[ { "num": 1, "a": "REQ-ARCH-2", "b": "REQ-INST-1", "a_title": "Public SDK surface is spt-proto, spt-runtime, spt-msg", "b_title": "endpoint ID vs instance split (adapter-agnostic ID)", "a_doc_snippet": "", "b_doc_snippet": "" }, { "num": 2, "a": "REQ-HAZARD-CONTROL-STAMP-LIFETIME", "b": "REQ-HAZARD-REGISTRY-STALL", "a_title": "#2: a control/viewer stamp never outlives its session — every teardown path clears what attach stamped. The broker exit-waiter (broker.rs ~:1844) send", "b_title": "REGISTRY-LIFECYCLE W1 (KNOWN-HAZARDS 7.44, hertz post-close v0.36 RCA — the umbrella conformance seam): streams and seats on a long-lived connection h", "a_doc_snippet": "7.26 Concurrent first-touch of ONE fresh BranchStore must ALL succeed — a non-atomic `git init` race must never strand a first-toucher `[REQ-HAZARD-STORE-INIT-RACE]`: ### 7.27 A control/viewer stamp must NEVER outlive its session — every teardown path clears what attach stamped `[REQ-HAZARD", "b_doc_snippet": "7.43 One wedged stream subscriber must NEVER stall stream serving — replay halts at the first failed write, a poisoned subscriber is removed, and recovery machinery must not manufacture new replay victims `[REQ-HAZARD-REDISPATCH-STALL]`: ### 7.44 Streams and seats on a long-lived connection must hav" }, { "num": 3, "a": "REQ-LISTEN-PRESERVES-HOSTING-TOPOLOGY", "b": "REQ-START-1", "a_title": "`api listen` must not ASSERT hosting topology it does not know. (hertz v0.39.0 field RCA 2026-07-21, doyle re-grounded at source.) OBSERVED: the publi", "b_title": "Adapters never resolve SPT_HOME; binary on PATH; api bridging only", "a_doc_snippet": "", "b_doc_snippet": "" }, { "num": 4, "a": "REQ-ECHO-DROP-DIR-RESOLVE", "b": "REQ-HAZARD-RESUME-CUSTODY-ABA", "a_title": "W1 (LIFECYCLE-TRUTH): fire_echo resolves the manifest commune_dir through the SAME resolver its siblings use before any write. ROOT (pinned): fire_ech", "b_title": "KNOWN-HAZARDS 7.51: process custody is an identity, never a bare PID — a recycled pid must read NOT OURS. The hazard-conformance twin of REQ-RESUME-CU", "a_doc_snippet": "", "b_doc_snippet": "7.51 Process custody is an identity, never a bare PID — a recycled pid must read NOT OURS `[REQ-HAZARD-RESUME-CUSTODY-ABA]`: - **Failure (paid-for, hertz v0.39.4 field RCA 2026-07-22, doyle code-verified same day):** `resume.pid` custody is a bare PID consumed as `read_resume_pid(..).is_som" }, { "num": 5, "a": "REQ-DOCS-6", "b": "REQ-MANIFEST-4", "a_title": "spt how-to : in-binary task-oriented agent instructions (anti-drift; quickstart prompts point agents at it)", "b_title": "Keyword hints — [[hints]] {keywords (literal/regex), text}; spt api hint --session emits at most one matched hint per message, once per session (seen-", "a_doc_snippet": "Quickstart: two agents exchange a message: Once-per-session usage/syntax hints, a first-class adapter feature: the manifest's `[hints]` section declares entries of `{keywords (literal default, regex opt-in), text}`; the adapter's user-prompt hook pipes the **" }, { "num": 6, "a": "REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE", "b": "REQ-HAZARD-RESTART-IDEMPOTENT", "a_title": "W2 (LIFECYCLE-TRUTH, KNOWN-HAZARDS, flagship — the update wedge): PTY viewer fan-out and control mutations must not depend synchronously on a live dra", "b_title": "Idempotent/exactly-once delivery across brain restart at every broker boundary (codex #14)", "a_doc_snippet": "7.35 The cached ceremony-clock NTP offset must NOT survive an OS clock STEP — an offset measured against the pre-step clock strands every pairing for the TTL `[REQ-HAZARD-CEREMONY-CLOCK-STEP]`: ### 7.36 The broker control plane and PTY fan-out must NEVER block on a single subscriber connection — a s", "b_doc_snippet": "" }, { "num": 7, "a": "REQ-DAEMON-9", "b": "REQ-NET-FAMILY-GATE", "a_title": "Net-bind boot-race resilience: a daemon that comes up net-less (NetHost::start failed — e.g. the systemd unit autostarted before the network/DNS