[ { "a": "REQ-CREATE-BIND-REST-ACTIVE", "b": "REQ-START-3", "a_title": "A successful fresh `endpoint run --create` bind MUST normalize rest intent to active IN THE SAME lif", "b_title": "spt-hosted startup: spawn-session then api bind (no file)", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-ACL-DISCOVER-GATE", "b": "REQ-ACL-SUBJECT-CHAIN", "a_title": "DISCOVER is a real gated surface: registry resolve/advertise and the resources blurb are filtered pe", "b_title": "One FIRST-MATCH-WINS subject chain decides every access question, with an implicit-open bottom that ", "a_doc_first": "resource advertisement (subnet resource registry)**: A per-endpoint **free-text blurb** describing the services/functions the endpoint can serve \u2014 an agent **yellow-pages** for service discovery, distinct from *capability declaration* (machine-readable, which endpoint *types* a node hosts) and from ", "b_doc_first": "control-surface modes (`open` / `closed`)** (ratified 2026-07-29, access-control grill): Per-surface default posture for unlisted subjects \u2014 `open` = allowed (no forced whitelisting), `closed` = blocked. Defined at three levels: **subnet** (a universal all-surfaces mode chosen at `subnet create` \u2014 p" }, { "a": "REQ-ACL-NODE-MODE-SET", "b": "REQ-ER-CONTROLLER-BOUND-POSTURE", "a_title": "The node's control-surface modes are settable through the engine room and nowhere else (ADR-0052 dec", "b_title": "The engine room is empowered ONLY while a controller is attached, and losing that controller drops i", "a_doc_first": "A locked-down **agent endpoint** (harness-adapter-backed, spt-hosted, has a mind \u2014 it can be briefed on and reason about the node's access posture). It is the designated way to set the **node's** control-surface modes.", "b_doc_first": "Decision 3 was written in the language of the ceremony, and two of its clauses do not survive contact with the daemon's lifecycle invariants. Both are amended here rather than built literally." }, { "a": "REQ-ACL-VIEW-DRILLDOWN", "b": "REQ-ACL-VIEW-ROSTER", "a_title": "The granular rule list is viewable only per named ruled entity (CONTEXT.md 'access entity'): `spt en", "b_title": "Access views are roster-first (CONTEXT.md 'access entity', FF grill 2026-07-30): `spt endpoint acces", "a_doc_first": "access entity** (ratified 2026-07-30, fast-follow grill): Anything that can be granted (or denied) control via access rules \u2014 a **subnet**, **node**, or **endpoint**. A **ruled access entity**, relative to a given target, is an access entity that at least one of the target's rules names. Access view", "b_doc_first": "access entity** (ratified 2026-07-30, fast-follow grill): Anything that can be granted (or denied) control via access rules \u2014 a **subnet**, **node**, or **endpoint**. A **ruled access entity**, relative to a given target, is an access entity that at least one of the target's rules names. Access view" }, { "a": "REQ-ADAPTER-ADD-SURFACE-ERRORS", "b": "REQ-UPDATE-APPLY-RESTART-NOTICE", "a_title": "Bug #1: adapter add runs the install-as-first-update via conduct (cli.rs:6963) which on a non-zero e", "b_title": "`spt update apply` prints a LOUD restart-required notice whenever the surviving broker will keep run", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-ADAPTER-LIVE-UPDATE", "b": "REQ-ADAPTER-UPDATE-MESSAGE", "a_title": "An adapter update is live and daemon-coordinated (the adapter analog of brain self-update, ADR-0004)", "b_title": "An adapter manifest may declare `[update].message` \u2014 a plain (multi-line) human notice surfaced to s", "a_doc_first": "Live, daemon-coordinated adapter update / Amendment (W3 build, 2026-06-22)", "b_doc_first": "adapter packaging & live update** (v0.13.2; ADR-0024, ADR-0025): A `.spt` may be **multi-platform**: shared `manifest.toml` + `strings/` at the root, role binaries under per-target-triple subdirectories (`x86_64-pc-windows-msvc/`, \u2026); install/update extracts the shared root plus only the current nod" }, { "a": "REQ-ADAPTER-MULTIPLATFORM-SPT", "b": "REQ-UPDATE-RESTART-SAFE-SWAP", "a_title": "A `.spt` adapter archive may pack multiple platforms in one signed asset: shared `manifest.toml` + `", "b_title": "THE-FORKENING W4 (operator-grilled 2026-07-14; RETIRES findings-backlog seed #12 REQ-UPDATE-ONE-STEP", "a_doc_first": "Multi-platform adapter `.spt` packaging", "b_doc_first": "update composite (`spt update`)** \u2014 the plain verb is the primary form: `update fetch --apply` then `update adapters` (core-first order); with core already current, only adapters update. `--core-only`/`-c` skips adapters; `spt update adapters [[,\u2026]]` is the adapters leg alone (alias over `spt " }, { "a": "REQ-DAEMON-6", "b": "REQ-MSG-INJECT-LEG-DROP-VISIBLE", "a_title": "Service-aware `daemon start`/`stop`: when an OS service manager has a registered spt-daemon for this", "b_title": "SEED (inactive \u2014 observability): a silently-dropped delivery leg must be DISTINGUISHABLE from an hon", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-ADAPTER-UNRESOLVED-HINT-FORM", "b": "REQ-RESUME-ADAPTER-FOLLOWS-SESSION", "a_title": "F-034 leg a (perri/hertz field finding 2026-07-09): the ADAPTER_UNRESOLVED refusal hint must print a", "b_title": "D-2 (REMOTE-TRUTH triage \u00a7D-2 + operator Q5 @c248afc): a resume-from-history restores the RECORDED s", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-ADAPTER-UPDATE-INPLACE", "b": "REQ-UPD-2", "a_title": "Bug #18: spt adapter update fails at re-register with os error 2 because it derives the install dir ", "b_title": "All binaries signature-verified before handoff", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-ADAPTER-UPDATE-MESSAGE", "b": "REQ-UPD-4", "a_title": "An adapter manifest may declare `[update].message` \u2014 a plain (multi-line) human notice surfaced to s", "b_title": "Update gated on user confirmation by default; opt-in full-auto", "a_doc_first": "adapter packaging & live update** (v0.13.2; ADR-0024, ADR-0025): A `.spt` may be **multi-platform**: shared `manifest.toml` + `strings/` at the root, role binaries under per-target-triple subdirectories (`x86_64-pc-windows-msvc/`, \u2026); install/update extracts the shared root plus only the current nod", "b_doc_first": "" }, { "a": "REQ-API-1", "b": "REQ-START-4", "a_title": "api prefix and adapter_name on every machinery invocation", "b_title": "Adapter-injected env aliases (SPT/OWL/LIVE)", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-ATTACH-IDEMPOTENT-REPLAY", "b": "REQ-HAZARD-INBOX-NO-DOUBLE", "a_title": "The equal-generation lease rung is idempotent for the same connection. (ADR-0047 decision 3, AMENDIN", "b_title": "No double-delivery via legacy inbox (4.5)", "a_doc_first": "3. The equal-generation rung is idempotent for the same connection", "b_doc_first": "" }, { "a": "REQ-BIND-HONEST-SELF-STAMP", "b": "REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT", "a_title": "C2-ROOT (F028, doyle RCA 2026-07-03): the identity-attribution ROOT behind REQ-SESSIONS-LOG-ENDPOINT", "b_title": "A clean `spt rc` attach to a LIVE spt-hosted (`endpoint run`) harness must DELIVER the harness's PTY", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-DAEMON-9", "b": "REQ-HEAVY-UNIT-CLASSIFICATION", "a_title": "Net-bind boot-race resilience: a daemon that comes up net-less (NetHost::start failed \u2014 e.g. the sys", "b_title": "A unit test that stands up a REAL broker inside a lib/bin `#[cfg(test)]` block must sit in the `heav", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-BIND-PSYCHE-CUSTODY-SQUAT-GUARD", "b": "REQ-PSYCHE-ACCOUNT-REFUSAL-EXIT", "a_title": "MSG-IDENTITY W1 / F-036 leg c (perri field RCA, doyle ACCEPTED defense-in-depth): a bind whose --set", "b_title": "RESERVED EXIT 96 \u2014 account/credential refusal from a psyche_resume turn: the inner tool refused for ", "a_doc_first": "", "b_doc_first": "Reserved exit codes \u2014 how a `psyche_resume` turn tells spt-core *why* it failed.