker receipt\".into());\n 9056│ }\n 9057│ // Status first: an in-progress physical write has not published its\n 9058│ // digest yet. A remote report must not guess while evidence is uncertain.\n │...\n 9071│ if controller_tx.try_send(CtrlMsg::InputPaths(frame)).is_err() {\n *9072│ recover(&reports).cancel_unsent(&request.receipt_id);\n *9073│ return Err(\"receipt-bound controller queue unavailable\".into());\n 9074│ }\n 9075│ // Bounded independently of every rc pump and hook. In-flight admission\n 9076│ // is capped by ReceiptBook, so silent clients cannot grow unlimited waiters.\n 9077│ thread::spawn(move || {\n *9078│ thread::sleep(crate::inputreceipt::REPLY_BOUND);\n *9079│ if recover(&reports).timeout(&request.receipt_id) {\n 9080│ spt_proto::emit_line_err!(\n *9081│ \"HELPER_SERVE_FOR: target={} receipt={} outcome=unanswered reason=controller reply deadline\",\n *9082│ req.endpoint, request.receipt_id,\n 9083│ );\n 9084│ }\n 9085│ });\n │...\n 9099│ let mut book = recover(&reports);\n *9100│ if !book.contains(&reply.receipt_id) { continue; }\n 9101│ book.complete(&reply, send.id(), crate::brain::now_ms()).map_err(str::to_owned)?\n 9102│ };\n 9103│ let perch = resolve_perch_path(&endpoint, ParentHint::Infer);\n │...\n 9117│ }\n *9118│ Err(\"reply has no live broker-session receipt\".into())\n 9119│ }\n 9120│\n 9121│ /// Deliver an inbound message to an spt-hosted endpoint by ENDPOINT ID:\n │...\n 10488│ #[test]\n*10489│ fn input_receipt_local_is_silent_then_remote_stays_bound_across_take() {\n 10490│ use spt_net::net::attach::{InputPathOutcome, InputPathReply, InputPathRequest, InputPathResult};\n 10491│ crate::test_home::with_home(|_| {\n 10492│ struct Child(Arc);\n │...\n 10497│ let broker = admit_test_broker();\n*10498│ let endpoint = \"receipt-seat\";\n 10499│ let perch = resolve_perch_path(endpoint, ParentHint::Infer);\n 10500│ std::fs::create_dir_all(&perch).unwrap();\n 10501│ spt_store::info::write_info(&perch, &spt_store::info::InfoJson::new(\n### servehost.rs\n 56│ /// The audience is its established target, never a field supplied by the peer.\n *57│ AddInputReference {\n 58│ path: PathBuf,\n *59│ receipt_id: String,\n 60│ audience: String,\n 61│ received_at_ms: u64,\n 62│ },\n │...\n 149│ let mut registry = ServingRegistry::load_at(&path).map_err(|error| {\n*150│ if matches!(&request, ServeRequest::AddInputReference { .. }) {\n 151│ io::Error::new(error.kind(), format!(\"INPUT_PATH_REGISTRY: {error}\"))\n 152│ } else {\n 153│ error\n │...\n 219│ }\n*220│ ServeRequest::AddInputReference { path: source, receipt_id, audience, received_at_ms } => {\n 221│ // Resolve the submitter's home HERE, never on the receiving node.\n 222│ let source = if let Some(relative) = source.to_str().and_then(|p| p.strip_prefix(\"~/\")) {\n 223│ std::env::home_dir()\n │...\n 230│ .map(|entry| entry.id.clone());\n*231│ match registry.add_input_reference(&source, &receipt_id, &audience, received_at_ms, now_ms)? {\n 232│ None => Ok(ServeResult::Missing),\n 233│ Some(entry) => {\n 234│ if previous_id.as_deref() != Some(entry.id.as_str()) {\n │...\n 467│\n*468│ fn input_reference(path: &Path, receipt: &str, audience: &str, received_at_ms: u64) -> ServeRequest {\n*469│ ServeRequest::AddInputReference {\n 470│ path: path.to_owned(),\n*471│ receipt_id: receipt.into(),\n 472│ audience: audience.into(),\n 473│ received_at_ms,\n 474│ }\n │...\n 477│ #[test]\n*478│ fn input_reference_missing_is_a_silent_skip_without_registry_publication() {\n 479│ let tmp = tempfile::tempdir().unwrap();\n 480│ let home = tmp.path().join(\"home\");\n*481│ let result = apply_at(&home, input_reference(&tmp.path().join(\"missing\"), \"r1\", \"agent\", 1), 1)\n 482│ .unwrap();\n 483│ assert!(matches!(result, ServeResult::Missing));\n 484│ assert!(!spt_store::perch::serving_registry_file_in(&home).exists());\n │...\n 487│ #[test]\n*488│ fn input_reference_replay_preserves_the_live_entry_and_deadline() {\n 489│ let tmp = tempfile::tempdir().unwrap();\n 490│ let home = tmp.path().join(\"home\");\n 491│ let source = tmp.path().join(\"report.txt\");\n 492│ std::fs::write(&source, b\"before\").unwrap();\n*493│ let ServeResult::Entry { entry } = apply_at(&home, input_reference(&source, \"r1\", \"agent\", 10), 20)\n 494│ .unwrap() else { panic!(\"expected reference\") };\n 495│ let ServeResult::Entry { entry: replay } =\n*496│ apply_at(&home, input_reference(&source, \"r1\", \"agent\", 50), 50).unwrap()\n 497│ else { panic!(\"expected replay\") };\n 498│ assert_eq!(replay, entry);\n 499│ // A second submission can reuse the same narrow exposure, not renew it.\n 500│ let ServeResult::Entry { entry: second } =\n*501│ apply_at(&home, input_reference(&source, \"r2\", \"agent\", 60), 60).unwrap()\n 502│ else { panic!(\"expected shared live reference\") };\n 503│ assert_eq!(second, entry);\n 504│ assert_eq!(list(&home), vec![entry]);\n │...