stack", "b_title": "spt-core binds only IP families that are actually REACHABLE (ADR-0030), so a half-broken family (e.g. IPv6 whose AAAA resolves but whose path is dead)", "a_doc_snippet": "", "b_doc_snippet": "Robust WAN subnet join: meet-before-code + per-family bind gate: " }, { "num": 8, "a": "REQ-CONN-POISON-ATTRIBUTION", "b": "REQ-HAZARD-RC-ATTACH-TRUTH", "a_title": "MSG-IDENTITY W6 / F-039 legs b-d (doyle W6 LOCK 2026-07-10, minted per amendment 3): every broker-conn lifecycle record is ATTRIBUTABLE — the W6 RCA's", "b_title": "RC-RENDER-TRUTH W1 (KNOWN-HAZARDS 7.46 — umbrella conformance seam for ADR-0042): an rc surface answers from live session authority, never a stale per", "a_doc_snippet": "", "b_doc_snippet": "7.45 Endpoint lifecycle state converges to truth from every death path — no optimistic online without authority, no surviving control stamps, no immortal wake intent, no untruthful create `[REQ-HAZARD-ENDPOINT-LIFECYCLE]`: ### 7.46 An rc surface answers from live session authority, never a stale per" }, { "num": 9, "a": "REQ-ENDPOINT-LIST-REST-FILTER", "b": "REQ-PICKER-KEY-GATE-LAUNCH-CAPABLE", "a_title": "spt endpoint list hides SUSPENDED instances by default; a new --show-all flag reveals them. Status-first row ordering with fixed precedence ONLINE > C", "b_title": "B-1 (F029, operator): the `h` (headless start) / `s` (shortcut) keybinds fire from broad picker contexts (mod.rs handle_confirm_key / ChooseProject / ", "a_doc_snippet": "", "b_doc_snippet": "" }, { "num": 10, "a": "REQ-HAZARD-INBOX-NO-DOUBLE", "b": "REQ-HAZARD-RESTART-IDEMPOTENT", "a_title": "No double-delivery via legacy inbox (4.5)", "b_title": "Idempotent/exactly-once delivery across brain restart at every broker boundary (codex #14)", "a_doc_snippet": "", "b_doc_snippet": "" }, { "num": 11, "a": "REQ-HAZARD-PSYCHE-RESIDENCY-EXPECTATION", "b": "REQ-HAZARD-TEARDOWN-DEADEND", "a_title": "W3 (F030 hazard; paid-for: hall-bf churn ordinal 6491+ + adapter v0.13.2 bad-ship brick 2026-07-04): a psyche failure of ANY shape must NOT remove or ", "b_title": "TEARDOWN-AUTHORITY W1 HAZARD (ADR-0045 decision 8; hertz RCA 2 — hit doyle's OWN live production endpoint, recoverable only by out-of-band scoped kill", "a_doc_snippet": "7.29 Control/viewer stamps CONVERGE to broker session-table truth, not merely edge-trigger `[REQ-HAZARD-CONTROL-STAMP-CONVERGENCE]`: ### 7.30 A Psyche failure of ANY shape must NEVER remove or alter the parent endpoint's ready/hosted state `[REQ-HAZARD-PSYCHE-RESIDENCY-EXPECTATION]` - **Fai", "b_doc_snippet": "7.48 At most one input-capable controller lease per PTY session — takeover revokes atomically and loudly, input is fenced to the active lease, node identity is never a lease `[REQ-HAZARD-CONTROLLER-LEASE]`: ### 7.49 A teardown verb never stamps a terminal or resting state it has not caused — and two" }, { "num": 12, "a": "REQ-HAZARD-RESUME-CUSTODY-ABA", "b": "REQ-RESUME-ADAPTER-FOLLOWS-SESSION", "a_title": "KNOWN-HAZARDS 7.51: process custody is an identity, never a bare PID — a recycled pid must read NOT OURS. The hazard-conformance twin of REQ-RESUME-CU", "b_title": "D-2 (REMOTE-TRUTH triage §D-2 + operator Q5 @c248afc): a resume-from-history restores the RECORDED session adapter (REQ-SESSION-ADAPTER-RECORDED) — th", "a_doc_snippet": "7.51 Process custody is an identity, never a bare PID — a recycled pid must read NOT OURS `[REQ-HAZARD-RESUME-CUSTODY-ABA]`: - **Failure (paid-for, hertz v0.39.4 field RCA 2026-07-22, doyle code-verified same day):** `resume.pid` custody is a bare PID consumed as `read_resume_pid(..).is_som", "b_doc_snippet": "" }, { "num": 13, "a": "REQ-ARCH-1", "b": "REQ-ARCH-2", "a_title": "Many small acyclically-layered crates", "b_title": "Public SDK surface is spt-proto, spt-runtime, spt-msg", "a_doc_snippet": "", "b_doc_snippet": "" }, { "num": 14, "a": "REQ-DOCS-4", "b": "REQ-DOCS-NO-INTERNAL-CODES", "a_title": "Agent-consumable layer (llms.txt, manifest schema, MCP, CLI help)", "b_title": "Public CLI --help (the clap `///` doc-comments) and the generated `docs-site/src/cli/reference.md` MUST NOT contain internal tracker/decision codes — ", "a_doc_snippet": "Agent-consumable docs (spt-core specifics): ", "b_doc_snippet": "CI commitments: **Public help carries no internal codes.