** spt-core classifies a failed turn on the process **exit code alone \u2014 never on output text** (your harness may reword, restructure, or JSON-wrap its errors freely; only the code is contract). Any other nonzero exit is " }, { "a": "REQ-BRAIN-RESUME-NO-CONTROL-STEAL", "b": "REQ-BRAIN-UPDATE-RESTART-CLEAN-CLOSE", "a_title": "UPDATE-WEDGE round 2 (v0.30.4, doyle-ruled 2026-07-09 \u2014 field incident on the counter-54 fetch--appl", "b_title": "SEED (DEFERRED, doyle 2026-07-09 \u2014 post-counter-54 root-hardening for UPDATE-WEDGE; mint now, impl a", "a_doc_first": "resume re-attach is view-only for non-driven sessions** \u2014 on respawn the new brain queries the broker for every hosted session and re-attaches to rebuild output-continuity cursors, but it re-attaches as a **viewer**, never a controller, for any session it does not itself drive (which is *all* of the", "b_doc_first": "" }, { "a": "REQ-BRAIN-UPDATE-RESTART-CLEAN-CLOSE", "b": "REQ-HAZARD-BRAIN-RESTART-PSYCHE-DUP", "a_title": "SEED (DEFERRED, doyle 2026-07-09 \u2014 post-counter-54 root-hardening for UPDATE-WEDGE; mint now, impl a", "b_title": "A bare brain restart leaves EXACTLY ONE `{id}-psyche` process per endpoint \u2014 no duplicate. On an abr", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-BROKER-ATTACH-JOURNAL-RESILIENT", "b": "REQ-UPD-8", "a_title": "A poisoned EffectJournal mutex or a sick NetHost runtime must NOT permanently brick all future attac", "b_title": "Platform-safe `spt update fetch` + apply platform-guard (v0.3.1 cross-OS brick fix): `spt update fet", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-CI-POSTJOB-DAEMON-REAP", "b": "REQ-HAZARD-DAEMON-STOP-REAP", "a_title": "A CI job REAPS ITS OWN test-spawned daemons at battery end, in-job, and logs a process census at job", "b_title": "Breap: `spt daemon stop` REAPS the spt-hosted children it spawned \u2014 no orphaned psyche/harness proce", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-CLI-2", "b": "REQ-CLI-4", "a_title": "spt daemon noun: run|stop|status (hidden daemon verb becomes daemon run; agent-endpoint shutdown kee", "b_title": "User-facing CLI output is human-readable: DIRECT-USER commands (e.g. adapter update/list/use) render", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-DAEMON-SERVICE-INSTALL", "b": "REQ-INST-13", "a_title": "F-038 RIDER (flynn nice-to-have, QUEUED not activated): a documented OS-service registration recipe ", "b_title": "Subnet-exclusive sync + per-endpoint subnet-membership list", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-CLI-4", "b": "REQ-INSTALL-2", "a_title": "User-facing CLI output is human-readable: DIRECT-USER commands (e.g. adapter update/list/use) render", "b_title": "Marketplace-repackaging-friendly install", "a_doc_first": "", "b_doc_first": "the two-paths model + the one-line script half (v0.1 phasing below; OS-service leg = docs/DEFERRED.md) the marketplace-repackaging stance: relocatable binary + minimal, non-OS-entangled install logic spt-core is per-machine and harness-independent, so it installs *before* and *independent of* any ad" }, { "a": "REQ-CLI-OUTPUT-MARKDOWN", "b": "REQ-ENDPOINT-LIST-REST-FILTER", "a_title": "Human-prose COMMAND OUTPUT (not just `--help`) renders the inline Markdown authored in its source st", "b_title": "spt endpoint list hides SUSPENDED instances by default; a new --show-all flag reveals them. Status-f", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-CONN-POISON-ATTRIBUTION", "b": "REQ-SHELL-2", "a_title": "MSG-IDENTITY W6 / F-039 legs b-d (doyle W6 LOCK 2026-07-10, minted per amendment 3): every broker-co", "b_title": "Shell sleep/wake: link-break always closes the binary (pre-close instruction + termination timeout),", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-CONTROL-STAMP-CONVERGENCE", "b": "REQ-HAZARD-REDISPATCH-CONTROL-STEAL", "a_title": "REGISTRY-LIFECYCLE W2 (ADR-0041 decision 4, emphasys C3 P1): control-stamp writes are session/genera", "b_title": "REDISPATCH-TRUTH W1 (KNOWN-HAZARDS 7.41, hertz field RCA 2026-07-16 \u2014 4/5 endpoints frozen per brain", "a_doc_first": "1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual persisted state + hosting authority \u2014 never from manifest capability alone. Legacy hybrid rows self-heal at reconcile, but only after a SUCCESSFUL broker query: a broker failure is never interpreted as an emp", "b_doc_first": "7.41 A fresh dispatcher must NEVER re-serve a terminal stream \u2014 historical replay must not steal or clear a live controller `[REQ-HAZARD-REDISPATCH-CONTROL-STEAL]` Failure (paid-for, hertz field RCA 2026-07-16 \u2014 4/5 endpoints frozen, twice in one day):** every brain cycle (`spt daemon refresh`, `spt" }, { "a": "REQ-CRC-SWAP-OLD-DISPLACE", "b": "REQ-UPD-5", "a_title": "C1 (F028, infra; memory crc-swap-old-litter-brick, RCA'd ENLYZEAM + confirmed systemic): crc_swap `.", "b_title": "spt-core ripple-updates registered adapters", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-DAEMON-5", "b": "REQ-ENDPOINT-STOP-OFFLINE", "a_title": "Pump liveness: the peer pump writes a last-tick heartbeat consumed by daemon status / subnet status ", "b_title": "H3: `spt endpoint stop ` marks the endpoint OFFLINE (alive=false), not merely de-readied. cmd_st", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-DOCS-5", "b": "REQ-RUN-ID-REUSES-ADAPTER", "a_title": "Anti-drift: rustdoc/schema/exports/CLI-help generated + CI-checked", "b_title": "D-1 (REMOTE-TRUTH triage \u00a7D-1): `spt endpoint run --id ` with NO --adapter, when names an E", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-DAEMON-6", "b": "REQ-INST-7", "a_title": "Service-aware `daemon start`/`stop`: when an OS service manager has a registered spt-daemon for this", "b_title": "Subnet registry + bare-id resolution policy", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-DAEMON-9", "b": "REQ-PSYCHE-LEGACY-RESIDENT-SWEEP", "a_title": "Net-bind boot-race resilience: a daemon that comes up net-less (NetHost::start failed \u2014 e.g. the sys", "b_title": "W5 (F030; doyle+perri 2026-07-04): a dirty daemon upgrade from <=v0.24.0 strands a RESIDENT psyche w", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-DAEMON-REFRESH", "b": "REQ-HAZARD-BRAIN-RESTART-PSYCHE-DUP", "a_title": "THE-FORKENING W4 (operator add 2026-07-14): `spt daemon refresh` \u2014 restart the daemon BRAIN without ", "b_title": "A bare brain restart leaves EXACTLY ONE `{id}-psyche` process per endpoint \u2014 no duplicate. On an abr", "a_doc_first": "daemon refresh (`spt daemon refresh`)** \u2014 restart the **brain** in place, no binary swap, broker and every held PTY untouched: the routine-update handoff path minus the swap. The recovery verb for wedged brain-held state (broken endpoint bringup, a downed hosted agent) that previously required a ful", "b_doc_first": "" }, { "a": "REQ-DAEMON-SERVICE-INSTALL", "b": "REQ-INSTALL-12", "a_title": "F-038 RIDER (flynn nice-to-have, QUEUED not activated): a documented OS-service registration recipe ", "b_title": "Durable active-profile pointer for bind-time profile selection (ADR-0021): adapters/active-profiles.", "a_doc_first": "", "b_doc_first": "Bind-time adapter/profile resolution (ADR-0021).** Because the seed is adapter-agnostic, `listen`/`poll` resolve the owning adapter/profile when they bind, as a pure read \u2014 never a seed-time snapshot that could drift. `--adapter ` is an **optional override** on the `api` group (an ex" }, { "a": "REQ-DIGEST-FETCHER-STRATEGY", "b": "REQ-HAZARD-ADAPTER-PROFILE-STAMP-CLOBBER", "a_title": "Bug #17 (W6b, closes eel-a end-to-end): [digest] gains a `fetcher` strategy mirroring [history]'s lo", "b_title": "A-4 (F029, operator regression): the picker/confirm views drop an endpoint's adapter `:profile` (sho", "a_doc_first": "`[digest]` supports the same two locate strategies as `[history]` \u2014 pick with `strategy`: / `[digest]` \u2014 session-digest extractor (ADR-0019) The session digest's own seam \u2014 **distinct from `[history]`** (which stays opaque and single-session, feeding the echo-commune verbatim). Declares an **imperat", "b_doc_first": "" }, { "a": "REQ-DISPATCH-FALLBACK-CIRCUIT", "b": "REQ-HAZARD-VIEWER-STARVE-UNDER-CONTROLLER-BACKPRESSURE", "a_title": "REDISPATCH-STALL W1 (ADR-0038 Amendment, fixes 1+5): the opener ring-peek fallback fires ONLY on the", "b_title": "A SLOW controller must not starve a concurrent `rc --view` VIEWER. W1 (REQ-HAZARD-INJECT-CONTROL-COE", "a_doc_first": "Amendment \u2014 REDISPATCH-STALL (2026-07-16)", "b_doc_first": "" }, { "a": "REQ-DOCS-LOCAL-SERVER", "b": "REQ-SPAWN-FRESH-TRUTHFUL", "a_title": "THE-FORKENING W3 (ADR-0036 \u00a74, operator-ruled crate-over-handroll + port 5474): the daemon (broker s", "b_title": "REGISTRY-LIFECYCLE W3 (ADR-0041 decision 5, spawn-fresh): endpoint create is TRUTHFUL at the broker,", "a_doc_first": "docs server** \u2014 the daemon serves `$SPT_HOME/docs` over HTTP on **loopback only**, default `127.0.0.1:5474` (config/env-overridable). This is the **canonical docs surface** (supersedes the public Pages URL, ADR-0014\u2192ADR-0036): agents and humans on the node read `http://localhost:5474`; `spt docs url", "b_doc_first": "1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual persisted state + hosting authority \u2014 never from manifest capability alone. Legacy hybrid rows self-heal at reconcile, but only after a SUCCESSFUL broker query: a broker failure is never interpreted as an emp" }, { "a": "REQ-DOCS-5", "b": "REQ-SHELL-LIST-DERIVED-PROVENANCE", "a_title": "Anti-drift: rustdoc/schema/exports/CLI-help generated + CI-checked", "b_title": "SEED (inactive \u2014 observability, perri-backed 2026-07-26): a status a reader can act on should be dis", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-ECHO-DROP-DIR-RESOLVE", "b": "REQ-HAZARD-UNHOST-PSYCHE-REAP", "a_title": "W1 (LIFECYCLE-TRUTH): fire_echo resolves the manifest commune_dir through the SAME