\n 507│ #[test]\n*508│ fn input_reference_cannot_rescope_another_audience_or_unrelated_entry() {\n 509│ let tmp = tempfile::tempdir().unwrap();\n 510│ let home = tmp.path().join(\"home\");\n 511│ let source = tmp.path().join(\"report.txt\");\n │...\n 514│ std::fs::write(&ordinary, b\"ordinary\").unwrap();\n*515│ apply_at(&home, input_reference(&source, \"r1\", \"agent\", 10), 10).unwrap();\n 516│ apply_at(&home, add(&ordinary), 10).unwrap();\n 517│ let before = list(&home);\n 518│ for request in [\n*519│ input_reference(&source, \"r1\", \"other\", 20),\n*520│ input_reference(&ordinary, \"r2\", \"agent\", 20),\n 521│ ] {\n 522│ let error = apply_at(&home, request, 20).unwrap_err();\n 523│ assert_eq!(error.kind(), io::ErrorKind::PermissionDenied);\n │...\n 529│ #[test]\n*530│ fn input_reference_expiry_cannot_be_renewed_by_replay_before_or_after_reaping() {\n 531│ let tmp = tempfile::tempdir().unwrap();\n 532│ let home = tmp.path().join(\"home\");\n 533│ let source = tmp.path().join(\"report.txt\");\n 534│ std::fs::write(&source, b\"live\").unwrap();\n*535│ let request = input_reference(&source, \"r1\", \"agent\", 10);\n 536│ let ServeResult::Entry { entry } = apply_at(&home, request.clone(), 10).unwrap()\n 537│ else { panic!(\"expected reference\") };\n 538│ let expires = 10 + spt_store::serving::HELPER_ENTRY_TTL_MS;"},"isError":false,"timestamp":1790029763129}}
{"type":"message","id":"ffb5fcc3","parentId":"20c3be12","timestamp":"2026-09-21T22:29:23.170Z","message":{"role":"toolResult","toolCallId":"call_m85pOE6fxzRc28g5bZVWIvBv|fc_0c7d22595484f800016ab1afc2dd4c87d2816a627b1fbd02a0","toolName":"grep","content":[{"type":"text","text":"# crates/\n\n## spt/src/api/\n### mod.rs\n 473| /// turn-boundary hook.\n*474| NowSignal {\n 475| /// The calling endpoint id.\n 476| id: String,\n 477| /// The harness session id keying every category's seen-set. A `/clear`\n...\n 493| #[arg(long)]\n*494| spec_file: Option,\n 495| },\n 496| /// Graceful live-agent signoff: run the final context save BEFORE\n 497| /// teardown, then soft-stop. The `spt shutdown` lifecycle path.\n...\n 517|#[derive(Args)]\n*518|pub struct AuthFlags {\n 519| /// Capability token proving association to the target perch.\n 520| #[arg(long)]\n 521| token: Option,\n...\n 648| // [impl->REQ-NOW-SIGNAL-VERB]\n*649| ApiCmd::NowSignal {\n 650| id,\n 651| session,\n 652| user_input,\n...\n 654| spec_manifest,\n*655| spec_file,\n 656| } => {\n 657| if !user_input.is_empty() {\n 658| nowsignal::report_user_input(&id, &session, &user_input);\n 659| }\n*660| let spec = nowsignal::resolve_spec(&ctx, spec_manifest, spec_file.as_deref());\n 661| nowsignal::cmd_now_signal(&ctx, &id, &session, &user_input, &agent_output, &spec)\n 662| }\n 663| // Harness-hosted startup (T4). Seed establishes; listen consumes+binds;\n\n## spt-daemon/src/\n### endpoint.rs\n 36|/// The broker listener name (B1/B2): PTY hosting + gapless handoff.\n*37|pub fn broker_socket_name() -> String {\n 38| format!(\"spt-daemon-broker-{}.sock\", home_tag())\n 39|}\n 40|\n\n# docs-site/src/\n\n## harness-contract/\n### manifest.md\n 430|\n*431|## `[inject]` — input-injection methods\n 432|\n 433|How text can be put in front of the agent, per activity state. Any\n 434|combination of `pty`, `hook`, `relay`, `http`:\n...\n 436|```toml\n*437|[inject]\n 438|activity = [\"hook\"] # non-disruptive while the agent is working\n 439|idle = [\"pty\", \"hook\"]\n 440|```\n...\n 513|coexists with an attached operator (spt-core owns every PTY write). **Idle delivery\n*514|only** — busy / mid-turn delivery stays your `[inject]` hook path.\n 515|\n 516|\n 517|**Every byte spt-core writes on this leg, so your editor is never surprised.** Three\n\n## cli/\n### reference.md\n 80| registered beside the adapter that survives adapter add re-registration. The\n*81| overlay TOML is read from --from or piped stdin (empty = a placeholder\n 82| profile to populate later with set-string). Refuses a name shadowing a shipped\n 83| profile, an invalid name, or an overlay that loosens a consent floor — nothing is\n 84| written unless every check passes\n...\n 243|Create (or overwrite) a local profile — a node-local sparse overlay registered beside the\n*244|adapter that survives adapter add re-registration. The overlay TOML is read from --from \n 245|or piped stdin (empty = a placeholder profile to populate later with set-string). Refuses a name\n 246|shadowing a shipped profile, an invalid name, or an overlay that loosens a consent floor — nothing\n 247|is written unless every check passes\n...\n 255|Options:\n*256| --from Read the overlay TOML from this file instead of stdin\n 257| --json Emit machine-readable JSON instead of the human view. Honored by the\n 258| read/status commands (list, whoami, status, description, role, the *-list\n 259| queries, how-to); action commands ignore it\n...\n 1838|\n*1839| --from \n 1840| Issuer endpoint id (auto-detected from session if omitted)\n 1841|\n 1842| -h, --help\n...