** The public CLI `--help` (the clap `///` doc-comments) and the generated `docs-site/src/cli/reference.md` MUST NOT contain internal tracker/decision codes — `REQ-*`, `F-###`, `M#-W#`, `ADR-####`. They are meaningless to an end user r" }, { "num": 15, "a": "REQ-HAZARD-SHAREDSEND-NO-BLOCKING-WRITE-UNDER-LOCK", "b": "REQ-PEER-PUMP-CHURN-STALL", "a_title": "UPDATE-WEDGE round-4 (hertz RCA, root reproduced + source-pinned on Windows 2026-07-09): EVERY write on a physical broker connection rides ONE bounded", "b_title": "B5 (F028, perri F-a; DEFECT daemon, OBSERVED-ONCE, HIGH): the peer pump STALLS under rapid rc attach/EOF-detach/--take churn. Fresh 0.22.0 daemon ~10m", "a_doc_snippet": "7.37 The Layer-1 settle-gate must RE-ARM per delivery on an observable PTY — a mid-session reader reattach (`/clear`) re-creates the head-swallow race `[REQ-HAZARD-INJECT-SETTLE-REARM]`: ### 7.38 EVERY write on a physical broker connection is bounded + cancelable + poison-on-failure — no writer hold", "b_doc_snippet": "" }, { "num": 16, "a": "REQ-INST-13", "b": "REQ-RUN-PICKER-HOME", "a_title": "Subnet-exclusive sync + per-endpoint subnet-membership list", "b_title": "Home-subnet selection LAYER in the `spt endpoint run` ratatui Create-new picker (v0.14.1; the deferred half of REQ-RUN-MULTISUBNET-HOME's interactive ", "a_doc_snippet": "", "b_doc_snippet": "Shell sleep/wake (offline ↔ online): **spt-hosted bringup picker (`spt endpoint run`)** (M12-W2): The user-facing bringup flow for spt-hosted endpoints. **Bare `spt endpoint run`** (no `--adapter`/`--id`) opens an in-process **ratatui picker**; the **flagged** form is the non-interactive br" }, { "num": 17, "a": "REQ-RESUME-UNBOUND-STAMP", "b": "REQ-SELF-ID-TRUST-INJECTED-ENV", "a_title": "RC-RENDER-TRUTH W1 (ADR-0042 decision 2, operator-spotted second root seam): resume launch transitions an existing offline perch to UNBOUND before/wit", "b_title": "DEFERRED to a followup vX.X.n sprint (post-LIFECYCLE-TRUTH, operator-ruled 2026-07-07): self-identity resolution must trust the harness-injected autho", "a_doc_snippet": "Decisions: 1. **`spt rc` consults the honest-session authority before the offline fast-fail.** Normal `spt rc ` runs the same bounded `SessionProbe::has_live_session_honest` gate `endpoint run` uses (ADR-0041 single liveness authority). An honest session exists → attach via the session-", "b_doc_snippet": "" }, { "num": 18, "a": "REQ-EP-3", "b": "REQ-PSYCHE-STAMP-CLEAR-ANY-SUCCESS", "a_title": "Messaging payloads carry typed operation commands + file blobs", "b_title": "W1 (LIFECYCLE-TRUTH): EVERY successful psyche operation clears psyche_host_error — not just the pulse-loop leg. ROOT (three field confirmations, perri", "a_doc_snippet": "", "b_doc_snippet": "" }, { "num": 19, "a": "REQ-ENDPOINT-MESSAGE-ONLY-DISPLAY", "b": "REQ-RUN-ID-REUSES-ADAPTER", "a_title": "An online agent-family endpoint with NO session surface reads as message-reachable, not as a harness-hosted live agent and not as a plain ONLINE. (her", "b_title": "D-1 (REMOTE-TRUTH triage §D-1): `spt endpoint run --id ` with NO --adapter, when names an EXISTING perch, REUSES that perch's recorded info.a", "a_doc_snippet": "", "b_doc_snippet": "" }, { "num": 20, "a": "REQ-HAZARD-CONTROLLER-GAP-RESUME", "b": "REQ-LIVE-AGENT-NO-INJECT-DELIVERY", "a_title": "A serving CONTROLLER whose serve-brain hits a b4 drop-don't-block FORWARD output gap must RESUME-FROM-FLOOR (re-subscribe from delivered_through and r", "b_title": "F-033 RE-SCOPED (doyle re-ruling 2026-07-10 after the #82 gate falsified the original premise — the hosting-mode class split is BINDING context): 'sta", "a_doc_snippet": "", "b_doc_snippet": "" } ]