resolver its sibl", "b_title": "On un-host, the detached `{id}-psyche` HARNESS PROCESS is reaped \u2014 not just its in-brain pulse-drive", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-ENDPOINT-AUTOSTART", "b": "REQ-HAZARD-ATTACH-WEDGE", "a_title": "MSG-IDENTITY W5 / F-038 (flynn operator-directed ask 2026-07-10, SPT-CORE-NEEDS #7 + deployah field-", "b_title": "A legitimately dead PTY child (real crash/kill) + an undrained operator pump must NOT wedge the brok", "a_doc_first": "Infrastructure endpoints (a gateway the phone treats as always-there) should not need hands-on bringup after a box reboot or daemon restart. `spt endpoint run \u2026 --save` persists the run \u2014 endpoint id, adapter option, and working directory \u2014 as a **startup default** in `daemon.json`; the daemon **rep", "b_doc_first": "" }, { "a": "REQ-ENDPOINT-CYCLE-HONEST", "b": "REQ-RESUME-UNBOUND-STAMP", "a_title": "REGISTRY-LIFECYCLE W3 (ADR-0041 decision 6, operator deployah stop/run wedge): cycle verbs share ONE", "b_title": "RC-RENDER-TRUTH W1 (ADR-0042 decision 2, operator-spotted second root seam): resume launch transitio", "a_doc_first": "1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual persisted state + hosting authority \u2014 never from manifest capability alone. Legacy hybrid rows self-heal at reconcile, but only after a SUCCESSFUL broker query: a broker failure is never interpreted as an emp", "b_doc_first": "1. **`spt rc` consults the honest-session authority before the offline fast-fail. Normal `spt rc ` runs the same bounded `SessionProbe::has_live_session_honest` gate `endpoint run` uses (ADR-0041 single liveness authority). An honest session exists \u2192 attach via the session-confirmed path regardl" }, { "a": "REQ-ENDPOINT-LIST-PALETTE", "b": "REQ-ENDPOINT-ONLINE-TRUTH", "a_title": "Bugs #11 + #15 (display): spt endpoint list renders status as plain text while the picker turns the ", "b_title": "REGISTRY-LIFECYCLE W2 (ADR-0041 decisions 1+2, emphasys C1 P0): ONLINE is earned, not declared \u2014 cmd", "a_doc_first": "", "b_doc_first": "1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual persisted state + hosting authority \u2014 never from manifest capability alone. Legacy hybrid rows self-heal at reconcile, but only after a SUCCESSFUL broker query: a broker failure is never interpreted as an emp" }, { "a": "REQ-ENDPOINT-LIST-PROJECT-COL", "b": "REQ-PICKER-FORK-LABEL-CWD", "a_title": "#8: spt endpoint list gains a second column / (the endpoint's LATEST project) -> 4 columns ", "b_title": "B-3 (F029, operator): the confirm-panel `Fork endpoint` option label is static and says nothing abou", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-DSR-SINGLE-CPR", "b": "REQ-HAZARD-SOFT-CLEANUP", "a_title": "TEARDOWN-AUTHORITY W3 rider (hertz RCA 2026-07-19): a Device Status Report query yields EXACTLY ONE ", "b_title": "Soft-cleanup preserves state, removes only the ready marker (6.2)", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-ENDPOINT-LIST-REST-FILTER", "b": "REQ-INST-3", "a_title": "spt endpoint list hides SUSPENDED instances by default; a new --show-all flag reveals them. Status-f", "b_title": "Dormant (warm) / suspended (cold) resting states", "a_doc_first": "", "b_doc_first": "Dormancy resource budget (D9-3 \u2014 ADR-0003 red-team #9)" }, { "a": "REQ-ENDPOINT-ONLINE-TRUTH", "b": "REQ-HAZARD-CONTROL-STAMP-LIFETIME", "a_title": "REGISTRY-LIFECYCLE W2 (ADR-0041 decisions 1+2, emphasys C1 P0): ONLINE is earned, not declared \u2014 cmd", "b_title": "#2: a control/viewer stamp never outlives its session \u2014 every teardown path clears what attach stamp", "a_doc_first": "1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual persisted state + hosting authority \u2014 never from manifest capability alone. Legacy hybrid rows self-heal at reconcile, but only after a SUCCESSFUL broker query: a broker failure is never interpreted as an emp", "b_doc_first": "7.27 A control/viewer stamp must NEVER outlive its session \u2014 every teardown path clears what attach stamped `[REQ-HAZARD-CONTROL-STAMP-LIFETIME]` Failure (F-026 #2, live evidence HFENDULEAM):** an spt-hosted endpoint stayed `ONLINE+CONTROLLED` after the operator's RC `/exit` \u2014 hours later hall-a's `" }, { "a": "REQ-ENDPOINT-STOP-OFFLINE", "b": "REQ-PID-ROLE-EVIDENCE", "a_title": "H3: `spt endpoint stop ` marks the endpoint OFFLINE (alive=false), not merely de-readied. cmd_st", "b_title": "THE RECORDED PID MUST CARRY WHAT IT MEANS. `info.pid` has two incompatible meanings decided by write", "a_doc_first": "", "b_doc_first": "`info.json` \u2014 what the recorded `pid` MEANS (`pid_role`)" }, { "a": "REQ-ENDPOINT-TEARDOWN-AUTHORITY", "b": "REQ-INST-4", "a_title": "TEARDOWN-AUTHORITY W1 (ADR-0045; two hertz field RCAs 2026-07-19, doyle code-verified + ruled): ONE ", "b_title": "active to dormant/suspended fires a transition echo commune", "a_doc_first": "7.49 A teardown verb never stamps a terminal or resting state it has not caused \u2014 and two individually-correct verbs must not compose into a lifecycle dead end `[REQ-HAZARD-TEARDOWN-DEADEND]` Failure (paid-for, two hertz field RCAs 2026-07-19, both doyle code-verified the same day; the second hit do", "b_doc_first": "" }, { "a": "REQ-EP-4", "b": "REQ-HAZARD-DRIVEN-BY-SELFHEAL", "a_title": "PresenceChannel broker endpoint (seam day-one)", "b_title": "An spt-hosted endpoint's ONLINE+CONTROLLED state (`driven_by`) must CLEAR even when the detach IPC i", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-EP-9", "b": "REQ-INSTALL-7", "a_title": "`#` always-on address sigil: a reserved LEADING sigil marking an AlwaysOnEndpoint, extending the REQ", "b_title": "Windows inbound reachability: the elevated install leg registers the inbound-UDP firewall rule (New-", "a_doc_first": "Status: accepted (2026-06-21)", "b_doc_first": "" }, { "a": "REQ-ENDPOINT-LIST-NODE-GROUPED", "b": "REQ-ENDPOINT-LIST-NODE-IDENT", "a_title": "spt endpoint list is node-grouped over unique INSTANCES, not subnet-grouped over duplicated rows: on", "b_title": "Bug #5: spt endpoint list local section header is the hardcoded literal LOCAL (this node) (render_lo", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-ER-BRINGUP-TOTP-GATE", "b": "REQ-SUBNET-ADMIN-CODE-JOIN", "a_title": "Bringing the engine room online \u2014 and attaching a controller to it \u2014 requires a same-node CLI call P", "b_title": "The join ceremony accepts EITHER subnet code: the SPAKE2 responder computes the member-key TOTP and ", "a_doc_first": "Bring-online + controller-attach requires a **same-node CLI call plus a member-or-admin TOTP** for the engine-room's home subnet. The gate proves a human holding subnet material is at the controls; agents cannot pass it.", "b_doc_first": "1a. Amendment (2026-07-29): how \"either code\" is actually admitted / Consequences" }, { "a": "REQ-ER-PURGE-RESETS", "b": "REQ-ER-RESERVED-ENDPOINT", "a_title": "`endpoint purge` against the engine room RESETS it rather than deleting it, and requires OS elevatio", "b_title": "A node has exactly ONE engine-room endpoint, and 'exactly one' is STRUCTURAL rather than policed: th", "a_doc_first": "`endpoint purge` against an engine-room **requires OS elevation** and resets the endpoint instead of deleting it. The reset is the only way to change its home subnet or its harness adapter.", "b_doc_first": "A locked-down **agent endpoint** (harness-adapter-backed, spt-hosted, has a mind \u2014 it can be briefed on and reason about the node's access posture). It is the designated way to set the **node's** control-surface modes." }, { "a": "REQ-GOSSIP-CONTROLLED-ANY", "b": "REQ-PICKER-CONTROLLED-LOCAL", "a_title": "Bug #3: a locally-controlled endpoint gossips controller_node = None so remote viewers show it free ", "b_title": "#3 local half: a LOCALLY-controlled endpoint renders CONTROLLED in its own node's picker. display_st", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-HAZARD-ADAPTER-APPLY-SILENT-NOOP", "b": "REQ-SEAM-UPDATE", "a_title": "A DELEGATED live adapter apply MUST NEVER report success without performing the swap, and the live-u", "b_title": "Adapter-update avenue (file-pull / delegated command)", "a_doc_first": "7.24 A delegated live adapter apply must NEVER report success without swapping, and the live-update seam must use ONE parent-aware adapter matcher `[REQ-HAZARD-ADAPTER-APPLY-SILENT-NOOP]` Failure (F015B / BUILD-F015B-APPLYMATCH):** a live adapter update to a PROFILE-COMPOSITE endpoint (`--adapter cc", "b_doc_first": "" }, { "a": "REQ-HAZARD-ATTACH-WEDGE", "b": "REQ-INST-11", "a_title": "A legitimately dead PTY child (real crash/kill) + an undrained operator pump must NOT wedge the brok", "b_title": "spt rename rippled to all instances (collision-checked, 6.5-reconciled)", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-HAZARD-BIND-CWD-UNSET", "b": "REQ-SEAM-SPAWN", "a_title": "A bound endpoint's `info.cwd` is SET at bind so a