\n 3954|\n*3955|Usage: spt endpoint monic clone [OPTIONS] --from [TARGET]\n 3956|\n 3957|Arguments:\n 3958| [TARGET]\n...\n 3969|\n*3970| --from \n 3971| The endpoint to copy FROM\n 3972|\n 3973| --to \n...\n 4148|Options:\n*4149| --from \n 4150| Sender id (auto-detected from session if omitted)\n 4151|\n 4152| --json\n...\n 4245|Options:\n*4246| --from Sender id carried structurally as the message from (auto-detected\n 4247| from session if omitted)\n 4248| --json Emit machine-readable JSON instead of the human view. Honored by the\n 4249| read/status commands (list, whoami, status, description, role, the"}],"details":{"scopePath":"crates/spt/src/api/mod.rs, crates/spt-daemon/src/endpoint.rs, crates/spt/tests/common/mod.rs, docs-site/src/harness-contract/manifest.md, docs-site/src/cli/reference.md","searchPath":"C:\\Users\\decid\\Documents\\projects\\spt-core","cwd":"C:\\Users\\decid\\Documents\\projects\\spt-core","matchCount":18,"fileCount":4,"files":["crates/spt/src/api/mod.rs","crates/spt-daemon/src/endpoint.rs","docs-site/src/harness-contract/manifest.md","docs-site/src/cli/reference.md"],"fileMatches":[{"path":"crates/spt/src/api/mod.rs","count":6},{"path":"crates/spt-daemon/src/endpoint.rs","count":1},{"path":"docs-site/src/harness-contract/manifest.md","count":3},{"path":"docs-site/src/cli/reference.md","count":8}],"truncated":false,"displayContent":"# crates/\n\n## spt/src/api/\n### mod.rs\n 473│ /// turn-boundary hook.\n*474│ NowSignal {\n 475│ /// The calling endpoint id.\n 476│ id: String,\n 477│ /// The harness session id keying every category's seen-set. A `/clear`\n │...\n 493│ #[arg(long)]\n*494│ spec_file: Option,\n 495│ },\n 496│ /// Graceful live-agent signoff: run the final context save BEFORE\n 497│ /// teardown, then soft-stop. The `spt shutdown` lifecycle path.\n │...\n 517│#[derive(Args)]\n*518│pub struct AuthFlags {\n 519│ /// Capability token proving association to the target perch.\n 520│ #[arg(long)]\n 521│ token: Option,\n │...\n 648│ // [impl->REQ-NOW-SIGNAL-VERB]\n*649│ ApiCmd::NowSignal {\n 650│ id,\n 651│ session,\n 652│ user_input,\n │...\n 654│ spec_manifest,\n*655│ spec_file,\n 656│ } => {\n 657│ if !user_input.is_empty() {\n 658│ nowsignal::report_user_input(&id, &session, &user_input);\n 659│ }\n*660│ let spec = nowsignal::resolve_spec(&ctx, spec_manifest, spec_file.as_deref());\n 661│ nowsignal::cmd_now_signal(&ctx, &id, &session, &user_input, &agent_output, &spec)\n 662│ }\n 663│ // Harness-hosted startup (T4). Seed establishes; listen consumes+binds;\n\n## spt-daemon/src/\n### endpoint.rs\n 36│/// The broker listener name (B1/B2): PTY hosting + gapless handoff.\n*37│pub fn broker_socket_name() -> String {\n 38│ format!(\"spt-daemon-broker-{}.sock\", home_tag())\n 39│}\n 40│\n\n# docs-site/src/\n\n## harness-contract/\n### manifest.md\n 430│\n*431│## `[inject]` — input-injection methods\n 432│\n 433│How text can be put in front of the agent, per activity state. Any\n 434│combination of `pty`, `hook`, `relay`, `http`:\n │...\n 436│```toml\n*437│[inject]\n 438│activity = [\"hook\"] # non-disruptive while the agent is working\n 439│idle = [\"pty\", \"hook\"]\n 440│```\n │...\n 513│coexists with an attached operator (spt-core owns every PTY write). **Idle delivery\n*514│only** — busy / mid-turn delivery stays your `[inject]` hook path.\n 515│\n 516│\n 517│**Every byte spt-core writes on this leg, so your editor is never surprised.** Three\n\n## cli/\n### reference.md\n 80│ registered beside the adapter that survives adapter add re-registration. The\n *81│ overlay TOML is read from --from or piped stdin (empty = a placeholder\n 82│ profile to populate later with set-string). Refuses a name shadowing a shipped\n 83│ profile, an invalid name, or an overlay that loosens a consent floor — nothing is\n 84│ written unless every check passes\n │...\n 243│Create (or overwrite) a local profile — a node-local sparse overlay registered beside the\n *244│adapter that survives adapter add re-registration. The overlay TOML is read from --from \n 245│or piped stdin (empty = a placeholder profile to populate later with set-string). Refuses a name\n 246│shadowing a shipped profile, an invalid name, or an overlay that loosens a consent floor — nothing\n 247│is written unless every check passes\n │...\n 255│Options:\n *256│ --from Read the overlay TOML from this file instead of stdin\n 257│ --json Emit machine-readable JSON instead of the human view. Honored by the\n 258│ read/status commands (list, whoami, status, description, role, the *-list\n 259│ queries, how-to); action commands ignore it\n │...\n 1838│\n*1839│ --from \n 1840│ Issuer endpoint id (auto-detected from session if omitted)\n 1841│\n 1842│ -h, --help\n │...\n 3954│\n*3955│Usage: spt endpoint monic clone [OPTIONS] --from [TARGET]\n 3956│\n 3957│Arguments:\n 3958│ [TARGET]\n │...\n 3969│\n*3970│ --from \n 3971│ The endpoint to copy FROM\n 3972│\n 3973│ --to \n │...\n 4148│Options:\n*4149│ --from \n 4150│ Sender id (auto-detected from session if omitted)\n 4151│\n 4152│ --json\n │...\n 4245│Options:\n*4246│ --from Sender id carried structurally as the message from (auto-detected\n 4247│ from session if omitted)\n 4248│ --json Emit machine-readable JSON instead of the human view. Honored by the\n 4249│ read/status commands (list, whoami, status, description, role, the"},"isError":false,"timestamp":1790029763168}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_B6tpbQ5TYKsXjtOWipJGC0B9|fc_0c7d22595484f800016ab1afcc386487d287da033fed1e23a6","toolName":"read","startedAt":"2026-09-21T22:29:32.298Z","args":{"path":"crates/spt-daemon/src/broker.rs:9020-9120"},"intent":"Reading receipt authority implementation"},"id":"6f175685","parentId":"ffb5fcc3","timestamp":"2026-09-21T22:29:32.298Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_kWg6oSBTsopk2HQD74W1iU8Y|fc_0c7d22595484f800016ab1afcc387487d29bcc179795c06886","toolName":"read","startedAt":"2026-09-21T22:29:32.298Z","args":{"path":"crates/spt/src/rc.rs:3040-3152"},"intent":"Reading owner handler and deadlines"},"id":"78a94e44","parentId":"6f175685","timestamp":"2026-09-21T22:29:32.298Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_Z2sy0NhRtM0R15qfXSmg5Rms|fc_0c7d22595484f800016ab1afcc387887d2b52478a4bbd2650a","toolName":"read","startedAt":"2026-09-21T22:29:32.298Z","args":{"path":"crates/spt/tests/webserve_cross_node_e2e.rs:1-220"},"intent":"Reading cross node isolation fixture"},"id":"19566586","parentId":"78a94e44","timestamp":"2026-09-21T22:29:32.298Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_U16RKaA5QY0rpBWNfw918OWx|fc_0c7d22595484f800016ab1afcc388087d2990ef061a5edd2dc","toolName":"read","startedAt":"2026-09-21T22:29:32.298Z","args":{"path":"crates/spt/src/api/mod.rs:461-550"},"intent":"Reading signal and authentication flags"},"id":"1d7dfc20","parentId":"19566586","timestamp":"2026-09-21T22:29:32.298Z"}
{"type":"message","id":"642cdd21","parentId":"1d7dfc20","timestamp":"2026-09-21T22:29:32.298Z","message":{"role":"assistant","content":[{"type":"toolCall","id":"call_B6tpbQ5TYKsXjtOWipJGC0B9|fc_0c7d22595484f800016ab1afcc386487d287da033fed1e23a6","name":"read","arguments":{"i":"Reading receipt authority implementation","path":"crates/spt-daemon/src/broker.rs:9020-9120"},"intent":"Reading receipt authority implementation"},{"type":"toolCall","id":"call_kWg6oSBTsopk2HQD74W1iU8Y|fc_0c7d22595484f800016ab1afcc387487d29bcc179795c06886","name":"read","arguments":{"i":"Reading owner handler and deadlines","path":"crates/spt/src/rc.rs:3040-3152"},"intent":"Reading owner handler and deadlines"},{"type":"toolCall","id":"call_Z2sy0NhRtM0R15qfXSmg5Rms|fc_0c7d22595484f800016ab1afcc387887d2b52478a4bbd2650a","name":"read","arguments":{"i":"Reading cross node isolation fixture","path":"crates/spt/tests/webserve_cross_node_e2e.rs:1-220"},"intent":"Reading cross node isolation fixture"},{"type":"toolCall","id":"call_U16RKaA5QY0rpBWNfw918OWx|fc_0c7d22595484f800016ab1afcc388087d2990ef061a5edd2dc","name":"read","arguments":{"i":"Reading signal and authentication flags","path":"crates/spt/src/api/mod.rs:461-550"},"intent":"Reading signal and authentication flags"},{"type":"toolCall","id":"call_gSIOKX054jaAGFoWXFX0w96m|fc_0c7d22595484f800016ab1afcc388887d287023c712e654a32","name":"read","arguments":{"i":"Reading translation protocol contract","path":"docs-site/src/harness-contract/manifest.md:431-550"},"intent":"Reading translation protocol contract"},{"type":"toolCall","id":"call_cUASAsahA4MybSAPuQTrx8Fw|fc_0c7d22595484f800016ab1afcc389087d281a58dc6f49bb42c","name":"grep","arguments":{"i":"Locating owner rescope guard","pattern":"add_input_reference|INPUT_PATH_|split_whitespace","path":"crates/spt-store/src/serving.rs;crates/spt-store/src/helperline.rs","case":true,"gitignore":true,"skip":0},"intent":"Locating owner rescope guard"}],"api":"openai-codex-responses","provider":"openai-codex","model":"gpt-6-astra","usage":{"input":7662,"output":258,"cacheRead":51072,"cacheWrite":0,"totalTokens":58992,"cost":{"input":0.07662000000000001,"output":0.0129,"cacheRead":0.051072,"cacheWrite":0,"total":0.140592}},"stopReason":"toolUse","timestamp":1790029763224,"responseId":"resp_0c7d22595484f800016ab1afc36ad487d2b42826010524b360","providerPayload":{"type":"openaiResponsesHistory","provider":"openai-codex","dt":true,"items":[{"id":"fc_0c7d22595484f800016ab1afcc386487d287da033fed1e23a6","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading receipt authority implementation\",\"path\":\"crates/spt-daemon/src/broker.rs:9020-9120\"}","call_id":"call_B6tpbQ5TYKsXjtOWipJGC0B9","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"read","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1afcc387487d29bcc179795c06886","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading owner handler and deadlines\",\"path\":\"crates/spt/src/rc.rs:3040-3152\"}","call_id":"call_kWg6oSBTsopk2HQD74W1iU8Y","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"read","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1afcc387887d2b52478a4bbd2650a","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading cross node isolation fixture\",\"path\":\"crates/spt/tests/webserve_cross_node_e2e.rs:1-220\"}","call_id":"call_Z2sy0NhRtM0R15qfXSmg5Rms","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"read","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1afcc388087d2990ef061a5edd2dc","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading signal and authentication flags\",\"path\":\"crates/spt/src/api/mod.rs:461-550\"}","call_id":"call_U16RKaA5QY0rpBWNfw918OWx","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"read","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1afcc388887d287023c712e654a32","type":"function_call","status":"completed","arguments":"{\"i\":\"Reading translation protocol contract\",\"path\":\"docs-site/src/harness-contract/manifest.md:431-550\"}","call_id":"call_gSIOKX054jaAGFoWXFX0w96m","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"read","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}},{"id":"fc_0c7d22595484f800016ab1afcc389087d281a58dc6f49bb42c","type":"function_call","status":"completed","arguments":"{\"i\":\"Locating owner rescope guard\",\"pattern\":\"add_input_reference|INPUT_PATH_|split_whitespace\",\"path\":\"crates/spt-store/src/serving.rs;crates/spt-store/src/helperline.rs\",\"case\":true,\"gitignore\":true,\"skip\":0}","call_id":"call_cUASAsahA4MybSAPuQTrx8Fw","internal_chat_message_metadata_passthrough":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"},"name":"grep","metadata":{"turn_id":"aa9d616a-f370-4e5b-9020-180c10f78345"}}]},"duration":9071.181899999996,"ttft":9024.078800000018,"completedAt":1790029772296,"contextSnapshot":{"promptTokens":58734,"nonMessageTokens":10457,"compactionEpoch":0}}}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_gSIOKX054jaAGFoWXFX0w96m|fc_0c7d22595484f800016ab1afcc388887d287023c712e654a32","toolName":"read","startedAt":"2026-09-21T22:29:32.298Z","args":{"path":"docs-site/src/harness-contract/manifest.md:431-550"},"intent":"Reading translation protocol contract"},"id":"da74ccb4","parentId":"642cdd21","timestamp":"2026-09-21T22:29:32.298Z"}
{"type":"custom","customType":"tool_execution_start","data":{"toolCallId":"call_cUASAsahA4MybSAPuQTrx8Fw|fc_0c7d22595484f800016ab1afcc389087d281a58dc6f49bb42c","toolName":"grep","startedAt":"2026-09-21T22:29:32.299Z","args":{"path":"crates/spt-store/src/serving.rs;crates/spt-store/src/helperline.rs"},"intent":"Locating owner rescope guard"},"id":"912c7692","parentId":"da74ccb4","timestamp":"2026-09-21T22:29:32.299Z"}
{"type":"message","id":"6a970efa","parentId":"912c7692","timestamp":"2026-09-21T22:29:32.310Z","message":{"role":"toolResult","toolCallId":"call_Z2sy0NhRtM0R15qfXSmg5Rms|fc_0c7d22595484f800016ab1afcc387887d2b52478a4bbd2650a","toolName":"read","content":[{"type":"text","text":"//! WEBSERVE W1 (releases#249) — the MECHANIZED cross-node serving rig: two\n//! REAL `spt daemon run` processes on one box, one `SPT_HOME` each, and a\n//! node-prefixed URL for the peer fetched through the requester's own\n//! loopback listener. The `int` evidence for `REQ-WEB-CROSS-NODE-PROXY` and\n//! for the first time the `WEB` surface is DIALLED (`REQ-WEB-ACCESS-SURFACE`).\n//!\n//! ## Why two OS processes\n//!\n//! Every claim here is about WHICH NODE decides: the owner runs the gate\n//! under the handshake-proven origin and resolves the served name through its\n//! own registry; the requester caches nothing and answers 502 on its own when\n//! the owner is gone. An in-process rig sharing one home cannot express\n//! \"decided there, not here\" — the stores would be the same files — so the\n//! rig is the `knock_mutual_cross_node_e2e.rs` shape: two daemons, driven\n//! through the public surfaces (the CLI for `serve add`, plain HTTP for the\n//! fetch), reaped SCOPED on drop.\n//!\n//! ## Rendezvous\n//!\n//! The real daemon has no bind-port knob; the rig asks each daemon what it is\n//! reachable AS (`net_status`) and seeds that address into the other home's\n//! `PeerAddrStore`. The requester's roster + registry snapshot carry the\n//! owner as a KNOWN subnet member under the label `rig-b` — which is what the\n//! router needs to open a stream rather than answer the docs 404. The two\n//! daemons share this box's hostname, so the owner serves the proxied request\n//! under its OWN prefix (the production rewrite this rig is the reason for).\n//! `relay: disabled` + `peer_pump: false` keep both daemons off every path but\n//! the seeded direct one; the rig's subnet seed is its own, so the LIVE fleet\n//! daemon on this box is refused by seed-proof membership.\n//!\n//! ## Why the pump STAYS off here, measured 2026-09-07\n//!