freshly-created perch appears under its own projec", "b_title": "spawn-session seam", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-HAZARD-ATOMIC-TMP-COLLISION", "b": "REQ-MANIFEST-3", "a_title": "Concurrent atomic writers to the same target must not share a tmp name (5.15): a fixed tmp sibling m", "b_title": "Adapter strings \u2014 [strings] KV tree, dot-path get-string resolving through the profile leaf-replace ", "a_doc_first": "5.15 Fixed atomic-write tmp name \u2192 concurrent writers collide (loser renames a consumed file) `[REQ-HAZARD-ATOMIC-TMP-COLLISION]` Failure:** `atomic_write_bytes` staged every write under a **fixed** sibling `{name}.tmp`. Two processes writing the SAME target concurrently \u2014 traced at bind ~700\u00b5s apar", "b_doc_first": "adapter strings** (ratified 2026-06-11, Gateway grill): A `[strings]` manifest section \u2014 an adapter-authored JSON/TOML KV tree, dot-path-readable by anything on the node via `spt adapter get-string ` (e.g. a harness hook fetching per-profile `additionalContext` \u2014 one hook " }, { "a": "REQ-HAZARD-BOUNDARY-READY-STRAND", "b": "REQ-HAZARD-STALE-SIGNOFF-SENTINEL", "a_title": "C-2 (F029, SEAM-2 pinned \u2014 B6's SECOND HALF, the live-wake blocker; perri wakep9 vs wakep4 gate-stat", "b_title": "Stale signoff sentinel does not kill a fresh start (3.2)", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-HAZARD-BRAIN-RESTART-LIFECYCLE-REHYDRATE", "b": "REQ-HAZARD-THRASH-GUARD-BLIND", "a_title": "B4 (deepest): a bare brain restart (broker survives) REHYDRATES the live-agent lifecycle so post-res", "b_title": "W3 (F030 hazard; paid-for: evidence #6, hall-bf ~12/min re-host NEVER tripped the C3(b) thrash guard", "a_doc_first": "", "b_doc_first": "7.31 The Psyche failure budget must count REAL per-event attempts \u2014 a resident rate-guard is blind to per-event churn `[REQ-HAZARD-THRASH-GUARD-BLIND]` Failure (paid-for, field evidence 2026-07-04):** the pre-F-030 resident-hosting thrash guard keyed on ledger-rate boundaries that were NOT the real " }, { "a": "REQ-HAZARD-BRAIN-RESTART-PSYCHE-DUP", "b": "REQ-HAZARD-STOP-PATH-PSYCHE-ORPHAN-REAP", "a_title": "A bare brain restart leaves EXACTLY ONE `{id}-psyche` process per endpoint \u2014 no duplicate. On an abr", "b_title": "Endpoint-stop and brain-death reconcile MUST reap a brain-less perch's orphan detached Psyche via th", "a_doc_first": "", "b_doc_first": "| # | Invariant | spt-core surface | |---|---|---| | 1.1 | Grace wait precedes INIT_SIGNOFF | daemon teardown | | 1.4/4.4 | Deferred rows excluded from event-stream drain | daemon spool drain | | 2.1/5.1 | Stable PID/broker-handle over ephemeral PID | liveness detection | | 2.3 | Handoff argv/IPC ve" }, { "a": "REQ-HAZARD-BROKER-PROCESS-ISOLATION", "b": "REQ-UPDATE-ONE-SHOT-FINISH", "a_title": "Broker and brain are separate processes: the broker runs as its own long-lived per-machine process t", "b_title": "W3 (LIFECYCLE-TRUTH): update apply works daemonless and one command finishes the cycle. ROOT (operat", "a_doc_first": "6.7 Broker and brain MUST be separate processes (in-process collapse silently breaks no-endpoint-drop update) `[REQ-HAZARD-BROKER-PROCESS-ISOLATION]` Failure:** the daemon hosts the broker as a background *thread* in the single `spt daemon` process (`daemon.rs:165-170`, `Arc` + `thread::spaw", "b_doc_first": "" }, { "a": "REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE", "b": "REQ-HAZARD-VIEWER-STARVE-UNDER-CONTROLLER-BACKPRESSURE", "a_title": "W2 (LIFECYCLE-TRUTH, KNOWN-HAZARDS, flagship \u2014 the update wedge): PTY viewer fan-out and control mut", "b_title": "A SLOW controller must not starve a concurrent `rc --view` VIEWER. W1 (REQ-HAZARD-INJECT-CONTROL-COE", "a_doc_first": "7.36 The broker control plane and PTY fan-out must NEVER block on a single subscriber connection \u2014 a suspended brain conn must not wedge control `[REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE]` Failure (paid-for, rig-CONFIRMED 2026-07-06/07 \u2014 `NtSuspendProcess` on the brain, no update involved):** a cont", "b_doc_first": "" }, { "a": "REQ-HAZARD-CONFLICT-BOTH-PRESERVED", "b": "REQ-LIVEHOST-RECONCILE-TRIAL-SILENT", "a_title": "A surfaced concurrent context pair is durably preserved (both versions, tracked artifacts) until a s", "b_title": "SEED (DEFERRED investigation, doyle 2026-07-09 \u2014 UPDATE-WEDGE follow-up): determine WHY the trial/ro", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-HAZARD-CORRUPT-PERCH-COHERENCE", "b": "REQ-LISTEN-SESSION-ID-FALLBACK", "a_title": "Corrupt (present-but-unparseable) info.json is NOT absent: liveness/status readers agree a destroyed", "b_title": "F-034 leg c (perri/hertz field finding 2026-07-09): a session that goes live LATE (hours after Sessi", "a_doc_first": "5.14 Corrupt info.json read as ABSENT \u2192 fail-open readers gossip a wiped perch ONLINE `[REQ-HAZARD-CORRUPT-PERCH-COHERENCE]` Failure:** three readers each collapsed a **corrupt** (present-but-unparseable) `info.json` into their fail-open ABSENT default, so a NUL-wiped perch (5.13) read as permanentl", "b_doc_first": "Seed lifetime.** The seed lives **in the daemon's memory only** \u2014 no file \u2014 and survives until exactly one of: a successful `listen` bind consumes it, a newer `seed` for the same pid overwrites it, or the daemon process restarts (which drops the whole map). Nothing re-fires it until the harness's **" }, { "a": "REQ-HAZARD-CONTROL-STAMP-CONVERGENCE", "b": "REQ-STAMP-CONVERGENCE-ORDER", "a_title": "Control/viewer stamps must CONVERGE to broker session-table truth for every session-backed endpoint,", "b_title": "RETIRED at W2 verify-first (doyle 2026-07-22): the C3 poll-vs-reap ordering race (hertz emphasys RCA", "a_doc_first": "7.29 Control/viewer stamps CONVERGE to broker session-table truth, not merely edge-trigger `[REQ-HAZARD-CONTROL-STAMP-CONVERGENCE]` Failure (F-026 stamp-gap, hall-b + the original ball-b):** a picker-created endpoint (`endpoint run` \u2192 new) read plain `ONLINE` in the list + picker while genuinely dri", "b_doc_first": "" }, { "a": "REQ-HAZARD-CONTROLLER-IRRECOVERABLE-BEHIND", "b": "REQ-HAZARD-REDISPATCH-CONTROL-STEAL", "a_title": "DEFERRED EDGE of REQ-HAZARD-CONTROLLER-GAP-RESUME: when a serving controller falls behind the live r", "b_title": "REDISPATCH-TRUTH W1 (KNOWN-HAZARDS 7.41, hertz field RCA 2026-07-16 \u2014 4/5 endpoints frozen per brain", "a_doc_first": "", "b_doc_first": "7.41 A fresh dispatcher must NEVER re-serve a terminal stream \u2014 historical replay must not steal or clear a live controller `[REQ-HAZARD-REDISPATCH-CONTROL-STEAL]` Failure (paid-for, hertz field RCA 2026-07-16 \u2014 4/5 endpoints frozen, twice in one day):** every brain cycle (`spt daemon refresh`, `spt" }, { "a": "REQ-HAZARD-CORRUPT-PERCH-COHERENCE", "b": "REQ-HAZARD-HOSTED-LIVENESS-RECONCILE", "a_title": "Corrupt (present-but-unparseable) info.json is NOT absent: liveness/status readers agree a destroyed", "b_title": "B2 KEYSTONE: a daemon-hosted (spt-hosted) endpoint's info.json status is RECONCILED to real liveness", "a_doc_first": "5.14 Corrupt info.json read as ABSENT \u2192 fail-open readers gossip a wiped perch ONLINE `[REQ-HAZARD-CORRUPT-PERCH-COHERENCE]` Failure:** three readers each collapsed a **corrupt** (present-but-unparseable) `info.json` into their fail-open ABSENT default, so a NUL-wiped perch (5.13) read as permanentl", "b_doc_first": "" }, { "a": "REQ-HAZARD-DAEMON-HOSTED-LIVENESS", "b": "REQ-PSYCHE-LEGACY-RESIDENT-SWEEP", "a_title": "Daemon-hosted perches (Psyche, spt-hosted Self) derive liveness from the daemon endpoint table + inf", "b_title": "W5 (F030; doyle+perri 2026-07-04): a dirty daemon upgrade from <=v0.24.0 strands a RESIDENT psyche w", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-HAZARD-DAEMON-SCHED-NONBLOCKING", "b": "REQ-UPDATE-FINISH-COMMUNE-FLUSH", "a_title": "Per-agent pulse/psyche/echo-commune scheduling must not serialize across agents: each agent's bounde", "b_title": "DEFERRED (post-LIFECYCLE-TRUTH, operator-ruled 2026-07-07 \u2014 mint now, impl a FUTURE milestone): make", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-HAZARD-DEFERRED-MANIFEST", "b": "REQ-INST-11", "a_title": "A pointer-mode (delegated / GhReleaseManaged) adapter whose binary/manifest is not yet extracted is ", "b_title": "spt rename rippled to all instances (collision-checked, 6.5-reconciled)", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-HAZARD-CORRUPT-PERCH-COHERENCE", "b": "REQ-UPDATE-PROMOTE-DRAINED", "a_title": "Corrupt (present-but-unparseable) info.json is NOT absent: liveness/status readers agree a destroyed", "b_title": "W3 (LIFECYCLE-TRUTH, mechanic-d MOVED FROM W2 per doyle gate verdict @e5ae7a9 \u2014 binding): the update", "a_doc_first": "5.14 Corrupt info.json read as ABSENT \u2192 fail-open readers gossip a wiped perch ONLINE `[REQ-HAZARD-CORRUPT-PERCH-COHERENCE]` Failure:** three readers each collapsed a **corrupt** (present-but-unparseable) `info.json` into their fail-open ABSENT default, so a NUL-wiped perch (5.13) read as permanentl", "b_doc_first": "" }, { "a": "REQ-HAZARD-DETACHED-DAEMON-STDIO", "b": "REQ-INSTALL-10", "a_title": "A daemon DETACHED-IN-FACT (no interactive console, or an inherited stderr PIPE nobody drains) that n", "b_title": "Windows at-logon autostart runs the daemon in the background with no persistent window: the schedule", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-HAZARD-DRIVEN-BY-SELFHEAL", "b": "REQ-INST-11", "a_title": "An spt-hosted endpoint's ONLINE+CONTROLLED state (`driven_by`) must CLEAR even when the detach IPC i", "b_title": "spt rename rippled to all instances (collision-checked, 6.5-reconciled)", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-HAZARD-EFFECT-JOURNAL-PTY-WEDGE", "b": "REQ-HAZARD-RC-ATTACH-TRUTH", "a_title": "The effect journal serializes EVERY PTY effect under one mutex held ACROSS two fsyncs AND the blocki", "b_title": "RC-RENDER-TRUTH W1 (KNOWN-HAZARDS 7.46 \u2014 umbrella conformance seam for ADR-0042): an rc surface answ", "a_doc_first": "", "b_doc_first": "7.46 An rc surface answers from live session authority, never a stale persisted projection \u2014 and a resuming perch is UNBOUND, not offline `[REQ-HAZARD-RC-ATTACH-TRUTH]` Failure (paid-for, hertz perri contradiction RCA 2026-07-17/18 + operator field recovery):** the broker hosted an honest live sessi" }, { "a": "REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT", "b": "REQ-NET-3", "a_title": "A clean `spt rc` attach to a LIVE spt-hosted (`endpoint run`) harness must DELIVER the harness's PTY", "b_title": "Cross-node Psyche sync over P2P replaces gh-repo-sync", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-HAZARD-ENVELOPE-PARSER-SAFE", "b": "REQ-INJECT-MULTILINE-INTEGRITY", "a_title": "Two-slice envelope parser is panic-free and tolerant (4.2)", "b_title": "W5 (LIFECYCLE-TRUTH): the idle-inject TYPED delivery leg delivers multi-line bodies byte-complete. R", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-HAZARD-HOSTED-LIVENESS-RECONCILE", "b": "REQ-SHELL-2", "a_title": "B2 KEYSTONE: a daemon-hosted (spt-hosted) endpoint's info.json status is RECONCILED to real liveness", "b_title": "Shell sleep/wake: link-break always closes the binary (pre-close instruction + termination timeout),", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-HAZARD-DRIVEN-BY-SELFHEAL", "b": "REQ-HAZARD-LIVEHOST-BOOT-RACE", "a_title": "An spt-hosted endpoint's ONLINE+CONTROLLED state (`driven_by`) must CLEAR even when the detach IPC i", "b_title": "The brain's daemon-hosted Psyche lifecycle surfaces a host-FAILURE on the live perch (harness-diagno", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-HAZARD-INFO-JSON-TORN-READ", "b": "REQ-WHOAMI-IDENTITY-ONLY", "a_title": "State-file reads tolerate concurrent writes (1.2)", "b_title": "PROJECT-INDEX W1 (F-040, perri filing claude-spt docs/SPT-CORE-FINDINGS.md @d775b38; correctness-cri", "a_doc_first": "", "b_doc_first": "The bounded-time \"which endpoint am I?\" answer for hooks and adapter glue: resolves the calling session to its endpoint (`$OWL_SESSION_ID` `$SPT_AGENT_ID` / process ancestry) and prints that ONE endpoint's SELF line \u2014 id, liveness, description. **The no-derivation bound is the contract**: whoami nev" }, { "a": "REQ-HAZARD-INJECT-WORKER-POISON", "b": "REQ-HAZARD-VIEWER-RING-ROLL-SNAP", "a_title": "The per-session inject-worker floor Mutex is SHARED by the inject worker (open/flush) and the contro", "b_title": "A read-only rc --view VIEWER whose serving brain falls behind the live ring under a hard flood and r", "a_doc_first": "", "b_doc_first": "BUILT (M12 W2.5).** The controller/viewer model is implemented end-to-end. Attach intent is **three-valued** (`AttachIntent = Viewer | Control | Take`, wire-default `Control`): `Control` to a FREE endpoint becomes controller; `Control` to a CONTROLLED endpoint is **refused with guidance** (`--view` " }, { "a": "REQ-HAZARD-LIVEHOST-BOOT-LIVENESS-GATE", "b": "REQ-HAZARD-SHELL-STALE-ONLINE", "a_title": "B5: `spt daemon start` does NOT revive phantom Psyches for dead-but-online-latched perches. Today re", "b_title": "A shell instance's ONLINE-ness is DERIVED (recorded status AND its recorded `shell.pid` not provably", "a_doc_first": "", "b_doc_first": "| # | Invariant | spt-core surface | |---|---|---| | 1.1 | Grace wait precedes INIT_SIGNOFF | daemon teardown | | 1.4/4.4 | Deferred rows excluded from event-stream drain | daemon spool drain | | 2.1/5.1 | Stable PID/broker-handle over ephemeral PID | liveness detection | | 2.3 | Handoff argv/IPC ve" }, { "a": "REQ-HAZARD-LIVEHOST-NONRESIDENT", "b": "REQ-PSYCHE-NESTED-RESOLUTION", "a_title": "A daemon-hosted Psyche that spawns then EXITS IMMEDIATELY is a host failure, surfaced like a spawn f", "b_title": "W4 (F030, design \u00a73; F-017 sibling, general not psyche-only): nested {parent}/{nested} ids resolve u", "a_doc_first": "", "b_doc_first": "`{subnet}` \u2014 the endpoint's home-subnet label.** A single `{subnet}` key fills to this endpoint's home-subnet label (`local` when unhomed), supplied whenever it is known so a psyche turn need never resolve a `--subnet` it cannot know; when no subnet is known the key is left unfilled so a referencing" }, { "a": "REQ-HAZARD-PARENT-PID-PREFER", "b": "REQ-HAZARD-TEST-PID-TREE-KILL-IDENTITY", "a_title": "Prefer stable parent PID / broker handle over ephemeral PID (2.1)", "b_title": "Seed: any process kill driven by a pid read from a best-effort breadcrumb FILE \u2014 tree or single-proc", "a_doc_first": "", "b_doc_first": "Failure (golden run `30501468421`, Windows job `90742055246`):** `worker_lifecycle_e2e` ran all child calls, then read `daemon.pid` and invoked `taskkill /PID /F /T` before its first assertion or observability point. A hard-killed harness cannot unwind, producing the observed bare exit 1 with " }, { "a": "REQ-HAZARD-PSYCHE-RESIDENCY-EXPECTATION", "b": "REQ-WORKER-PICKER-EXCLUDED", "a_title": "W3 (F030 hazard; paid-for: hall-bf churn ordinal 6491+ + adapter v0.13.2 bad-ship brick 2026-07-04):", "b_title": "V-2 (WORKER-TRUTH triage, operator rider): non-drivable endpoint classes never render as `spt endpoi", "a_doc_first": "7.30 A Psyche failure of ANY shape must NEVER remove or alter the parent endpoint's ready/hosted state `[REQ-HAZARD-PSYCHE-RESIDENCY-EXPECTATION]` Failure (paid-for, field brick 2026-07-04, adapter v0.13.2):** the pre-F-030 model kept a **resident** Psyche process the daemon supervised, with residen", "b_doc_first": "" }, { "a": "REQ-HAZARD-ENDPOINT-LIFECYCLE", "b": "REQ-UPDATE-FINISH-COMMUNE-FLUSH", "a_title": "REGISTRY-LIFECYCLE W2 (KNOWN-HAZARDS 7.45 \u2014 the umbrella conformance seam for ADR-0041): endpoint li", "b_title": "DEFERRED (post-LIFECYCLE-TRUTH, operator-ruled 2026-07-07 \u2014 mint now, impl a FUTURE milestone): make", "a_doc_first": "7.45 Endpoint lifecycle state converges to truth from every death path \u2014 no optimistic online without authority, no surviving control stamps, no immortal wake intent, no untruthful create `[REQ-HAZARD-ENDPOINT-LIFECYCLE]` Failure (paid-for, three hertz reports + operator field 2026-07-16):** four fa", "b_doc_first": "" }, { "a": "REQ-HAZARD-RC-ATTACH-TRUTH", "b": "REQ-RESUME-UNBOUND-STAMP", "a_title": "RC-RENDER-TRUTH W1 (KNOWN-HAZARDS 7.46 \u2014 umbrella conformance seam for ADR-0042): an rc surface answ", "b_title": "RC-RENDER-TRUTH W1 (ADR-0042 decision 2, operator-spotted second root seam): resume launch transitio", "a_doc_first": "7.46 An rc surface answers from live session authority, never a stale persisted projection \u2014 and a resuming perch is UNBOUND, not offline `[REQ-HAZARD-RC-ATTACH-TRUTH]` Failure (paid-for, hertz perri contradiction RCA 2026-07-17/18 + operator field recovery):** the broker hosted an honest live sessi", "b_doc_first": "1. **`spt rc` consults the honest-session authority before the offline fast-fail. Normal `spt rc ` runs the same bounded `SessionProbe::has_live_session_honest` gate `endpoint run` uses (ADR-0041 single liveness authority). An honest session exists \u2192 attach via the session-confirmed path regardl" }, { "a": "REQ-HAZARD-REGISTRY-DIR-CREATE", "b": "REQ-SUBNET-ADMIN-CODE-JOIN", "a_title": "SQLite store opens create their parent dir themselves \u2014 a fresh-home registry op must not SQLITE_CAN", "b_title": "The join ceremony accepts EITHER subnet code: the SPAKE2 responder computes the member-key TOTP and ", "a_doc_first": "4.9 SQLite stores must create their parent dir \u2014 SQLite won't Failure:** `Connection::open` creates the database FILE but never its parent DIRECTORY. On a fresh home (first boot, fresh CI `_work` dir) a registry op that runs before any perch-creating op (`create_dir_all` side effects) fails `SQLITE_", "b_doc_first": "1a. Amendment (2026-07-29): how \"either code\" is actually admitted / Consequences" }, { "a": "REQ-HAZARD-RESUME-CUSTODY-ABA", "b": "REQ-RESUME-REAP-PRIOR-HARNESS", "a_title": "KNOWN-HAZARDS 7.51: process custody is an identity, never a bare PID \u2014 a recycled pid must read NOT ", "b_title": "B4 (F028, hall-b diagnosis, verified 0.22.0): `--resume` respawns a SECOND harness onto the SAME ses", "a_doc_first": "Failure (paid-for, hertz v0.39.4 field RCA 2026-07-22, doyle code-verified same day):** `resume.pid` custody is a bare PID consumed as `read_resume_pid(..).is_some_and(is_process_alive)` at BOTH the livehost restart gate and the liveness-reconcile DEFER. A dead wake-resume spawn's pid, recycled by t", "b_doc_first": "" }, { "a": "REQ-HAZARD-SESSION-PIN-WEDGE", "b": "REQ-MANIFEST-6", "a_title": "A perch PINNED to a DEAD session-id self-heals instead of wedging forever. authenticate() (spt/src/a", "b_title": "Cross-adapter fallback target addressing (M12-W3-T3.2): a cross-adapter fallback target is addressed", "a_doc_first": "7.25 A perch PINNED to a DEAD session self-heals (dead-owner re-pin) instead of wedging forever; a LIVE-owner rotation still refuses `[REQ-HAZARD-SESSION-PIN-WEDGE]` Failure (F-024C/F-024D, ENLYZEAM field + clean-room repro 2026-07-02):** `authenticate()` (auth.rs) gates `api poll`/`state`/`boundary", "b_doc_first": "Command templates are opaque.