\n//! WEBSERVE W2's helper needs the receiver to know the sender's endpoint is a\n//! Gateway, and only gossip teaches that (`RegistryHost` starts empty and never\n//! reads its own snapshots back). Turning the pump on WORKS — A learned B's\n//! Gateway in 751 ms, twice — but it breaks this rig's ROUTING, because\n//! `known_subnet_node` prefers the registry-ADVERTISED label over the roster's,\n//! that label is the OS hostname, and one box gives both daemons the same one.\n//! The peer prefix then equals the local node's and every `//f/…` is\n//! answered locally: arm 1 went `404 NO_DOCS_LANDED`. Gossip-on and node-label\n//! routing are mutually exclusive on ONE box, so the cross-node helper's\n//! positive lives in `spt-daemon/tests/twohost_web.rs`, where two hosts carry\n//! two hostnames. What stays here is the arm that needs no gossip at all: an\n//! agent-authored message is declined at ingress before any registry fact is\n//! consulted. The pump-on rig is preserved as a patch under `.spt/preserved/`.\n//!\n//! ## The arms (one `#[test]`, sequential — `SPT_HOME` is process-global)\n//!\n//! byte-equal fetch · edit visible (no cache) · HEAD · Range → 206 · owner's\n//! 404 carried as 404 · WEB deny rule on the owner → 403 naming the surface ·\n//! rule cleared → 200 again · unknown label → the docs 404 · reserved facet\n//! answered locally · owner stopped → 502 naming the node, timed.\n\nuse std::io::{Read, Write as _};\nuse std::net::TcpStream;\nuse std::path::{Path, PathBuf};\nuse std::process::{Child, Command, Stdio};\nuse std::time::{Duration, Instant};\n\nmod common;\nuse common::CommandNoWindowExt;\n\nuse spt_daemon::brain::Brain;\nuse spt_store::access::{AccessRule, AccessStore, OriginQualifier, Provenance, RuleDecision, Subject};\nuse spt_store::perch;\nuse spt_store::subnet::SubnetStore;\n\n/// The rig's own subnet — a name and seed no other node on this box holds.\nconst SUBNET: &str = \"w1-249-rig\";\nconst SUBNET_SEED: [u8; 20] = [\n 0x4a, 0x91, 0x0c, 0xe3, 0x57, 0x28, 0xb6, 0x1f, 0x9d, 0x62, 0x7e, 0x05, 0xc4, 0x3b, 0xa8, 0x70,\n 0x19, 0xd2, 0x8f, 0x66,\n];\n/// The label the requester's roster carries for the owner.\nconst OWNER_LABEL: &str = \"rig-b\";\n/// The endpoint that registers the served file on the owner (the gate's subject).\nconst OWNER_ENDPOINT: &str = \"w1-servie\";\n/// The endpoint an ENTRY may be addressed to (WEBSERVE W2). It lives on the\n/// requesting node A, which is what makes A's fetch the admitted one.\nconst AUDIENCE_ENDPOINT: &str = \"w2-audience\";\n/// An AGENT-typed endpoint on the owner node — the author whose message arm\n/// (iii) proves the ingress helper declines to act on.\nconst SENDER_AGENT: &str = \"w2-agent\";\n\nfn now_ms() -> u64 {\n std::time::SystemTime::now()\n .duration_since(std::time::UNIX_EPOCH)\n .expect(\"clock\")\n .as_millis() as u64\n}\n\n/// Run `f` with the process-global `SPT_HOME` pointed at `home`. Sound only\n/// because this binary holds exactly ONE `#[test]` (KNOWN-HAZARDS 5.19).\nfn in_home(home: &Path, f: impl FnOnce() -> T) -> T {\n std::env::set_var(\"SPT_HOME\", home);\n f()\n}\n\nfn ready_pid(path: &Path) -> Option {\n let s = std::fs::read_to_string(path).ok()?;\n serde_json::from_str::(&s)\n .ok()?\n .get(\"pid\")?\n .as_u64()\n .map(|p| p as u32)\n}\n\nfn kill_pid(pid: u32) {\n #[cfg(windows)]\n let _ = Command::new(\"taskkill\")\n .no_window()\n .args([\"/PID\", &pid.to_string(), \"/F\", \"/T\"])\n .output();\n #[cfg(unix)]\n let _ = Command::new(\"kill\").args([\"-9\", &pid.to_string()]).output();\n}\n\n/// One REAL `spt daemon run` under `home`, readiness-gated on `brain.ready`,\n/// reaped SCOPED on drop (never machine-wide — this box hosts the live fleet).\nstruct DaemonGuard {\n home: PathBuf,\n spt: PathBuf,\n broker: Option,\n brain_pid: Option,\n log: PathBuf,\n}\n\nimpl DaemonGuard {\n fn start(home: &Path, spt: &Path, tag: &str) -> DaemonGuard {\n let ready = home.join(\"brain.ready\");\n let _ = std::fs::remove_file(&ready);\n let log = home.join(format!(\"brain-{tag}.stderr.log\"));\n let log_file = std::fs::File::create(&log).expect(\"create brain stderr log\");\n let broker = Command::new(spt)\n .no_window()\n .args([\"daemon\", \"run\"])\n .env(\"SPT_HOME\", home)\n .env(\"SPT_INSTALL_NO_FIREWALL\", \"1\")\n // Ephemeral advisory ports: this box's perch daemons own 5474.\n .env(\"SPT_TEST_EPHEMERAL_ADVISORY_PORTS\", \"1\")\n // A battery is not an endpoint: the identity trio must not reach\n // the daemon (its stop guard reads it).\n .env_remove(\"OWL_SESSION_ID\")\n .env_remove(\"SPT_AGENT_ID\")\n .env_remove(\"SPT_ENDPOINT_ID\")\n .stdout(Stdio::null())\n .stderr(Stdio::from(log_file))\n .spawn()\n .expect(\"spawn spt daemon run\");\n let mut guard = DaemonGuard {\n home: home.to_path_buf(),\n spt: spt.to_path_buf(),\n broker: Some(broker),\n brain_pid: None,\n log,\n };\n let deadline = Instant::now() + Duration::from_secs(90);\n while Instant::now() < deadline {\n if let Some(p) = ready_pid(&ready) {\n guard.brain_pid = Some(p);\n return guard;\n }\n std::thread::sleep(Duration::from_millis(100));\n }\n let tail = common::daemon_stderr_panel(&guard.log);\n drop(guard);\n panic!