** spt-core never parses out a model/tool/flag \u2014 the adapter writes the whole command line; spt-core fills substitution keys and runs it. A command template's program token resolves against the adapter install dir before PATH (since v0.8.0).** A `.spt` adapter ships its " }, { "a": "REQ-HAZARD-SHAREDSEND-NO-BLOCKING-WRITE-UNDER-LOCK", "b": "REQ-UPDATE-APPLY-RESTART-NOTICE", "a_title": "UPDATE-WEDGE round-4 (hertz RCA, root reproduced + source-pinned on Windows 2026-07-09): EVERY write", "b_title": "`spt update apply` prints a LOUD restart-required notice whenever the surviving broker will keep run", "a_doc_first": "7.38 EVERY write on a physical broker connection is bounded + cancelable + poison-on-failure \u2014 no writer holds the send gate across an UNBOUNDED OS write `[REQ-HAZARD-SHAREDSEND-NO-BLOCKING-WRITE-UNDER-LOCK]` Failure (paid-for, field capture + deterministic Windows repro 2026-07-09 \u2014 hertz RCA, UPDA", "b_doc_first": "" }, { "a": "REQ-HAZARD-SPOOL-SENTINEL-CREATE-FAIL", "b": "REQ-MSG-IDLE-TRANSLATION-BINARY", "a_title": "A persistent failure to (re)create the spool has-messages sentinel is SURFACED, never silently swall", "b_title": "spt-hosted idle message delivery via an adapter TRANSLATION BINARY (ADR-0022). New opt-in manifest s", "a_doc_first": "", "b_doc_first": "`[message-idle-translation-binary]` \u2014 spt-hosted idle delivery / `[message-idle-translation-binary]` \u2014 spt-hosted idle delivery (ADR-0022) Opt-in. The adapter's **idle-delivery translation binary**: a pure stdin\u2192stdout JSON-lines filter spt-core lifecycle-manages (spawned when the spt-hosted endpoin" }, { "a": "REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT", "b": "REQ-READY-AGENT-RESUME", "a_title": "A clean `spt rc` attach to a LIVE spt-hosted (`endpoint run`) harness must DELIVER the harness's PTY", "b_title": "An offline ReadyAgent shows in `spt endpoint run`'s picker Resume-from-history and resumes correctly", "a_doc_first": "", "b_doc_first": "`spt endpoint run` is the spt-hosted bringup for BOTH endpoint types** (v0.12.0): The bringup core is **type-agnostic** \u2014 the endpoint TYPE is the adapter manifest's concern, not a separate bringup mode. A manifest declaring `[session.psyche_init]` brings up a **LiveAgent** (the daemon reconcile hos" }, { "a": "REQ-HAZARD-TEST-PID-TREE-KILL-IDENTITY", "b": "REQ-RESUME-CUSTODY-IDENTITY", "a_title": "Seed: any process kill driven by a pid read from a best-effort breadcrumb FILE \u2014 tree or single-proc", "b_title": "Resume custody is an identity pair (pid + process creation time), never a bare PID. (ADR-0047 decisi", "a_doc_first": "Failure (golden run `30501468421`, Windows job `90742055246`):** `worker_lifecycle_e2e` ran all child calls, then read `daemon.pid` and invoked `taskkill /PID /F /T` before its first assertion or observability point. A hard-killed harness cannot unwind, producing the observed bare exit 1 with ", "b_doc_first": "1. Process custody is an identity, never a bare PID" }, { "a": "REQ-HAZARD-UPDATE-ROLLBACK", "b": "REQ-UPD-4", "a_title": "Self-update rejects version rollback; metadata expiry + adapter content signing (codex #5)", "b_title": "Update gated on user confirmation by default; opt-in full-auto", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-HAZARD-WMI-DAEMON-WINDOW", "b": "REQ-PICKER-ADAPTER-DESCRIPTION", "a_title": "`spt daemon start` launches the daemon with NO visible console window. REGRESSION (v0.12.1 L1.5): th", "b_title": "The Create-new adapter-CHOICE screen of `spt endpoint run`'s picker shows a right-hand Description p", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-HOST-RUN-1", "b": "REQ-READY-AGENT-RESUME", "a_title": "spt-hosted harness bringup: `spt endpoint run` spawns an adapter's `[session.self]` command template", "b_title": "An offline ReadyAgent shows in `spt endpoint run`'s picker Resume-from-history and resumes correctly", "a_doc_first": "", "b_doc_first": "`spt endpoint run` is the spt-hosted bringup for BOTH endpoint types** (v0.12.0): The bringup core is **type-agnostic** \u2014 the endpoint TYPE is the adapter manifest's concern, not a separate bringup mode. A manifest declaring `[session.psyche_init]` brings up a **LiveAgent** (the daemon reconcile hos" }, { "a": "REQ-INST-1", "b": "REQ-INSTALL-12", "a_title": "endpoint ID vs instance split (adapter-agnostic ID)", "b_title": "Durable active-profile pointer for bind-time profile selection (ADR-0021): adapters/active-profiles.", "a_doc_first": "", "b_doc_first": "Bind-time adapter/profile resolution (ADR-0021).** Because the seed is adapter-agnostic, `listen`/`poll` resolve the owning adapter/profile when they bind, as a pure read \u2014 never a seed-time snapshot that could drift. `--adapter ` is an **optional override** on the `api` group (an ex" }, { "a": "REQ-INST-11", "b": "REQ-SHELL-2", "a_title": "spt rename rippled to all instances (collision-checked, 6.5-reconciled)", "b_title": "Shell sleep/wake: link-break always closes the binary (pre-close instruction + termination timeout),", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-HAZARD-HANDOFF-ARGV-COMPAT", "b": "REQ-SESSIONS-LOG-ENDPOINT-ATTRIBUTION", "a_title": "Broker/brain IPC + handoff argv version-tolerant (2.3)", "b_title": "C2 (F028, infra; ROOT-CAUSED + severity-upgraded doyle RCA 2026-07-03): cross-endpoint perch contami", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-INST-15", "b": "REQ-INSTALL-5", "a_title": "Immutable home subnet (assigned at creation: auto-if-one/ask-if-many) + spt fork (cross-subnet clone", "b_title": "Non-interactive install path: the install path doubles as every adapter's pack-in on-demand install ", "a_doc_first": "Delivered (M4-D9-5, 2026-06-04):** home assignment at creation (`spt_store::home` \u2014 auto-if-one / ask-if-many / local-only-until-first-join, carried forward across re-binds, no setter) + `sync_subnets = [home]` creation seeding + `spt fork --subnet -` launcher shortcut generation (picker `s` keybind, M12-W2-T2.4): from any pre-start", "a_doc_first": "Command templates are opaque.** spt-core never parses out a model/tool/flag \u2014 the adapter writes the whole command line; spt-core fills substitution keys and runs it. A command template's program token resolves against the adapter install dir before PATH (since v0.8.0).