(\"PRECONDITION: brain never came up ({tag}).\\n{tail}\");\n }\n\n /// Every daemon stderr line so far: the pre-redirect capture plus the\n /// durable sink `daemon run` redirects into (where the announcements land).\n fn stderr(&self) -> String {\n let mut text = std::fs::read_to_string(&self.log).unwrap_or_default();\n text.push_str(&std::fs::read_to_string(spt_daemon::stderrlog::sink_path(&self.home)).unwrap_or_default());\n text\n }\n\n /// The bound loopback serving port, read off the daemon's own\n /// `DOCS_SERVER_UP: http://localhost://` line.\n fn docs_port(&self) -> u16 {\n let deadline = Instant::now() + Duration::from_secs(60);\n loop {\n let log = self.stderr();\n if let Some(port) = log\n .lines()\n .find_map(|line| line.strip_prefix(\"DOCS_SERVER_UP: http://localhost:\"))\n .and_then(|rest| rest.split('/').next())\n .and_then(|port| port.parse::().ok())\n {\n return port;\n }\n assert!(\n Instant::now() < deadline,\n \"PRECONDITION: the daemon under {} never announced DOCS_SERVER_UP:\\n{}\",\n self.home.display(),\n common::daemon_stderr_panel(&self.log)\n );\n std::thread::sleep(Duration::from_millis(200));\n }\n }\n\n fn reap_pids(&mut self) {\n if let Some(p) = self.brain_pid.take() {\n kill_pid(p);\n }\n if let Some(mut c) = self.broker.take() {\n let _ = c.kill();\n let _ = c.wait();\n }\n }\n\n /// Stop this daemon now (the \"owner gone\" arm), scoped exactly as drop is.\n fn stop(&mut self) {\n let mut cmd = Command::new(&self.spt);\n cmd.no_window()\n .args([\"daemon\", \"stop\"])\n .env(\"SPT_HOME\", &self.home)\n .env(\"SPT_INSTALL_NO_FIREWALL\", \"1\")\n .env_remove(\"OWL_SESSION_ID\")\n .env_remove(\"SPT_AGENT_ID\")\n .env_remove(\"SPT_ENDPOINT_ID\");\n let _ = common::output_bounded(cmd, Duration::from_secs(20));\n self.reap_pids();\n }\n}\n\n[Showing lines 1-223 of 945. Use :224 to continue]"}],"details":{"truncation":{"content":"//! WEBSERVE W1 (releases#249) — the MECHANIZED cross-node serving rig: two\r\n//! REAL `spt daemon run` processes on one box, one `SPT_HOME` each, and a\r\n//! node-prefixed URL for the peer fetched through the requester's own\r\n//! loopback listener. The `int` evidence for `REQ-WEB-CROSS-NODE-PROXY` and\r\n//! for the first time the `WEB` surface is DIALLED (`REQ-WEB-ACCESS-SURFACE`).\r\n//!\r\n//! ## Why two OS processes\r\n//!\r\n//! Every claim here is about WHICH NODE decides: the owner runs the gate\r\n//! under the handshake-proven origin and resolves the served name through its\r\n//! own registry; the requester caches nothing and answers 502 on its own when\r\n//! the owner is gone. An in-process rig sharing one home cannot express\r\n//! \"decided there, not here\" — the stores would be the same files — so the\r\n//! rig is the `knock_mutual_cross_node_e2e.rs` shape: two daemons, driven\r\n//! through the public surfaces (the CLI for `serve add`, plain HTTP for the\r\n//! fetch), reaped SCOPED on drop.\r\n//!\r\n//! ## Rendezvous\r\n//!\r\n//! The real daemon has no bind-port knob; the rig asks each daemon what it is\r\n//! reachable AS (`net_status`) and seeds that address into the other home's\r\n//! `PeerAddrStore`. The requester's roster + registry snapshot carry the\r\n//! owner as a KNOWN subnet member under the label `rig-b` — which is what the\r\n//! router needs to open a stream rather than answer the docs 404. The two\r\n//! daemons share this box's hostname, so the owner serves the proxied request\r\n//! under its OWN prefix (the production rewrite this rig is the reason for).\r\n//! `relay: disabled` + `peer_pump: false` keep both daemons off every path but\r\n//! the seeded direct one; the rig's subnet seed is its own, so the LIVE fleet\r\n//! daemon on this box is refused by seed-proof membership.\r\n//!\r\n//! ## Why the pump STAYS off here, measured 2026-09-07\r\n//!\r\n//! WEBSERVE W2's helper needs the receiver to know the sender's endpoint is a\r\n//! Gateway, and only gossip teaches that (`RegistryHost` starts empty and never\r\n//! reads its own snapshots back). Turning the pump on WORKS — A learned B's\r\n//! Gateway in 751 ms, twice — but it breaks this rig's ROUTING, because\r\n//! `known_subnet_node` prefers the registry-ADVERTISED label over the roster's,\r\n//! that label is the OS hostname, and one box gives both daemons the same one.\r\n//! The peer prefix then equals the local node's and every `//f/…` is\r\n//! answered locally: arm 1 went `404 NO_DOCS_LANDED`. Gossip-on and node-label\r\n//! routing are mutually exclusive on ONE box, so the cross-node helper's\r\n//! positive lives in `spt-daemon/tests/twohost_web.rs`, where two hosts carry\r\n//! two hostnames. What stays here is the arm that needs no gossip at all: an\r\n//! agent-authored message is declined at ingress before any registry fact is\r\n//! consulted. The pump-on rig is preserved as a patch under `.spt/preserved/`.\r\n//!