** A `.spt` adapter ships its ", "b_doc_first": "`spt-` shortcut** (picker `s` keybind, M12-W2): From any pre-start options set, `s` writes (or updates) a **`-` launcher** at the project root that bakes the current selection's **non-interactive** flags (terminal actions only: adapter[:profile] + id + create|resume + start|attach|" }, { "a": "REQ-INSTALL-3", "b": "REQ-RUN-SHORTCUT", "a_title": "Idempotent + interactive-optional first run", "b_title": "`-` launcher shortcut generation (picker `s` keybind, M12-W2-T2.4): from any pre-start", "a_doc_first": "", "b_doc_first": "`spt-` shortcut** (picker `s` keybind, M12-W2): From any pre-start options set, `s` writes (or updates) a **`-` launcher** at the project root that bakes the current selection's **non-interactive** flags (terminal actions only: adapter[:profile] + id + create|resume + start|attach|" }, { "a": "REQ-INSTALL-9", "b": "REQ-MIGRATE-1", "a_title": "Adapter add from a GitHub release archive: `spt adapter add --release [--tag ] [--a", "b_title": "Auto-detect and migrate a legacy claude_skill_owl install", "a_doc_first": "adapter registration (`spt adapter add`)**: How a node comes to *know* an adapter \u2014 harness or shell. An explicit **`spt adapter add `** (or **`--github `**) validates the manifest against the published JSON Schema and writes a registration record under `{SPT_HOME}/\u2026/adapters/` \u2014 a ", "b_doc_first": "" }, { "a": "REQ-HAZARD-HOSTED-LIVENESS-RECONCILE", "b": "REQ-LIVEHOST-RECONCILE-TRIAL-SILENT", "a_title": "B2 KEYSTONE: a daemon-hosted (spt-hosted) endpoint's info.json status is RECONCILED to real liveness", "b_title": "SEED (DEFERRED investigation, doyle 2026-07-09 \u2014 UPDATE-WEDGE follow-up): determine WHY the trial/ro", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-LISTEN-PRESERVES-HOSTING-TOPOLOGY", "b": "REQ-PRESENCE-CONTROL-REAP-ON-EXIT", "a_title": "`api listen` must not ASSERT hosting topology it does not know. (hertz v0.39.0 field RCA 2026-07-21,", "b_title": "B3 (F028, hall-b diagnosis + deferred #11 seed; BROADENED perri F-b CONFIRMED): dead-pid ONLINE deca", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-LIVE-AGENT-NO-INJECT-DELIVERY", "b": "REQ-STREAM-OPENER-DURABLE", "a_title": "F-033 RE-SCOPED (doyle re-ruling 2026-07-10 after the #82 gate falsified the original premise \u2014 the ", "b_title": "REDISPATCH-TRUTH W1 (ADR-0038, hertz fix B): stream classification identity is RESTART-DURABLE and i", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-MANIFEST-6", "b": "REQ-MANIFEST-8", "a_title": "Cross-adapter fallback target addressing (M12-W3-T3.2): a cross-adapter fallback target is addressed", "b_title": "[adapter] host_binaries declares the harness executable basenames a kind=\"harness\" adapter hosts age", "a_doc_first": "Command templates are opaque.** spt-core never parses out a model/tool/flag \u2014 the adapter writes the whole command line; spt-core fills substitution keys and runs it. A command template's program token resolves against the adapter install dir before PATH (since v0.8.0).** A `.spt` adapter ships its ", "b_doc_first": "Bind-time adapter/profile resolution (ADR-0021).** Because the seed is adapter-agnostic, `listen`/`poll` resolve the owning adapter/profile when they bind, as a pure read \u2014 never a seed-time snapshot that could drift. `--adapter ` is an **optional override** on the `api` group (an ex" }, { "a": "REQ-MESH-2", "b": "REQ-SUBNET-2", "a_title": "Member roster: node-level union-merge grow-set (per member: pubkey, label, machine_id, last-known ad", "b_title": "Guided join e2e: spt subnet join CLI initiator + always-on daemon pairing responder", "a_doc_first": "", "b_doc_first": "Product-surface amendment (2026-06-05 \u2014 M7 D3)" }, { "a": "REQ-MSG-CLI-ORIGIN", "b": "REQ-MSG-SELF-DETECT-ANCESTRY", "a_title": "A bare non-perch CLI `spt send` (no owning perch to name as origin) stamps from = `cli@`", "b_title": "#9 (F026, operator field bug): a perch-owned `spt send` from an endpoint's OWN session must self-ide", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-MSG-SELF-DETECT-ANCESTRY", "b": "REQ-SHELL-LIST-DERIVED-PROVENANCE", "a_title": "#9 (F026, operator field bug): a perch-owned `spt send` from an endpoint's OWN session must self-ide", "b_title": "SEED (inactive \u2014 observability, perri-backed 2026-07-26): a status a reader can act on should be dis", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-INST-15", "b": "REQ-PLATFORM-REGISTRY", "a_title": "Immutable home subnet (assigned at creation: auto-if-one/ask-if-many) + spt fork (cross-subnet clone", "b_title": "MUSL-TIER W1 (target-triple centralization, behaviour-NEUTRAL refactor): ONE authoritative platform ", "a_doc_first": "Delivered (M4-D9-5, 2026-06-04):** home assignment at creation (`spt_store::home` \u2014 auto-if-one / ask-if-many / local-only-until-first-join, carried forward across re-binds, no setter) + `sync_subnets = [home]` creation seeding + `spt fork --subnet `** (or **`--github `**) validates the manifest against the published JSON Schema and writes a registration record under `{SPT_HOME}/\u2026/adapters/` \u2014 a " }, { "a": "REQ-PICKER-CHOOSE-DEDUP-ALL", "b": "REQ-PICKER-HISTORY-FRESH", "a_title": "A4 (F028, operator #5): choose-project duplicate rows. model.rs:314-337 build_project_choices dedups", "b_title": "The `spt endpoint run` picker shows project history for FRESH endpoints (operator-raised v0.12.0 rea", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-PICKER-CURRENT-DIR-LABEL", "b": "REQ-PICKER-NODE-GROUPING", "a_title": "A-2/A-3 (F029, operator, semantic pair): the Choose-project rows must self-identify the CURRENT DIR.", "b_title": "Bug #13: the endpoint run Subnet tab shows a machine once PER shared subnet (subnet_rows data.rs:253", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-PICKER-NODE-GROUPING", "b": "REQ-PICKER-REMOTE-WAKE", "a_title": "Bug #13: the endpoint run Subnet tab shows a machine once PER shared subnet (subnet_rows data.rs:253", "b_title": "C-2 (REMOTE-TRUTH triage \u00a7C-2 #4 + addendum @3442ce5): a REMOTE suspended picker row offers `Wake no", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-PICKER-PROJECT-DISPLAY-NAME", "b": "REQ-PICKER-RESUME-CONTEXT-PANEL", "a_title": "A1 (F028, operator #1/#4/#6-display): `github-com-*` 'ghost' project entries are NOT phantoms \u2014 proj", "b_title": "#6: the 'Resume from history' view keeps the endpoint's 'Confirm selection' top panel and swaps ONLY", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-PICKER-RESUME-CONTEXT-PANEL", "b": "REQ-RESUME-ROW-PER-PROJECT", "a_title": "#6: the 'Resume from history' view keeps the endpoint's 'Confirm selection' top panel and swaps ONLY", "b_title": "A5 (F028, operator #6): resume-from-history labels EVERY session with the endpoint's newest project.", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-PRESENCE-CONTROL-REAP-ON-EXIT", "b": "REQ-UPDATE-APPLY-ALREADY-APPLIED", "a_title": "B3 (F028, hall-b diagnosis + deferred #11 seed; BROADENED perri F-b CONFIRMED): dead-pid ONLINE deca", "b_title": "`spt update apply` classifies an already-staged / already-applied state as a friendly exit-0 no-op i", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-INSTALL-13", "b": "REQ-SEAM-UPDATE", "a_title": "Adapter add is non-destructive & idempotent-safe (F-018): `spt adapter add --github|--release` REFUS", "b_title": "Adapter-update avenue (file-pull / delegated command)", "a_doc_first": "adapter registration (`spt adapter add`)**: How a node comes to *know* an adapter \u2014 harness or shell. An explicit **`spt adapter add `** (or **`--github `**) validates the manifest against the published JSON Schema and writes a registration record under `{SPT_HOME}/\u2026/adapters/` \u2014 a ", "b_doc_first": "" }, { "a": "REQ-PSYCHE-CRASHLOOP-BACKOFF-SHUTDOWN", "b": "REQ-PSYCHE-STAMP-CLEAR-ANY-SUCCESS", "a_title": "C3 (F028, perri F-h): psyche wrapper crash-loop has no backoff, and `endpoint shutdown` misses a wed", "b_title": "W1 (LIFECYCLE-TRUTH): EVERY successful psyche operation clears psyche_host_error \u2014 not just the puls", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-PSYCHE-LEGACY-RESIDENT-SWEEP", "b": "REQ-UPDATE-RUNNING-IMAGE-SURFACE", "a_title": "W5 (F030; doyle+perri 2026-07-04): a dirty daemon upgrade from <=v0.24.0 strands a RESIDENT psyche w", "b_title": "`spt` surfaces the RUNNING broker image version beside the on-disk version so an updated-looking nod", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-PSYCHE-SPAWN-ENV-PARITY", "b": "REQ-SESSION-ADAPTER-RECORDED", "a_title": "P-2 (WORKER-TRUTH triage addendum, perri-filed field finding 2026-07-06): the per-event psyche_resum", "b_title": "D-2 (REMOTE-TRUTH triage \u00a7D-2 + operator Q5 @c248afc): the session ledger records the adapter[:profi", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-RC-DISPLAY-SOLE-WRITER", "b": "REQ-RC-RECONNECT", "a_title": "TEARDOWN-AUTHORITY W5 (hertz RCA 3 bug 1, 2026-07-19 \u2014 REPRODUCED on 0.38.1 CLI + 0.38.1 broker; doy", "b_title": "B-3 (REMOTE-TRUTH triage \u00a7B-3, the operator-asked UX): the rc attach viewport RECONNECTS on a severe", "a_doc_first": "", "b_doc_first": "| # | Fault injected | Blast radius (by design) | Survives untouched | Recovery | Evidence | |---|---|---|---|---|---| | 1 | **Brain killed mid-PTY-stream** (logic crash / routine self-update) | Logic halts until restart | Broker, PTY child (pid stable), output log | New brain re-subscribes from cur" }, { "a": "REQ-RC-QUALIFIED-TARGET-CANONICAL", "b": "REQ-RESUME-UNBOUND-STAMP", "a_title": "RC-RENDER-TRUTH W1 (ADR-0042 decision 4, hertz elevated-endpoints RCA core leg 2, doyle seam-confirm", "b_title": "RC-RENDER-TRUTH W1 (ADR-0042 decision 2, operator-spotted second root seam): resume launch transitio", "a_doc_first": "1. **`spt rc` consults the honest-session authority before the offline fast-fail. Normal `spt rc ` runs the same bounded `SessionProbe::has_live_session_honest` gate `endpoint run` uses (ADR-0041 single liveness authority). An honest session exists \u2192 attach via the session-confirmed path regardl", "b_doc_first": "1. **`spt rc` consults the honest-session authority before the offline fast-fail. Normal `spt rc ` runs the same bounded `SessionProbe::has_live_session_honest` gate `endpoint run` uses (ADR-0041 single liveness authority). An honest session exists \u2192 attach via the session-confirmed path regardl" }, { "a": "REQ-REGISTRY-APPLY-TRANSACTIONAL", "b": "REQ-SEAT-LIFETIME-BOUNDED", "a_title": "REGISTRY-LIFECYCLE W1 (ADR-0040 decision 3, hertz defect B leg 3): registry feed application is TRAN", "b_title": "REGISTRY-LIFECYCLE W1 (ADR-0040 decision 5, hertz defect B leg 5 CROSS-FAMILY per the final attribut", "a_doc_first": "1. **One-way (fire-and-forget) stream families are terminal at FIN, sender-side.** The registry feed pump retires its own row after successful write+FIN via the existing `net-stream-retire` verb (best-effort on N-1 brokers, per ADR-0038 A). A one-way family's exchange is definitionally over at FIN; ", "b_doc_first": "1. **One-way (fire-and-forget) stream families are terminal at FIN, sender-side.** The registry feed pump retires its own row after successful write+FIN via the existing `net-stream-retire` verb (best-effort on N-1 brokers, per ADR-0038 A). A one-way family's exchange is definitionally over at FIN; " }, { "a": "REQ-MANIFEST-7", "b": "REQ-PROJECT-INDEX-READER-CUTOVER", "a_title": "Adapter-declared shortcut basename (M12-W2 follow-on): an optional `[adapter] shortcut_basename` man", "b_title": "PROJECT-INDEX W3 (ADR-0037): endpoint list, the picker, and endpoint-info consume the materialized i", "a_doc_first": "`shortcut_basename` *(optional, default `spt`)* \u2014 the basename the `spt endpoint run` picker's `s` keybind bakes into the generated `-` launcher shortcut at the project root (REQ-MANIFEST-7). Absent \u21d2 the harness-agnostic `spt` (\u2192 `spt-`); an adapter sets it to brand its shortcuts ", "b_doc_first": "project index** \u2014 a node's endpoint\u2192project attribution is DERIVED state, held as a **persistent materialized index** (ADR-0037): `spt-store` owns the versioned format + read path (daemon-offline reads = last persisted snapshot); the **daemon is the sole single-flight writer** (load-at-start, ready-" }, { "a": "REQ-RELEASE-MUSL-ARTIFACT", "b": "REQ-UPDATE-ONE-SHOT-FINISH", "a_title": "MUSL-TIER W3 (CI build + signed release + update-set publish + self-update E2E): release.yml gains a", "b_title": "W3 (LIFECYCLE-TRUTH): update apply works daemonless and one command finishes the cycle. ROOT (operat", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-RESUME-CONTEXT-PULL", "b": "REQ-XTASK-SPT-BIN-TARGET-DIR", "a_title": "Adapter-callable resume-context pull verb + not-yet-synthesized commune/signoff drop append (legacy-", "b_title": "#13 (F026 micro, tooling): xtask `spt_bin()` (crates/xtask/src/main.rs) BUILDS `spt` via cargo (whic", "a_doc_first": "resume-session seam** \u2014 two distinct forms: fresh-with-preload:** resume with *cleared* context (a fresh session) + psyche-download. Accepts a `$psyche-context` key to launch the fresh session with the psyche-download preloaded \u2014 or the adapter instead pulls it via an spt-core command in its Session", "b_doc_first": "" }, { "a": "REQ-RUN-ID-REUSES-ADAPTER", "b": "REQ-TERM-7", "a_title": "D-1 (REMOTE-TRUTH triage \u00a7D-1): `spt endpoint run --id ` with NO --adapter, when names an E", "b_title": "Two-origin digest merge: spt-owned context-injection entries (psyche_download | echo_mirror | owl_me", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-SEAM-PSYCHE", "b": "REQ-TERM-7", "a_title": "spawn-psyche seam (fresh + resume templates)", "b_title": "Two-origin digest merge: spt-owned context-injection entries (psyche_download | echo_mirror | owl_me", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-SESSION-ADAPTER-RECORDED", "b": "REQ-START-2", "a_title": "D-2 (REMOTE-TRUTH triage \u00a7D-2 + operator Q5 @c248afc): the session ledger records the adapter[:profi", "b_title": "Harness-hosted startup: api seed then listen", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-SPOOL-TAKE-AUDIT", "b": "REQ-TERM-7", "a_title": "W5 (LIFECYCLE-TRUTH, RCA cost: proving WHO took delivered=1 rows burned an hour): the spool records ", "b_title": "Two-origin digest merge: spt-owned context-injection entries (psyche_download | echo_mirror | owl_me", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-MANIFEST-8", "b": "REQ-TERM-5", "a_title": "[adapter] host_binaries declares the harness executable basenames a kind=\"harness\" adapter hosts age", "b_title": "Adapter-declared digest extractor seam: a `[digest]` manifest section declaring an imperative extrac", "a_doc_first": "Bind-time adapter/profile resolution (ADR-0021).** Because the seed is adapter-agnostic, `listen`/`poll` resolve the owning adapter/profile when they bind, as a pure read \u2014 never a seed-time snapshot that could drift. `--adapter ` is an **optional override** on the `api` group (an ex", "b_doc_first": "The session digest is a PROJECTION of the endpoint's session logs, never a PTY-byte parse (the superseded source mechanism). ADR-0019 gives it its OWN manifest seam \u2014 the `[digest]` extractor above \u2014 distinct from `[history]` (which stays opaque + single-session, feeding the echo-commune verbatim). " }, { "a": "REQ-SUBNET-ADMIN-SEED-REPLICATION", "b": "REQ-SUBNET-CREATE-CAPTURE-PROOF", "a_title": "Every member node holds BOTH subnet seeds \u2014 the admin seed replicates at join exactly as the member ", "b_title": "`subnet create` proves the admin key was captured before anything persists (ADR-0051 \u00a72b, FF grill 2", "a_doc_first": "2. Held everywhere, revealable nowhere / 3. Irrecoverable by design", "b_doc_first": "2b. Capture proof at create (added 2026-07-30, fast-follow grill)" }, { "a": "REQ-UPD-2", "b": "REQ-UPDATE-FINISH-COMMUNE-FLUSH", "a_title": "All binaries signature-verified before handoff", "b_title": "DEFERRED (post-LIFECYCLE-TRUTH, operator-ruled 2026-07-07 \u2014 mint now, impl a FUTURE milestone): make", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-UPD-6", "b": "REQ-UPDATE-RUNNING-IMAGE-SURFACE", "a_title": "Platform-targeted update sets and debug rollout: signed multi-platform update metadata, recipient pl", "b_title": "`spt` surfaces the RUNNING broker image version beside the on-disk version so an updated-looking nod", "a_doc_first": "Build plan \u2014 `xtask debug-converge` (deferred follow-up) / Debug rollout runbook", "b_doc_first": "" }, { "a": "REQ-UPDATE-FETCH-APPLY-FLAG", "b": "REQ-UPDATE-RUNNING-IMAGE-SURFACE", "a_title": "`spt update fetch --apply` is the one-shot get-to-latest: fetch, then INSTALL the staged update REGA", "b_title": "`spt` surfaces the RUNNING broker image version beside the on-disk version so an updated-looking nod", "a_doc_first": "", "b_doc_first": "" }, { "a": "REQ-MSG-5", "b": "REQ-MSG-DELIVERY-AXES", "a_title": "user-msg envelope kind + daemon identity gate: a Gateway endpoint / the local user's CLI author user", "b_title": "Activity-gated inbound delivery + per-message send control as THREE ORTHOGONAL AXES plus opaque meta", "a_doc_first": "A message sent from a Gateway carries **the user's authority** \u2014 it *is* the user speaking through a device \u2014 and is delivered typed **`user-msg`** (ratified 2026-06-12) so receiving agents weight it as user instruction, not peer-agent chatter. The type is **identity-gated, never payload-trusted** (", "b_doc_first": "Activity-gated message delivery + send-modifier axes" }, { "a": "REQ-MSG-INJECT-LEG-DROP-VISIBLE", "b": "REQ-RC-WIN-PASTE", "a_title": "SEED (inactive \u2014 observability): a silently-dropped delivery leg must be DISTINGUISHABLE from an hon", "b_title": "In an `spt rc` session neither ctrl+V nor right-click pastes (CC explicitly supports ctrl+V). ROOT (", "a_doc_first": "", "b_doc_first": "7.18 `spt rc` paste is client-originated on Windows \u2014 read the LOCAL clipboard, inject a BRACKETED paste `[REQ-RC-WIN-PASTE]` Failure (operator dogfooding):** in an `spt rc` session neither ctrl+V nor right-click pasted (CC explicitly supports ctrl+V). `RawGuard` did only `enable_raw_mode` (no brack" }, { "a": "REQ-ONEWAY-STREAM-TERMINAL", "b": "REQ-REGISTRY-APPLY-TRANSACTIONAL", "a_title": "REGISTRY-LIFECYCLE W1 (ADR-0040 decision 1, hertz defect B leg 1): a one-way fire-and-forget stream ", "b_title": "REGISTRY-LIFECYCLE W1 (ADR-0040 decision 3, hertz defect B leg 3): registry feed application is TRAN", "a_doc_first": "1. **One-way (fire-and-forget) stream families are terminal at FIN, sender-side.** The registry feed pump retires its own row after successful write+FIN via the existing `net-stream-retire` verb (best-effort on N-1 brokers, per ADR-0038 A). A one-way family's exchange is definitionally over at FIN; ", "b_doc_first": "1. **One-way (fire-and-forget) stream families are terminal at FIN, sender-side.** The registry feed pump retires its own row after successful write+FIN via the existing `net-stream-retire` verb (best-effort on N-1 brokers, per ADR-0038 A). A one-way family's exchange is definitionally over at FIN; " } ]