\r\n//! ## The arms (one `#[test]`, sequential — `SPT_HOME` is process-global)\r\n//!\r\n//! byte-equal fetch · edit visible (no cache) · HEAD · Range → 206 · owner's\r\n//! 404 carried as 404 · WEB deny rule on the owner → 403 naming the surface ·\r\n//! rule cleared → 200 again · unknown label → the docs 404 · reserved facet\r\n//! answered locally · owner stopped → 502 naming the node, timed.\r\n\r\nuse std::io::{Read, Write as _};\r\nuse std::net::TcpStream;\r\nuse std::path::{Path, PathBuf};\r\nuse std::process::{Child, Command, Stdio};\r\nuse std::time::{Duration, Instant};\r\n\r\nmod common;\r\nuse common::CommandNoWindowExt;\r\n\r\nuse spt_daemon::brain::Brain;\r\nuse spt_store::access::{AccessRule, AccessStore, OriginQualifier, Provenance, RuleDecision, Subject};\r\nuse spt_store::perch;\r\nuse spt_store::subnet::SubnetStore;\r\n\r\n/// The rig's own subnet — a name and seed no other node on this box holds.\r\nconst SUBNET: &str = \"w1-249-rig\";\r\nconst SUBNET_SEED: [u8; 20] = [\r\n 0x4a, 0x91, 0x0c, 0xe3, 0x57, 0x28, 0xb6, 0x1f, 0x9d, 0x62, 0x7e, 0x05, 0xc4, 0x3b, 0xa8, 0x70,\r\n 0x19, 0xd2, 0x8f, 0x66,\r\n];\r\n/// The label the requester's roster carries for the owner.\r\nconst OWNER_LABEL: &str = \"rig-b\";\r\n/// The endpoint that registers the served file on the owner (the gate's subject).\r\nconst OWNER_ENDPOINT: &str = \"w1-servie\";\r\n/// The endpoint an ENTRY may be addressed to (WEBSERVE W2). It lives on the\r\n/// requesting node A, which is what makes A's fetch the admitted one.\r\nconst AUDIENCE_ENDPOINT: &str = \"w2-audience\";\r\n/// An AGENT-typed endpoint on the owner node — the author whose message arm\r\n/// (iii) proves the ingress helper declines to act on.\r\nconst SENDER_AGENT: &str = \"w2-agent\";\r\n\r\nfn now_ms() -> u64 {\r\n std::time::SystemTime::now()\r\n .duration_since(std::time::UNIX_EPOCH)\r\n .expect(\"clock\")\r\n .as_millis() as u64\r\n}\r\n\r\n/// Run `f` with the process-global `SPT_HOME` pointed at `home`. Sound only\r\n/// because this binary holds exactly ONE `#[test]` (KNOWN-HAZARDS 5.19).\r\nfn in_home(home: &Path, f: impl FnOnce() -> T) -> T {\r\n std::env::set_var(\"SPT_HOME\", home);\r\n f()\r\n}\r\n\r\nfn ready_pid(path: &Path) -> Option {\r\n let s = std::fs::read_to_string(path).ok()?;\r\n serde_json::from_str::(&s)\r\n .ok()?\r\n .get(\"pid\")?\r\n .as_u64()\r\n .map(|p| p as u32)\r\n}\r\n\r\nfn kill_pid(pid: u32) {\r\n #[cfg(windows)]\r\n let _ = Command::new(\"taskkill\")\r\n .no_window()\r\n .args([\"/PID\", &pid.to_string(), \"/F\", \"/T\"])\r\n .output();\r\n #[cfg(unix)]\r\n let _ = Command::new(\"kill\").args([\"-9\", &pid.to_string()]).output();\r\n}\r\n\r\n/// One REAL `spt daemon run` under `home`, readiness-gated on `brain.ready`,\r\n/// reaped SCOPED on drop (never machine-wide — this box hosts the live fleet).\r\nstruct DaemonGuard {\r\n home: PathBuf,\r\n spt: PathBuf,\r\n broker: Option,\r\n brain_pid: Option,\r\n log: PathBuf,\r\n}\r\n\r\nimpl DaemonGuard {\r\n fn start(home: &Path, spt: &Path, tag: &str) -> DaemonGuard {\r\n let ready = home.join(\"brain.ready\");\r\n let _ = std::fs::remove_file(&ready);\r\n let log = home.join(format!(\"brain-{tag}.stderr.log\"));\r\n let log_file = std::fs::File::create(&log).expect(\"create brain stderr log\");\r\n let broker = Command::new(spt)\r\n .no_window()\r\n .args([\"daemon\", \"run\"])\r\n .env(\"SPT_HOME\", home)\r\n .env(\"SPT_INSTALL_NO_FIREWALL\", \"1\")\r\n // Ephemeral advisory ports: this box's perch daemons own 5474.\r\n .env(\"SPT_TEST_EPHEMERAL_ADVISORY_PORTS\", \"1\")\r\n // A battery is not an endpoint: the identity trio must not reach\r\n // the daemon (its stop guard reads it).\r\n .env_remove(\"OWL_SESSION_ID\")\r\n .env_remove(\"SPT_AGENT_ID\")\r\n .env_remove(\"SPT_ENDPOINT_ID\")\r\n .stdout(Stdio::null())\r\n .stderr(Stdio::from(log_file))\r\n .spawn()\r\n .expect(\"spawn spt daemon run\");\r\n let mut guard = DaemonGuard {\r\n home: home.to_path_buf(),\r\n spt: spt.to_path_buf(),\r\n broker: Some(broker),\r\n brain_pid: None,\r\n log,\r\n };\r\n let deadline = Instant::now() + Duration::from_secs(90);\r\n while Instant::now() < deadline {\r\n if let Some(p) = ready_pid(&ready) {\r\n guard.brain_pid = Some(p);\r\n return guard;\r\n }\r\n std::thread::sleep(Duration::from_millis(100));\r\n }\r\n let tail = common::daemon_stderr_panel(&guard.log);\r\n drop(guard);\r\n panic!(\"PRECONDITION: brain never came up ({tag}).\\n{tail}\");\r\n }\r\n\r\n /// Every daemon stderr line so far: the pre-redirect capture plus the\r\n /// durable sink `daemon run` redirects into (where the announcements land).\r\n fn stderr(&self) -> String {\r\n let mut text = std::fs::read_to_string(&self.log).unwrap_or_default();\r\n text.push_str(&std::fs::read_to_string(spt_daemon::stderrlog::sink_path(&self.home)).unwrap_or_default());\r\n text\r\n }\r\n\r\n /// The bound loopback serving port, read off the daemon's own\r\n /// `DOCS_SERVER_UP: http://localhost: