[ { "pair": 1, "a_id": "REQ-ACL-ACCESS-REFRESH-ER-ONLY", "b_id": "REQ-SEC-1", "a_title": "spt api access-refresh stops refusing and becomes real, gated to the engine room, updating ONLY the node's captured subnet-level fallbacks (ADR-0052 d", "b_title": "Per-endpoint access whitelist: origin-node gate, stateful-firewall (reply/outbound exempt), node-now/user-later, outer gate before grants", "a_doc": "A node's **effective** subnet modes are captured at its join and are immutable from outside. Mode changes replicate as advisory metadata: they surface as a notif, and the engine-room is briefed at ses", "b_doc": "" }, { "pair": 2, "a_id": "REQ-ACL-NODE-MODE-SET", "b_id": "REQ-ACL-NODE-VIEW", "a_title": "The node's control-surface modes are settable through the engine room and nowhere else (ADR-0052 decisions 1 and 3, CONTEXT.md 'control-surface modes'", "b_title": "`spt daemon access` is the node-tier roster: the entities the node-scope rules name (node and subnet-wildcard subjects \u2014 a node-scope sender-endpoint ", "a_doc": "A locked-down **agent endpoint** (harness-adapter-backed, spt-hosted, has a mind \u2014 it can be briefed on and reason about the node's access posture). It is the designated way to set the **node's** cont", "b_doc": "access entity** (ratified 2026-07-30, fast-follow grill): Anything that can be granted (or denied) control via access rules \u2014 a **subnet**, **node**, or **endpoint**. A **ruled access entity**, relati" }, { "pair": 3, "a_id": "REQ-ACL-SURFACE-VOCAB", "b_id": "REQ-ACL-VIEW-ROSTER", "a_title": "Access control is granular at the CONTROL SURFACE, not at the endpoint. A rule is (target endpoint x surface x subject) -> allow/deny, where a surface", "b_title": "Access views are roster-first (CONTEXT.md 'access entity', FF grill 2026-07-30): `spt endpoint access []` lists each ruled target's access e", "a_doc": "control surface** (ratified 2026-07-28, access-control grill): The unit of access-control granularity: a named remote-reachable operation class on an endpoint. **Open string vocabulary, CONSTANT_CASE ", "b_doc": "access entity** (ratified 2026-07-30, fast-follow grill): Anything that can be granted (or denied) control via access rules \u2014 a **subnet**, **node**, or **endpoint**. A **ruled access entity**, relati" }, { "pair": 4, "a_id": "REQ-MANIFEST-2", "b_id": "REQ-REACH-2", "a_title": "Adapter profiles \u2014 sparse leaf-replace overlays (shipped + local), composite : addressing, shadow-refusal, tighten-only consent floo", "b_title": "Remote command execution (deferred, consent-gated)", "a_doc": "adapter profile** (ratified 2026-06-11, Gateway grill; future spt-core milestone \u2014 first beneficiaries `spt-claude-code` and the usbip shell): A named **sparse overlay** on its parent adapter manifest", "b_doc": "" }, { "pair": 5, "a_id": "REQ-ADAPTER-FLOOR-ENFORCE", "b_id": "REQ-DIGEST-FETCHER-STRATEGY", "a_title": "F-5 (REMOTE-TRUTH triage \u00a7F-5 + doyle rulings 2026-07-05): BOTH adapter acquisition verbs (spt adapter add + spt adapter update) REFUSE when the insta", "b_title": "Bug #17 (W6b, closes eel-a end-to-end): [digest] gains a `fetcher` strategy mirroring [history]'s locate/normalize split (CONTEXT \u00a7history: [digest] m", "a_doc": "`min_spt_core_version` is the **enforced** compatibility floor. Both acquisition verbs \u2014 `spt adapter add` and `spt adapter update` \u2014 REFUSE when the installed spt-core is below this version, naming t", "b_doc": "`[digest]` supports the same two locate strategies as `[history]` \u2014 pick with `strategy`: / `[digest]` \u2014 session-digest extractor (ADR-0019) The session digest's own seam \u2014 **distinct from `[history]`" }, { "pair": 6, "a_id": "REQ-ADAPTER-PROOF-DIR-OVERRIDE", "b_id": "REQ-DOC-ENDPOINT-DROP-RESOLUTION", "a_title": "The author-time proof commands (`spt adapter digest-proof`, `spt adapter translate-proof`) gain a `--dir ` / `--manifest ` override so an ", "b_title": "D1 (F028, perri F-c; docs/truth): SI-1's resolution rule \u2014 a RELATIVE watched drop dir resolves against the ENDPOINT's cwd, never the daemon's (KH 7.2", "a_doc": "Proof a DEV build off disk \u2014 `--dir` / `--manifest`.** Both `digest-proof` and `translate-proof` accept `--dir ` (binaries resolve there, just like a registered install) or `--manifest ] (JSON) lets an endpoint learn its ATTACHED (controlling) node \u2014 claude-spt surfaces local + attached node names on Us", "b_title": "DEFERRED (post-LIFECYCLE-TRUTH, operator-ruled 2026-07-07 \u2014 mint now, impl a FUTURE milestone): make the update swap LOSSLESS for live hosted endpoint", "a_doc": "", "b_doc": "" }, { "pair": 10, "a_id": "REQ-DOC-ECHO-COMMUNE-CONTRACT", "b_id": "REQ-MANIFEST-8", "a_title": "W6 (LIFECYCLE-TRUTH, docs \u2014 this gap cost a full outage night, priority slot): publish the [session.echo_commune] I/O contract on the docs-site: key c", "b_title": "[adapter] host_binaries declares the harness executable basenames a kind=\"harness\" adapter hosts agents inside (e.g. host_binaries = [\"claude\"]); bind", "a_doc": "the full echo-commune I/O contract: the role + fields, the key catalog spt-core fills, the no-history-on-stdin rule, read-env self-locate, the single-writer/per-endpoint-resolver/ingest-deletes drop-f", "b_doc": "Bind-time adapter/profile resolution (ADR-0021).** Because the seed is adapter-agnostic, `listen`/`poll` resolve the owning adapter/profile when they bind, as a pure read \u2014 never a seed-time snapshot " }, { "pair": 11, "a_id": "REQ-EP-7", "b_id": "REQ-HAZARD-COMMUNE-INGEST-BLACKHOLE", "a_title": "Durable live-role.md: a per-agent broad-purpose statement in tracked/agents// beside live-context.md (replicates with the mind on the same a- ", "b_title": "F-032 (perri field finding 2026-07-08, LEGACY-SPT-PARITY-GAP, data-loss): commune/signoff ingest MUST NOT delete a drop until its content is DURABLY C", "a_doc": "live role** (`live-role.md`, ratified 2026-06-12 \u2014 core milestone A): A durable statement of an agent's **broad purpose** \u2014 rarely modified, and only at deliberate user instruction. Lives in `tracked/", "b_doc": "7.40 A commune/signoff drop is deleted ONLY after every applicable tier is durably committed \u2014 an un-committable slice preserves the drop, never delete-then-lose `[REQ-HAZARD-COMMUNE-INGEST-BLACKHOLE]" }, { "pair": 12, "a_id": "REQ-HAZARD-BROKER-SEED-WIRE-SKEW", "b_id": "REQ-HAZARD-COMMUNE-INGEST-BLACKHOLE", "a_title": "A daemon-state wire-format change (e.g. the v0.9.0 adapter-agnostic Seed) does NOT take effect until a DELIBERATE full broker restart: the broker serv", "b_title": "F-032 (perri field finding 2026-07-08, LEGACY-SPT-PARITY-GAP, data-loss): commune/signoff ingest MUST NOT delete a drop until its content is DURABLY C", "a_doc": "7.9 A daemon-state wire change needs a deliberate BROKER restart (the broker is resident across a brain self-update) `[REQ-HAZARD-BROKER-SEED-WIRE-SKEW]` Failure:** the broker serves the seed-control ", "b_doc": "7.40 A commune/signoff drop is deleted ONLY after every applicable tier is durably committed \u2014 an un-committable slice preserves the drop, never delete-then-lose `[REQ-HAZARD-COMMUNE-INGEST-BLACKHOLE]" }, { "pair": 13, "a_id": "REQ-HAZARD-ECHO-BEFORE-SIGNOFF", "b_id": "REQ-MANIFEST-8", "a_title": "Echo-commune fires before INIT_SIGNOFF on orphan teardown (3.3)", "b_title": "[adapter] host_binaries declares the harness executable basenames a kind=\"harness\" adapter hosts agents inside (e.g. host_binaries = [\"claude\"]); bind", "a_doc": "", "b_doc": "Bind-time adapter/profile resolution (ADR-0021).** Because the seed is adapter-agnostic, `listen`/`poll` resolve the owning adapter/profile when they bind, as a pure read \u2014 never a seed-time snapshot " }, { "pair": 14, "a_id": "REQ-INST-1", "b_id": "REQ-UPDATE-FINISH-COMMUNE-FLUSH", "a_title": "endpoint ID vs instance split (adapter-agnostic ID)", "b_title": "DEFERRED (post-LIFECYCLE-TRUTH, operator-ruled 2026-07-07 \u2014 mint now, impl a FUTURE milestone): make the update swap LOSSLESS for live hosted endpoint", "a_doc": "", "b_doc": "" }, { "pair": 15, "a_id": "REQ-MANIFEST-NODE-KEY", "b_id": "REQ-PSYCHE-ROLE-OPTIONAL-SKIP", "a_title": "A new session-scoped manifest fill key `{node}` resolves to THIS node's advertised label \u2014 available wherever the session-scoped keys ({id}/{session_i", "b_title": "W1 (LIFECYCLE-TRUTH): a manifest with NO [session.echo_commune] role SKIPS commune-sync (debug-level note, no strike) instead of hard-failing the turn", "a_doc": "```toml [session.self] {node} fills as one argv token \u2014 the node's advertised label (its hostname). command = \"claude --session-id {session_id} --remote-control {id}--{node}\" keys = [\"session_id\", \"id", "b_doc": "" }, { "pair": 16, "a_id": "REQ-RESUME-ADAPTER-FOLLOWS-SESSION", "b_id": "REQ-TERM-5", "a_title": "D-2 (REMOTE-TRUTH triage \u00a7D-2 + operator Q5 @c248afc): a resume-from-history restores the RECORDED session adapter (REQ-SESSION-ADAPTER-RECORDED) \u2014 th", "b_title": "Adapter-declared digest extractor seam: a `[digest]` manifest section declaring an imperative extractor (native harness log -> the {role,text,tool,ts}", "a_doc": "", "b_doc": "The session digest is a PROJECTION of the endpoint's session logs, never a PTY-byte parse (the superseded source mechanism). ADR-0019 gives it its OWN manifest seam \u2014 the `[digest]` extractor above \u2014 " }, { "pair": 17, "a_id": "REQ-TERM-5", "b_id": "REQ-WORKER-MINTED-NAME", "a_title": "Adapter-declared digest extractor seam: a `[digest]` manifest section declaring an imperative extractor (native harness log -> the {role,text,tool,ts}", "b_title": "N-1 (WORKER-TRUTH triage, operator rider): worker perch identity is CORE-MINTED and parent-derived \u2014 `{parent}-w{N}` with a per-parent counter at regi", "a_doc": "The session digest is a PROJECTION of the endpoint's session logs, never a PTY-byte parse (the superseded source mechanism). ADR-0019 gives it its OWN manifest seam \u2014 the `[digest]` extractor above \u2014 ", "b_doc": "`api worker-start [--agent-id ] [--agent-type ]`" }, { "pair": 18, "a_id": "REQ-HAZARD-REDISPATCH-CONTROL-STEAL", "b_id": "REQ-WAKE-WAIT", "a_title": "REDISPATCH-TRUTH W1 (KNOWN-HAZARDS 7.41, hertz field RCA 2026-07-16 \u2014 4/5 endpoints frozen per brain cycle): a fresh dispatcher must NEVER re-serve a ", "b_title": "A-2 rider (REMOTE-TRUTH triage \u00a7A-2): `spt endpoint wake --wait` blocks on the REAL bind (status reaches online) after the daemon wake-resume lift (RE", "a_doc": "7.41 A fresh dispatcher must NEVER re-serve a terminal stream \u2014 historical replay must not steal or clear a live controller `[REQ-HAZARD-REDISPATCH-CONTROL-STEAL]` Failure (paid-for, hertz field RCA 2", "b_doc": "" }, { "pair": 19, "a_id": "REQ-CLI-1", "b_id": "REQ-HAZARD-CONPTY-DSR", "a_title": "spt endpoint noun namespace: absorbs fork/suspend/wake/shutdown/rename/stop/digest + access (ported 1:1: allow|revoke|open|list, decision 21) + descri", "b_title": "ConPTY reader must auto-answer DSR (ESC[6n) or all child output stalls (5.5)", "a_doc": "", "b_doc": "" }, { "pair": 20, "a_id": "REQ-CLI-3", "b_id": "REQ-WHOAMI-EXPLICIT-SID-REFUSAL", "a_title": "Agent hot path stays flat across the M8 reorg: send/ring/ready/whoami/how-to unchanged; notify moves to subnet notify while notif stays top-level; bre", "b_title": "RULED DESIGN, delivery unowned (doyle 2026-07-26): when a caller hands identity resolution an EXPLICIT non-empty $OWL_SESSION_ID that resolves to NO p", "a_doc": "", "b_doc": "" }, { "pair": 21, "a_id": "REQ-CLI-HELP-MARKDOWN", "b_id": "REQ-MSG-SELF-DETECT-ANCESTRY", "a_title": "`spt --help` (and every subcommand --help) renders the inline Markdown authored in the clap doc-comments as terminal styling, never as literal markers", "b_title": "#9 (F026, operator field bug): a perch-owned `spt send` from an endpoint's OWN session must self-identify, not mis-stamp `cli@` (whose replies b", "a_doc": "", "b_doc": "" }, { "pair": 22, "a_id": "REQ-CLI-WIN-VT-ENABLE", "b_id": "REQ-MSG-2", "a_title": "A7 (F028, operator, Win10 conhost): ANSI emitted without VT enable \u2192 garbled console. Evidence (raw PowerShell 7, Win10 conhost): literal `\u2190[36m` in `", "b_title": "spt binary CLI surface: send/ring/ready(+--once)/list/stop/whoami, stable arg shapes + exit codes", "a_doc": "", "b_doc": "" }, { "pair": 23, "a_id": "REQ-DIGEST-JSON-SELF-CONTAINED", "b_id": "REQ-RESIDENT-SERVICE", "a_title": "TEARDOWN-AUTHORITY W4 (perri adapter-surface finding 2026-07-19, doyle-grounded and RE-SCOPED; title AMENDED at gate 2026-07-19 \u2014 the original welded ", "b_title": "ResidentService substrate (ADR-0049, design ratified 2026-07-26): a daemon-supervised binary an adapter declares via a `[service]` manifest section \u2014 ", "a_doc": "the self-contained --json contract: top-level integer version cursor, stderr-clean under --json, the complete entry-kind enum with per-kind agent-produced vs spt-injected provenance, and the seq/curso", "b_doc": "`command`** \u2014 an **opaque** command string (program token plus args), like every other command seam. Its program token resolves against the adapter install dir** before PATH (REQ-INSTALL-11), and args" }, { "pair": 24, "a_id": "REQ-ENDPOINT-LIST-NODE-IDENT", "b_id": "REQ-HAZARD-CONPTY-DSR", "a_title": "Bug #5: spt endpoint list local section header is the hardcoded literal LOCAL (this node) (render_local_section cli.rs:4359). Change to 'This node: shell, REST-only, never-spooled, latest-wins): the owner->shell mirror of sensory for continuous real-time control (scroll/crank", "a_doc": "", "b_doc": "" }, { "pair": 27, "a_id": "REQ-REST-VERB-ROUTING", "b_id": "REQ-SHELL-LIST-DERIVED-PROVENANCE", "a_title": "A-3 (REMOTE-TRUTH triage \u00a7A + Q3 operator-law): a BARE-id rest verb (spt wake/suspend ) routes across the subnet like send's fallback instead of f", "b_title": "SEED (inactive \u2014 observability, perri-backed 2026-07-26): a status a reader can act on should be distinguishable from a status a record actually holds", "a_doc": "", "b_doc": "" }, { "pair": 28, "a_id": "REQ-CONTROLLER-LEASE-IDENTITY", "b_id": "REQ-HAZARD-VIEWER-STARVE-UNDER-CONTROLLER-BACKPRESSURE", "a_title": "RC-RENDER-TRUTH W2 (ADR-0044 decisions 1+2, hertz same-machine --take split-brain RCA P0-A/B, doyle seam-verified broker.rs resolve_subscribe 1296-131", "b_title": "A SLOW controller must not starve a concurrent `rc --view` VIEWER. W1 (REQ-HAZARD-INJECT-CONTROL-COEXIST) moved the controller SOCKET WRITE off the dr", "a_doc": "1. **Distinct viewport/lease identity.** Each rc invocation/attach stream mints a unique controller lease id, carried through SubscribeReq, the controller slot, and Input/Resize. Node identity is kept", "b_doc": "" }, { "pair": 29, "a_id": "REQ-HAZARD-INJECT-CONTROL-COEXIST", "b_id": "REQ-HAZARD-REDISPATCH-CONTROL-STEAL", "a_title": "SPINE INVARIANT (v0.13.0 keystone): the broker must accept INJECTED keystrokes into an spt-hosted PTY (the v0.11.0 raw direct-inject today; the ADR-00", "b_title": "REDISPATCH-TRUTH W1 (KNOWN-HAZARDS 7.41, hertz field RCA 2026-07-16 \u2014 4/5 endpoints frozen per brain cycle): a fresh dispatcher must NEVER re-serve a ", "a_doc": "", "b_doc": "7.41 A fresh dispatcher must NEVER re-serve a terminal stream \u2014 historical replay must not steal or clear a live controller `[REQ-HAZARD-REDISPATCH-CONTROL-STEAL]` Failure (paid-for, hertz field RCA 2" }, { "pair": 30, "a_id": "REQ-DAEMON-4", "b_id": "REQ-HAZARD-RESTART-IDEMPOTENT", "a_title": "Honor every KNOWN-HAZARDS invariant", "b_title": "Idempotent/exactly-once delivery across brain restart at every broker boundary (codex #14)", "a_doc": "", "b_doc": "" }, { "pair": 31, "a_id": "REQ-ENDPOINT-TEARDOWN-AUTHORITY", "b_id": "REQ-HAZARD-TRANSLATE-FAULT-PERMANENT-DEATH", "a_title": "TEARDOWN-AUTHORITY W1 (ADR-0045; two hertz field RCAs 2026-07-19, doyle code-verified + ruled): ONE shared topology-aware broker-teardown primitive be", "b_title": "C-1 hazard (F029; paid-for: B6 + three-version checkpoint-wake breakage): a REAL translation fault (binary death \u2014 stdin write fail / stdout disconnec", "a_doc": "7.49 A teardown verb never stamps a terminal or resting state it has not caused \u2014 and two individually-correct verbs must not compose into a lifecycle dead end `[REQ-HAZARD-TEARDOWN-DEADEND]` Failure ", "b_doc": "" }, { "pair": 32, "a_id": "REQ-DISPATCH-FALLBACK-CIRCUIT", "b_id": "REQ-STREAMLOG-SUBSCRIBER-DISCIPLINE", "a_title": "REDISPATCH-STALL W1 (ADR-0038 Amendment, fixes 1+5): the opener ring-peek fallback fires ONLY on the explicit UnsupportedVerb/old-broker answer \u2014 tran", "b_title": "REDISPATCH-STALL W1 (ADR-0038 Amendment, fixes 2+3+4): StreamLog subscriber write discipline \u2014 (a) replay and live fan-out HALT at the first failed su", "a_doc": "Amendment \u2014 REDISPATCH-STALL (2026-07-16)", "b_doc": "Amendment \u2014 REDISPATCH-STALL (2026-07-16)" }, { "pair": 33, "a_id": "REQ-DOCS-1", "b_id": "REQ-DOCS-3", "a_title": "Dual-audience docs (human + AI dev-agent), markdown once / two depths", "b_title": "Di\u00e1taxis structure; one canonical way to do X", "a_doc": "the dual-audience contract surfaced to the second audience: agent exports, .md negotiation, schema, CLI-help-as-docs For AI agents reading this", "b_doc": "Di\u00e1taxis four-mode separation + one-canonical-way, stated as the corpus's contract How these docs are organized" }, { "pair": 34, "a_id": "REQ-DOCS-5", "b_id": "REQ-RUN-ID-REUSES-ADAPTER", "a_title": "Anti-drift: rustdoc/schema/exports/CLI-help generated + CI-checked", "b_title": "D-1 (REMOTE-TRUTH triage \u00a7D-1): `spt endpoint run --id ` with NO --adapter, when names an EXISTING perch, REUSES that perch's recorded info.a", "a_doc": "", "b_doc": "" }, { "pair": 35, "a_id": "REQ-HAZARD-DEFERRED-MANIFEST", "b_id": "REQ-SPAWN-FRESH-TRUTHFUL", "a_title": "A pointer-mode (delegated / GhReleaseManaged) adapter whose binary/manifest is not yet extracted is reported with a CLEAR diagnostic, never silently d", "b_title": "REGISTRY-LIFECYCLE W3 (ADR-0041 decision 5, spawn-fresh): endpoint create is TRUTHFUL at the broker, atomically \u2014 spawn policies split Fresh/RejectExi", "a_doc": "", "b_doc": "1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual persisted state + hosting authority \u2014 never from manifest capability alone. Legacy hybrid rows self-heal at " }, { "pair": 36, "a_id": "REQ-CONN-POISON-ATTRIBUTION", "b_id": "REQ-EP-8", "a_title": "MSG-IDENTITY W6 / F-039 legs b-d (doyle W6 LOCK 2026-07-10, minted per amendment 3): every broker-conn lifecycle record is ATTRIBUTABLE \u2014 the W6 RCA's", "b_title": "AlwaysOnEndpoint: a resident, addressable, mindless endpoint whose adapter binary the daemon supervises continuously \u2014 register-triggered by an adapte", "a_doc": "", "b_doc": "Status: accepted (2026-06-21)" }, { "pair": 37, "a_id": "REQ-DAEMON-5", "b_id": "REQ-SUBNET-DISPLAY-PARITY", "a_title": "Pump liveness: the peer pump writes a last-tick heartbeat consumed by daemon status / subnet status (decision 23 render legs in REQ-CLI-2/REQ-SUBNET-8", "b_title": "The `spt endpoint run` picker renders endpoint state IDENTICALLY for local and remote (subnet) rows \u2014 bound/unbound, controlled (+driver node), and ha", "a_doc": "", "b_doc": "" }, { "pair": 38, "a_id": "REQ-DAEMON-BITS-AMBIGUITY", "b_id": "REQ-LIST-JSON-LIVENESS-PARITY", "a_title": "SEED (inactive, RCA-first \u2014 do NOT close on agreement): nothing on a node surfaces WHICH BITS ARE SERVING, and the same silent wrong-state shape bit t", "b_title": "GATEWAY-LIVENESS (flynn field bug 2026-07-09, RCA reader-divergence root): `spt endpoint list` (human) and `endpoint list --json` MUST report an IDENT", "a_doc": "", "b_doc": "" }, { "pair": 39, "a_id": "REQ-ENDPOINT-AUTOSTART", "b_id": "REQ-EP-4", "a_title": "MSG-IDENTITY W5 / F-038 (flynn operator-directed ask 2026-07-10, SPT-CORE-NEEDS #7 + deployah field-confirm same day: mobile-gw alive=false after the ", "b_title": "PresenceChannel broker endpoint (seam day-one)", "a_doc": "Infrastructure endpoints (a gateway the phone treats as always-there) should not need hands-on bringup after a box reboot or daemon restart. `spt endpoint run \u2026 --save` persists the run \u2014 endpoint id,", "b_doc": "" }, { "pair": 40, "a_id": "REQ-ENDPOINT-CYCLE-HONEST", "b_id": "REQ-SUBNET-COUNT-ROUTABLE", "a_title": "REGISTRY-LIFECYCLE W3 (ADR-0041 decision 6, operator deployah stop/run wedge): cycle verbs share ONE liveness authority \u2014 the ALREADY_LIVE dup-guard l", "b_title": "Bug #2: a remote node endpoint count drifts (0/2, 1/3) because node_status_rows (cli.rs:5314) increments the per-node total unconditionally, counting ", "a_doc": "1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual persisted state + hosting authority \u2014 never from manifest capability alone. Legacy hybrid rows self-heal at ", "b_doc": "" }, { "pair": 41, "a_id": "REQ-ENDPOINT-LIST-RENDER-POLISH", "b_id": "REQ-PSYCHE-LEGACY-RESIDENT-SWEEP", "a_title": "A6 (F028, operator, 4 asks): `spt endpoint list` render polish. (a) the 'Shared subnets' line is NOT dim \u2014 LIGHT_GRAY = \"37\" (cli.rs:3019) is standard", "b_title": "W5 (F030; doyle+perri 2026-07-04): a dirty daemon upgrade from <=v0.24.0 strands a RESIDENT psyche wrapper the OLD daemon spawned \u2014 and F-030 W4's nes", "a_doc": "", "b_doc": "" }, { "pair": 42, "a_id": "REQ-ENDPOINT-MESSAGE-ONLY-DISPLAY", "b_id": "REQ-PICKER-NODE-GROUPING", "a_title": "An online agent-family endpoint with NO session surface reads as message-reachable, not as a harness-hosted live agent and not as a plain ONLINE. (her", "b_title": "Bug #13: the endpoint run Subnet tab shows a machine once PER shared subnet (subnet_rows data.rs:253 iterates per-subnet, groups by subnet:node, no cr", "a_doc": "", "b_doc": "" }, { "pair": 43, "a_id": "REQ-ENDPOINT-STOP-OFFLINE", "b_id": "REQ-LISTEN-PRESERVES-HOSTING-TOPOLOGY", "a_title": "H3: `spt endpoint stop ` marks the endpoint OFFLINE (alive=false), not merely de-readied. cmd_stop (cli.rs:2994-3010) removes the ready marker + u", "b_title": "`api listen` must not ASSERT hosting topology it does not know. (hertz v0.39.0 field RCA 2026-07-21, doyle re-grounded at source.) OBSERVED: the publi", "a_doc": "", "b_doc": "" }, { "pair": 44, "a_id": "REQ-EP-4", "b_id": "REQ-LIST-JSON-LIVENESS-PARITY", "a_title": "PresenceChannel broker endpoint (seam day-one)", "b_title": "GATEWAY-LIVENESS (flynn field bug 2026-07-09, RCA reader-divergence root): `spt endpoint list` (human) and `endpoint list --json` MUST report an IDENT", "a_doc": "", "b_doc": "" }, { "pair": 45, "a_id": "REQ-HAZARD-ATTACH-WEDGE", "b_id": "REQ-MSG-INJECT-LEG-DROP-VISIBLE", "a_title": "A legitimately dead PTY child (real crash/kill) + an undrained operator pump must NOT wedge the broker for all other clients. ROOT (v0.12.0 real-harne", "b_title": "SEED (inactive \u2014 observability): a silently-dropped delivery leg must be DISTINGUISHABLE from an honestly-offline endpoint on a status surface. The sp", "a_doc": "", "b_doc": "" }, { "pair": 46, "a_id": "REQ-HAZARD-BOUNDARY-READY-STRAND", "b_id": "REQ-PSYCHE-LEGACY-RESIDENT-SWEEP", "a_title": "C-2 (F029, SEAM-2 pinned \u2014 B6's SECOND HALF, the live-wake blocker; perri wakep9 vs wakep4 gate-state dump + doyle code trace): at a /clear, CC fires ", "b_title": "W5 (F030; doyle+perri 2026-07-04): a dirty daemon upgrade from <=v0.24.0 strands a RESIDENT psyche wrapper the OLD daemon spawned \u2014 and F-030 W4's nes", "a_doc": "", "b_doc": "" }, { "pair": 47, "a_id": "REQ-HAZARD-CORRUPT-PERCH-COHERENCE", "b_id": "REQ-SUBNET-COUNT-ROUTABLE", "a_title": "Corrupt (present-but-unparseable) info.json is NOT absent: liveness/status readers agree a destroyed record is neither alive nor Active (counter-39 #2", "b_title": "Bug #2: a remote node endpoint count drifts (0/2, 1/3) because node_status_rows (cli.rs:5314) increments the per-node total unconditionally, counting ", "a_doc": "5.14 Corrupt info.json read as ABSENT \u2192 fail-open readers gossip a wiped perch ONLINE `[REQ-HAZARD-CORRUPT-PERCH-COHERENCE]` Failure:** three readers each collapsed a **corrupt** (present-but-unparsea", "b_doc": "" }, { "pair": 48, "a_id": "REQ-HAZARD-DRIVEN-BY-SELFHEAL", "b_id": "REQ-INST-3", "a_title": "An spt-hosted endpoint's ONLINE+CONTROLLED state (`driven_by`) must CLEAR even when the detach IPC is lost \u2014 do NOT rely on the detach signal (same le", "b_title": "Dormant (warm) / suspended (cold) resting states", "a_doc": "", "b_doc": "Dormancy resource budget (D9-3 \u2014 ADR-0003 red-team #9)" }, { "pair": 49, "a_id": "REQ-HAZARD-HOSTED-LIVENESS-RECONCILE", "b_id": "REQ-SHELL-LIST-DERIVED-PROVENANCE", "a_title": "B2 KEYSTONE: a daemon-hosted (spt-hosted) endpoint's info.json status is RECONCILED to real liveness, not left latched online. The broker exit-waiter ", "b_title": "SEED (inactive \u2014 observability, perri-backed 2026-07-26): a status a reader can act on should be distinguishable from a status a record actually holds", "a_doc": "", "b_doc": "" }, { "pair": 50, "a_id": "REQ-HAZARD-SHELL-STALE-ONLINE", "b_id": "REQ-PRESENCE-LIVENESS-TRUTH", "a_title": "A shell instance's ONLINE-ness is DERIVED (recorded status AND its recorded `shell.pid` not provably dead), never the recorded `status` field alone \u2014 ", "b_title": "A node's gossiped per-endpoint registry Status reflects real liveness, so a remote viewer never paints a DEAD endpoint as ONLINE. ROOT (confirmed + ga", "a_doc": "| # | Invariant | spt-core surface | |---|---|---| | 1.1 | Grace wait precedes INIT_SIGNOFF | daemon teardown | | 1.4/4.4 | Deferred rows excluded from event-stream drain | daemon spool drain | | 2.1/", "b_doc": "" }, { "pair": 51, "a_id": "REQ-INST-4", "b_id": "REQ-PRESENCE-LIVENESS-TRUTH", "a_title": "active to dormant/suspended fires a transition echo commune", "b_title": "A node's gossiped per-endpoint registry Status reflects real liveness, so a remote viewer never paints a DEAD endpoint as ONLINE. ROOT (confirmed + ga", "a_doc": "", "b_doc": "" }, { "pair": 52, "a_id": "REQ-LISTEN-PRESERVES-HOSTING-TOPOLOGY", "b_id": "REQ-SHELL-LIST-DERIVED-PROVENANCE", "a_title": "`api listen` must not ASSERT hosting topology it does not know. (hertz v0.39.0 field RCA 2026-07-21, doyle re-grounded at source.) OBSERVED: the publi", "b_title": "SEED (inactive \u2014 observability, perri-backed 2026-07-26): a status a reader can act on should be distinguishable from a status a record actually holds", "a_doc": "", "b_doc": "" }, { "pair": 53, "a_id": "REQ-PICKER-CONTROL-LINE-STATUS-GATE", "b_id": "REQ-REST-TERMINAL-NORMALIZE", "a_title": "A2 (F028, operator #2): the picker confirm-panel 'controlled locally' line renders for OFFLINE endpoints. view.rs:425-436 builds control_line from ep.", "b_title": "REGISTRY-LIFECYCLE W2 (ADR-0041 decision 3, rest-normalize P0): definitive hosted-session loss normalizes TERMINALLY and ATOMICALLY \u2014 one store-level ", "a_doc": "", "b_doc": "1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual persisted state + hosting authority \u2014 never from manifest capability alone. Legacy hybrid rows self-heal at " }, { "pair": 54, "a_id": "REQ-PRESENCE-LIVENESS-TRUTH", "b_id": "REQ-TRANSLATE-COMMIT-MISS-TOLERANCE", "a_title": "A node's gossiped per-endpoint registry Status reflects real liveness, so a remote viewer never paints a DEAD endpoint as ONLINE. ROOT (confirmed + ga", "b_title": "C-1 (F029, B6 ROOT \u2014 rescope of REQ-TRANSLATE-BINARY-LIVENESS-DECAY, now PINNED): at a checkpoint clear boundary the clear-only inject drives `/clear`", "a_doc": "", "b_doc": "Amendment (2026-07-03, F029 C-1) \u2014 a commit-miss is NOT a fault; real faults respawn" }, { "pair": 55, "a_id": "REQ-RUN-PICKER", "b_id": "REQ-SUBNET-DISPLAY-PARITY", "a_title": "Interactive `spt endpoint run` picker (ratatui TUI): bare `spt endpoint run` (no --adapter/--id) enters an in-process picker (flags-present = the REQ-", "b_title": "The `spt endpoint run` picker renders endpoint state IDENTICALLY for local and remote (subnet) rows \u2014 bound/unbound, controlled (+driver node), and ha", "a_doc": "spt-hosted bringup picker (`spt endpoint run`)** (M12-W2): The user-facing bringup flow for spt-hosted endpoints. **Bare `spt endpoint run`** (no `--adapter`/`--id`) opens an in-process **ratatui pick", "b_doc": "" }, { "pair": 56, "a_id": "REQ-UPDATE-TRIAL-DRAIN-DRIVE", "b_id": "REQ-WAKE-RESUME-LEG", "a_title": "UPDATE-WEDGE (counter-54, doyle-ruled 2026-07-09 \u2014 regression of the v0.29.0 seamless brain-swap): a brain generation DRIVES the broker's controller-l", "b_title": "A-2 (REMOTE-TRUTH triage \u00a7A-2 + ADR-0033): the daemon reconcile gains a WAKE-RESUME LEG \u2014 an endpoint whose rest INTENT is Active but whose harness se", "a_doc": "brain-trial promotion (readiness + drained)** \u2014 the broker supervises the swapped-in brain through a bounded readiness **trial** and *promotes* the new binary only when it both signals ready for its o", "b_doc": "" }, { "pair": 57, "a_id": "REQ-ER-RESERVED-ENDPOINT", "b_id": "REQ-HAZARD-VIEWER-CLOSE-DETACH", "a_title": "A node has exactly ONE engine-room endpoint, and 'exactly one' is STRUCTURAL rather than policed: the engine room lives at a reserved per-node endpoin", "b_title": "A VIEW is independent from the endpoint: closing the tab/window where `spt endpoint run` was invoked must detach ONLY the `spt rc` attach pump \u2014 the d", "a_doc": "A locked-down **agent endpoint** (harness-adapter-backed, spt-hosted, has a mind \u2014 it can be briefed on and reason about the node's access posture). It is the designated way to set the **node's** cont", "b_doc": "A view is independent from the endpoint** (invariant): An spt-hosted endpoint runs in a **daemon-owned PTY, decoupled from whatever terminal launched it**. Closing the tab/window where `spt endpoint r" }, { "pair": 58, "a_id": "REQ-RUN-NO-DUP-SESSION", "b_id": "REQ-SEAM-SPAWN", "a_title": "B1 (F028, hall-b diagnosis, verified 0.22.0): `endpoint run --id X --create` on an endpoint with a LIVE session mints a silent DUPLICATE session \u2014 and", "b_title": "spawn-session seam", "a_doc": "", "b_doc": "" }, { "pair": 59, "a_id": "REQ-ENDPOINT-STOP-RESOLVES", "b_id": "REQ-ER-PURGE-RESETS", "a_title": "`spt endpoint stop ` REFUSES an id that nothing on the node knows, instead of stamping success on a no-op \u2014 an unconditional-success verb is a lyi", "b_title": "`endpoint purge` against the engine room RESETS it rather than deleting it, and requires OS elevation to do so (ADR-0052 decision 4). Reset-not-delete", "a_doc": "", "b_doc": "`endpoint purge` against an engine-room **requires OS elevation** and resets the endpoint instead of deleting it. The reset is the only way to change its home subnet or its harness adapter." }, { "pair": 60, "a_id": "REQ-HAZARD-RING-PERCH-ADOPTION", "b_id": "REQ-WORKER-REAP", "a_title": "A ring NEVER adopts \u2014 and therefore never deletes \u2014 a perch directory it did not create in THIS invocation (3.4). The twin of REQ-HAZARD-EPHEMERAL-CLE", "b_title": "W-3 (WORKER-TRUTH triage): worker records must not persist indefinitely past their useful life \u2014 6 dead-pid workers leaked OFFLINE on flynn (kill-path", "a_doc": "3.4 A `ring` never adopts \u2014 so never deletes \u2014 a perch it did not create Failure:** 3.1 guards the LEAK direction (cleanup on every exit path). It says nothing about *whose* perch is being cleaned, an", "b_doc": "" }, { "pair": 61, "a_id": "REQ-ACL-NODE-MODE-SET", "b_id": "REQ-ER-CEREMONY-VERB", "a_title": "The node's control-surface modes are settable through the engine room and nowhere else (ADR-0052 decisions 1 and 3, CONTEXT.md 'control-surface modes'", "b_title": "The engine-room ceremony is invocable: `spt endpoint engine-room --adapter ` runs the one create/reset code path (`provision_at`), report", "a_doc": "A locked-down **agent endpoint** (harness-adapter-backed, spt-hosted, has a mind \u2014 it can be briefed on and reason about the node's access posture). It is the designated way to set the **node's** cont", "b_doc": "Engine room: first-time setup / Ruled at the fast-follow grill 2026-07-30 (operator + doyle). The ceremony ships as **`spt endpoint engine-room --adapter `** \u2014 one verb, one code path (`p" }, { "pair": 62, "a_id": "REQ-ER-CONTROLLER-BOUND-POSTURE", "b_id": "REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE", "a_title": "The engine room is empowered ONLY while a controller is attached, and losing that controller drops its POSTURE \u2014 not its process (ADR-0052 decision 3,", "b_title": "W2 (LIFECYCLE-TRUTH, KNOWN-HAZARDS, flagship \u2014 the update wedge): PTY viewer fan-out and control mutations must not depend synchronously on a live dra", "a_doc": "Decision 3 was written in the language of the ceremony, and two of its clauses do not survive contact with the daemon's lifecycle invariants. Both are amended here rather than built literally.", "b_doc": "7.36 The broker control plane and PTY fan-out must NEVER block on a single subscriber connection \u2014 a suspended brain conn must not wedge control `[REQ-HAZARD-BROKER-VIEWER-BRAIN-DECOUPLE]` Failure (pa" }, { "pair": 63, "a_id": "REQ-ACTIVITY-LINK-PUSH", "b_id": "REQ-RUN-SHORTCUT", "a_title": "An owned Shell observes its owner's busy/idle transitions as an activity frame on the EXISTING shell-link event stream (ADR-0048 decisions 1-3; perri ", "b_title": "`-` launcher shortcut generation (picker `s` keybind, M12-W2-T2.4): from any pre-start options set the picker writes/updates a `` shortcut** (picker `s` keybind, M12-W2): From any pre-start options set, `s` writes (or updates) a **`-` launcher** at the project root that bakes the current selection's **no" }, { "pair": 64, "a_id": "REQ-ADAPTER-ADD-SURFACE-ERRORS", "b_id": "REQ-ADAPTER-UPDATE-MESSAGE", "a_title": "Bug #1: adapter add runs the install-as-first-update via conduct (cli.rs:6963) which on a non-zero exit prints only the exit code and DISCARDS the sub", "b_title": "An adapter manifest may declare `[update].message` \u2014 a plain (multi-line) human notice surfaced to stdout, markdown-rendered (the v0.13.0 helpfmt pros", "a_doc": "", "b_doc": "adapter packaging & live update** (v0.13.2; ADR-0024, ADR-0025): A `.spt` may be **multi-platform**: shared `manifest.toml` + `strings/` at the root, role binaries under per-target-triple subdirectori" }, { "pair": 65, "a_id": "REQ-ADAPTER-FLOOR-ENFORCE", "b_id": "REQ-UPDATE-FETCH-APPLY-FLAG", "a_title": "F-5 (REMOTE-TRUTH triage \u00a7F-5 + doyle rulings 2026-07-05): BOTH adapter acquisition verbs (spt adapter add + spt adapter update) REFUSE when the insta", "b_title": "`spt update fetch --apply` is the one-shot get-to-latest: fetch, then INSTALL the staged update REGARDLESS of whether the fetch itself staged anything", "a_doc": "`min_spt_core_version` is the **enforced** compatibility floor. Both acquisition verbs \u2014 `spt adapter add` and `spt adapter update` \u2014 REFUSE when the installed spt-core is below this version, naming t", "b_doc": "" }, { "pair": 66, "a_id": "REQ-ADAPTER-MULTIPLATFORM-SPT", "b_id": "REQ-PICKER-ADAPTER-DESCRIPTION", "a_title": "A `.spt` adapter archive may pack multiple platforms in one signed asset: shared `manifest.toml` + `strings/` at the root, role binaries under per-Rus", "b_title": "The Create-new adapter-CHOICE screen of `spt endpoint run`'s picker shows a right-hand Description panel (like the Pick-existing endpoint picker's two", "a_doc": "Multi-platform adapter `.spt` packaging", "b_doc": "" }, { "pair": 67, "a_id": "REQ-ADAPTER-UPDATE-MESSAGE", "b_id": "REQ-INSTALL-BOOTSTRAP-VERB", "a_title": "An adapter manifest may declare `[update].message` \u2014 a plain (multi-line) human notice surfaced to stdout, markdown-rendered (the v0.13.0 helpfmt pros", "b_title": "THE-FORKENING W1 (ADR-0036 \u00a73, bootstrap shape b operator-ruled): virgin-box install = `gh release download` the platform binary + ONE self-install ve", "a_doc": "adapter packaging & live update** (v0.13.2; ADR-0024, ADR-0025): A `.spt` may be **multi-platform**: shared `manifest.toml` + `strings/` at the root, role binaries under per-target-triple subdirectori", "b_doc": "Installer form (gh bootstrap, ADR-0036):** install gh \u2192 `gh auth login` (org membership) \u2192 `gh release download` the platform binary from the private channel \u2192 one **self-install verb** in the binary " }, { "pair": 68, "a_id": "REQ-CI-POSTJOB-DAEMON-REAP", "b_id": "REQ-MANIFEST-SUBST", "a_title": "A CI job REAPS ITS OWN test-spawned daemons at battery end, in-job, and logs a process census at job start AND job end so contamination and reap effec", "b_title": "Manifest substitution primitives for resolve-not-execute (ADR-0029, supersedes a rejected `spt api run-hook`): (1) two adapter-static substitution key", "a_doc": "", "b_doc": "Adapter-static keys \u2014 `{adapter_dir}` and `{adapter_name}` (since v0.16.0).** Two of the catalog keys are *adapter-static* \u2014 they depend only on the resolved adapter, never on a session or event, so t" }, { "pair": 69, "a_id": "REQ-DAEMON-9", "b_id": "REQ-RELEASE-MUSL-ARTIFACT", "a_title": "Net-bind boot-race resilience: a daemon that comes up net-less (NetHost::start failed \u2014 e.g. the systemd unit autostarted before the network/DNS stack", "b_title": "MUSL-TIER W3 (CI build + signed release + update-set publish + self-update E2E): release.yml gains a musl matrix entry (build on kitsubito; install mu", "a_doc": "", "b_doc": "" }, { "pair": 70, "a_id": "REQ-HAZARD-DEFERRED-MANIFEST", "b_id": "REQ-INST-1", "a_title": "A pointer-mode (delegated / GhReleaseManaged) adapter whose binary/manifest is not yet extracted is reported with a CLEAR diagnostic, never silently d", "b_title": "endpoint ID vs instance split (adapter-agnostic ID)", "a_doc": "", "b_doc": "" }, { "pair": 71, "a_id": "REQ-HAZARD-WMI-DAEMON-WINDOW", "b_id": "REQ-INSTALL-1", "a_title": "`spt daemon start` launches the daemon with NO visible console window. REGRESSION (v0.12.1 L1.5): the WMI job-neutral launch (spawn_daemon_via_wmi) se", "b_title": "Two install paths (harness-bootstrapped calls into standalone); OS-service registration deferred. HISTORY: originally 'signed one-line script' \u2014 the h", "a_doc": "", "b_doc": "the two-paths model + the one-line script half (v0.1 phasing below; OS-service leg = docs/DEFERRED.md) the marketplace-repackaging stance: relocatable binary + minimal, non-OS-entangled install logic " }, { "pair": 72, "a_id": "REQ-INST-10", "b_id": "REQ-RUN-SHORTCUT", "a_title": "Qualified addressing [subnet:]id[@node] + ambiguity forces qualification", "b_title": "`-` launcher shortcut generation (picker `s` keybind, M12-W2-T2.4): from any pre-start options set the picker writes/updates a `` shortcut** (picker `s` keybind, M12-W2): From any pre-start options set, `s` writes (or updates) a **`-` launcher** at the project root that bakes the current selection's **no" }, { "pair": 73, "a_id": "REQ-INST-13", "b_id": "REQ-INSTALL-9", "a_title": "Subnet-exclusive sync + per-endpoint subnet-membership list", "b_title": "Adapter add from a GitHub release archive: `spt adapter add --release [--tag ] [--asset ]` fetches a `.spt` tar asset over HTTP", "a_doc": "", "b_doc": "adapter registration (`spt adapter add`)**: How a node comes to *know* an adapter \u2014 harness or shell. An explicit **`spt adapter add `** (or **`--github `**) validates the manifest ag" }, { "pair": 74, "a_id": "REQ-INST-2", "b_id": "REQ-INSTALL-6", "a_title": "Per-node files, synced Psyche mind", "b_title": "Linux elevation install leg: install.sh symlinks the binary into a sudo-reachable path (/usr/local/bin; graceful print-the-one-liner when unelevated) ", "a_doc": "", "b_doc": "" }, { "pair": 75, "a_id": "REQ-INST-5", "b_id": "REQ-RUN-SHORTCUT", "a_title": "Two-tier context sync (live to all, project to same-project)", "b_title": "`-` launcher shortcut generation (picker `s` keybind, M12-W2-T2.4): from any pre-start options set the picker writes/updates a `` shortcut** (picker `s` keybind, M12-W2): From any pre-start options set, `s` writes (or updates) a **`-` launcher** at the project root that bakes the current selection's **no" }, { "pair": 76, "a_id": "REQ-INST-9", "b_id": "REQ-INSTALL-8", "a_title": "Multi-subnet membership (same-user N subnets; cross-user seam)", "b_title": "OS-service registration (REQ-INSTALL-1's deferred third leg): Linux systemd USER service + loginctl enable-linger (linger rides the elevated install l", "a_doc": "", "b_doc": "" }, { "pair": 77, "a_id": "REQ-INSTALL-12", "b_id": "REQ-PLATFORM-MUSL", "a_title": "Durable active-profile pointer for bind-time profile selection (ADR-0021): adapters/active-profiles.toml at the registry ROOT (sibling to the per-adap", "b_title": "MUSL-TIER W2 (register the musl platform, self-IDENTIFY): add x86_64-unknown-linux-musl to the W1 registry \u2014 a current_platform() cfg arm (target_arch", "a_doc": "Bind-time adapter/profile resolution (ADR-0021).** Because the seed is adapter-agnostic, `listen`/`poll` resolve the owning adapter/profile when they bind, as a pure read \u2014 never a seed-time snapshot ", "b_doc": "" }, { "pair": 78, "a_id": "REQ-INSTALL-6", "b_id": "REQ-UPDATE-FETCH-CURRENT-UX", "a_title": "Linux elevation install leg: install.sh symlinks the binary into a sudo-reachable path (/usr/local/bin; graceful print-the-one-liner when unelevated) ", "b_title": "`spt update fetch` reports an already-staged / already-applied latest as an ACTIONABLE human outcome (exit 0), not a Debug-formatted error. ROOT: cmd_", "a_doc": "", "b_doc": "" }, { "pair": 79, "a_id": "REQ-PLATFORM-REGISTRY", "b_id": "REQ-RUN-SHORTCUT", "a_title": "MUSL-TIER W1 (target-triple centralization, behaviour-NEUTRAL refactor): ONE authoritative platform registry from which current_platform(), KNOWN_TARG", "b_title": "`-` launcher shortcut generation (picker `s` keybind, M12-W2-T2.4): from any pre-start options set the picker writes/updates a `` shortcut** (picker `s` keybind, M12-W2): From any pre-start options set, `s` writes (or updates) a **`-` launcher** at the project root that bakes the current selection's **no" }, { "pair": 80, "a_id": "REQ-BROKER-OUTPUT-BEFORE-EXIT", "b_id": "REQ-HAZARD-SINGLE-PATH-SOURCE", "a_title": "RC-RENDER-TRUTH W3 (ADR-0043 decision 1, hertz stale-glyphs RCA leg 1 P0): the PTY drain/output writer is the SOLE FIFO sequencer for terminal Output ", "b_title": "Single path/registry source of truth; no layout ambiguity (6.1)", "a_doc": "1. **One FIFO sequencer per attach sink.** The PTY drain/output writer is the sole sequencer for terminal Output and Exit: Exit is enqueued behind all prior output for each sink (drain EOF/completion ", "b_doc": "" }, { "pair": 81, "a_id": "REQ-HAZARD-DIRECT-WRITE-PRECEDENCE", "b_id": "REQ-MANIFEST-6", "a_title": "Direct-write precedence marker (with node id) guards stale overwrite (6.5)", "b_title": "Cross-adapter fallback target addressing (M12-W3-T3.2): a cross-adapter fallback target is addressed as `:` (not just a bare adapter", "a_doc": "", "b_doc": "Command templates are opaque.** spt-core never parses out a model/tool/flag \u2014 the adapter writes the whole command line; spt-core fills substitution keys and runs it. A command template's program toke" }, { "pair": 82, "a_id": "REQ-HAZARD-SINGLE-PATH-SOURCE", "b_id": "REQ-INSTALL-4", "a_title": "Single path/registry source of truth; no layout ambiguity (6.1)", "b_title": "Adapter registration lifecycle: spt adapter add (--github, manifest-first, install-is-first-update) + soft-deregister remove + optional manifest unins", "a_doc": "", "b_doc": "" }, { "pair": 83, "a_id": "REQ-INSTALL-4", "b_id": "REQ-MANIFEST-SUBST", "a_title": "Adapter registration lifecycle: spt adapter add (--github, manifest-first, install-is-first-update) + soft-deregister remove + optional manifest unins", "b_title": "Manifest substitution primitives for resolve-not-execute (ADR-0029, supersedes a rejected `spt api run-hook`): (1) two adapter-static substitution key", "a_doc": "", "b_doc": "Adapter-static keys \u2014 `{adapter_dir}` and `{adapter_name}` (since v0.16.0).** Two of the catalog keys are *adapter-static* \u2014 they depend only on the resolved adapter, never on a session or event, so t" }, { "pair": 84, "a_id": "REQ-MANIFEST-6", "b_id": "REQ-MANIFEST-SUBST", "a_title": "Cross-adapter fallback target addressing (M12-W3-T3.2): a cross-adapter fallback target is addressed as `:` (not just a bare adapter", "b_title": "Manifest substitution primitives for resolve-not-execute (ADR-0029, supersedes a rejected `spt api run-hook`): (1) two adapter-static substitution key", "a_doc": "Command templates are opaque.** spt-core never parses out a model/tool/flag \u2014 the adapter writes the whole command line; spt-core fills substitution keys and runs it. A command template's program toke", "b_doc": "Adapter-static keys \u2014 `{adapter_dir}` and `{adapter_name}` (since v0.16.0).** Two of the catalog keys are *adapter-static* \u2014 they depend only on the resolved adapter, never on a session or event, so t" }, { "pair": 85, "a_id": "REQ-CARRIER-CLAIM-EXCLUSIVE", "b_id": "REQ-RELAY-DEATH-CONVERGENCE", "a_title": "MSG-IDENTITY W4 / F-033 + operator self-send probe 2026-07-09 (dup-delivery cluster, RCA-FIRST): a spooled message row is delivered by EXACTLY ONE car", "b_title": "A dead harness relay MUST converge the endpoint's projection \u2014 an endpoint whose relay process is provably gone cannot keep rendering `ONLINE - HARNES", "a_doc": "", "b_doc": "" }, { "pair": 86, "a_id": "REQ-HAZARD-INBOX-NO-DOUBLE", "b_id": "REQ-MSG-DELIVERY-AXES", "a_title": "No double-delivery via legacy inbox (4.5)", "b_title": "Activity-gated inbound delivery + per-message send control as THREE ORTHOGONAL AXES plus opaque metadata (ADR-0028; grilled w/ operator 2026-06-23). S", "a_doc": "", "b_doc": "Activity-gated message delivery + send-modifier axes" }, { "pair": 87, "a_id": "REQ-SEND-WINDOW-DRAIN-HONOR", "b_id": "REQ-TERM-2", "a_title": "F-035 (field finding 2026-07-09): active_only = POLL-ONLY for a relay-bearing live agent -- it must NEVER be RELAY-delivered (its contract is 'active ", "b_title": "session-surface abstraction; send-keys + send-line injection", "a_doc": "F-035 RCA \u2014 report-before-fix. F-035 RCA \u2014 idle-edge parked-drain ignores the delivery-window tag", "b_doc": "" }, { "pair": 88, "a_id": "REQ-EP-9", "b_id": "REQ-MSG-5", "a_title": "`#` always-on address sigil: a reserved LEADING sigil marking an AlwaysOnEndpoint, extending the REQ-INST-10 grammar to `[subnet:]#id[@node]`. Mandato", "b_title": "user-msg envelope kind + daemon identity gate: a Gateway endpoint / the local user's CLI author user-msg (the user's authority); agent-family senders ", "a_doc": "Status: accepted (2026-06-21)", "b_doc": "A message sent from a Gateway carries **the user's authority** \u2014 it *is* the user speaking through a device \u2014 and is delivered typed **`user-msg`** (ratified 2026-06-12) so receiving agents weight it " }, { "pair": 89, "a_id": "REQ-OPID-TRACING-RETRY", "b_id": "REQ-SHELL-4", "a_title": "A-4b (REMOTE-TRUTH triage \u00a7A + ADR-0034 Decision 2): the tracing-only op families auto-retry ONCE with a fresh op on the typed no-longer-held error, s", "b_title": "Shell tunnel (reliable-ordered opaque byte stream): an owner<->shell link may hold a long-lived, reliable-ordered, link-bound QUIC stream pair carryin", "a_doc": "Decision 3's \"typed op error\" is realized as a single `pub const` marker phrase, not a new typed variant on the KIND_ERROR wire path:", "b_doc": "shell tunnel: a long-lived reliable-ordered link-bound QUIC stream pair carrying opaque bytes the taxonomy never reinterprets; manifest opt-in, not enveloped/MAC-framed/spooled; link-break closes it; " }, { "pair": 90, "a_id": "REQ-ER-BRINGUP-TOTP-GATE", "b_id": "REQ-PAIR-1", "a_title": "Bringing the engine room online \u2014 and attaching a controller to it \u2014 requires a same-node CLI call PLUS a member-or-admin TOTP for its home subnet, an", "b_title": "TOTP-seeded SPAKE2 pairing", "a_doc": "Bring-online + controller-attach requires a **same-node CLI call plus a member-or-admin TOTP** for the engine-room's home subnet. The gate proves a human holding subnet material is at the controls; ag", "b_doc": "" }, { "pair": 91, "a_id": "REQ-JOIN-DIAGNOSTICS", "b_id": "REQ-JOIN-TWO-PHASE", "a_title": "`spt subnet join` never fails SILENTLY (ADR-0030; the field incident showed no output at all). (a) LIVE progress during the meet (replace the one-shot", "b_title": "`spt subnet join` is two-phase (meet-before-code) so the entered code is FRESH at the ceremony regardless of discovery time (ADR-0030). The meet selec", "a_doc": "Robust WAN subnet join: meet-before-code + per-family bind gate", "b_doc": "Robust WAN subnet join: meet-before-code + per-family bind gate" }, { "pair": 92, "a_id": "REQ-PAIR-2", "b_id": "REQ-PAIR-8", "a_title": "Local trust store with TOFU + warn-on-change", "b_title": "NTP TOTP offset: the pairing ceremony queries NTP at ceremony time (both sides) and applies the derived offset to the TOTP calculation in-process only", "a_doc": "", "b_doc": "" }, { "pair": 93, "a_id": "REQ-ENDPOINT-LIST-PALETTE", "b_id": "REQ-PICKER-REMOTE-WAKE", "a_title": "Bugs #11 + #15 (display): spt endpoint list renders status as plain text while the picker turns the same ResourceRow into the W5 colored EpDisplay pal", "b_title": "C-2 (REMOTE-TRUTH triage \u00a7C-2 #4 + addendum @3442ce5): a REMOTE suspended picker row offers `Wake now` \u2014 waking the endpoint THROUGH its owning node's", "a_doc": "", "b_doc": "" }, { "pair": 94, "a_id": "REQ-HAZARD-BIND-CWD-UNSET", "b_id": "REQ-STORE-CONTEXT-BRANCH-FILL", "a_title": "A bound endpoint's `info.cwd` is SET at bind so a freshly-created perch appears under its own project tab. ROOT (found, v0.13.0): `info.cwd` is NEVER ", "b_title": "#1 SI-1 (RCA, operator-promoted 2026-07-03): the context store (tracked/.seed.git) holds ZERO p-* branches on a box with months of live-agent use, whi", "a_doc": "", "b_doc": "7.28 A relative manifest path resolves against the ENDPOINT, never the daemon `[REQ-STORE-CONTEXT-BRANCH-FILL]` Class rule:** a relative manifest path naming a filesystem location the ENDPOINT reads o" }, { "pair": 95, "a_id": "REQ-PICKER-4", "b_id": "REQ-PICKER-PROJECT-HISTORY-TRUTH", "a_title": "The picker's Subnet category renders the canonical node LABEL, not bare key-hex: a subnet row's node renders as 'LABEL (keyprefix\u2026)' (e.g. 'HFENDULEAM", "b_title": "#1: picker project history is derived from sessions.log cwds (newest->oldest, deduped by project_id_for_dir) UNION context-store branches, EXCLUDING o", "a_doc": "", "b_doc": "" }, { "pair": 96, "a_id": "REQ-PICKER-CHANGE-ADAPTER-FLOW", "b_id": "REQ-PICKER-START-PROJECT-CHOICE", "a_title": "B-2 (F029, operator; LARGEST item): `ConfirmOption::ChangeAdapter` wrongly routes into the CREATE flow (Screen::CreateAdapter \u2192 CreateId \u2192 CreateHome ", "b_title": "#5: after 'Start now' in the endpoint picker, swap the bottom Options panel to a 'Choose project' list: (1) the endpoint's most recent project dir, (2", "a_doc": "", "b_doc": "" }, { "pair": 97, "a_id": "REQ-PICKER-NODE-GROUPING", "b_id": "REQ-PICKER-OFFLINE-NO-VIEW", "a_title": "Bug #13: the endpoint run Subnet tab shows a machine once PER shared subnet (subnet_rows data.rs:253 iterates per-subnet, groups by subnet:node, no cr", "b_title": "A3 (F028, operator #3): 'View now (read-only)' is offered for OFFLINE endpoints. model.rs:1030 offline branch of confirm_options is vec![Start, View] ", "a_doc": "", "b_doc": "" }, { "pair": 98, "a_id": "REQ-PICKER-RESUME-CONTEXT-PANEL", "b_id": "REQ-STORE-CONTEXT-BRANCH-FILL", "a_title": "#6: the 'Resume from history' view keeps the endpoint's 'Confirm selection' top panel and swaps ONLY the bottom panel to 'Resume from a prior session'", "b_title": "#1 SI-1 (RCA, operator-promoted 2026-07-03): the context store (tracked/.seed.git) holds ZERO p-* branches on a box with months of live-agent use, whi", "a_doc": "", "b_doc": "7.28 A relative manifest path resolves against the ENDPOINT, never the daemon `[REQ-STORE-CONTEXT-BRANCH-FILL]` Class rule:** a relative manifest path naming a filesystem location the ENDPOINT reads o" }, { "pair": 99, "a_id": "REQ-CI-POSTJOB-DAEMON-REAP", "b_id": "REQ-NODE-IDENTITY", "a_title": "A CI job REAPS ITS OWN test-spawned daemons at battery end, in-job, and logs a process census at job start AND job end so contamination and reap effec", "b_title": "Ed25519 identity primitive: keypair, detached sign/verify, stable pubkey<->hex", "a_doc": "", "b_doc": "" }, { "pair": 100, "a_id": "REQ-API-4", "b_id": "REQ-CI-WINDOWS-PHASE-A-BOUND", "a_title": "api resolves the adapter manifest (+ profile + install dir) from `--adapter name:profile` via the registry when `--manifest` is omitted; `--manifest` ", "b_title": "Phase-A nextest parallelism is BOUNDED on the Windows self-hosted leg, so the full-parallel 1881-test battery stops saturating a box that also hosts t", "a_doc": "Manifest resolution from `--adapter` (since v0.8.0).** `spt api --adapter ` resolves the registered adapter's manifest, `:profile` overlay, and install dir from the registry when", "b_doc": "" }, { "pair": 101, "a_id": "REQ-BIND-HONEST-SELF-STAMP", "b_id": "REQ-WORKER-PICKER-EXCLUDED", "a_title": "C2-ROOT (F028, doyle RCA 2026-07-03): the identity-attribution ROOT behind REQ-SESSIONS-LOG-ENDPOINT-ATTRIBUTION \u2014 three composing defects let a psych", "b_title": "V-2 (WORKER-TRUTH triage, operator rider): non-drivable endpoint classes never render as `spt endpoint run` picker rows \u2014 a worker perch cannot be dri", "a_doc": "", "b_doc": "" }, { "pair": 102, "a_id": "REQ-CI-WINDOWS-PHASE-A-BOUND", "b_id": "REQ-START-2", "a_title": "Phase-A nextest parallelism is BOUNDED on the Windows self-hosted leg, so the full-parallel 1881-test battery stops saturating a box that also hosts t", "b_title": "Harness-hosted startup: api seed then listen", "a_doc": "", "b_doc": "" }, { "pair": 103, "a_id": "REQ-DIGEST-GENERATION-SUPERSEDE", "b_id": "REQ-UPDATE-FINISH-ENDPOINT-SURVIVAL", "a_title": "W3 (LIFECYCLE-TRUTH, digest projection truth \u2014 flynn filing spt-mobile d0aa3f4): a one-shot `endpoint digest --json` snapshot must return each logical", "b_title": "W3 (LIFECYCLE-TRUTH): daemon restart no longer massacres hosted endpoints \u2014 daemon start RE-RUNS previously-online spt-hosted endpoints. ROOT rig-prov", "a_doc": "", "b_doc": "" }, { "pair": 104, "a_id": "REQ-HAZARD-DAEMON-IDENTITY-ENV-SANITIZE", "b_id": "REQ-HAZARD-PSYCHE-OUTBOUND-PROXY", "a_title": "MSG-IDENTITY W1 / F-036 leg a (perri field RCA 2026-07-09/10, psyche seat-theft \u2014 doyle ACCEPTED primary fix): the daemon MUST sanitize inherited per-", "b_title": "Psyche outbound captured + sanitized: the live-Psyche turn driver captures stdout (never Stdio::null), and the daemon strips/re-stamps Psyche-supplied", "a_doc": "7.39 Per-session identity env (`SPT_ENDPOINT_ID`/`OWL_SESSION_ID`/`SPT_AGENT_ID`) is NEVER inherited \u2014 the daemon scrubs it at startup AND on every role spawn, regardless of any role's declared `env_r", "b_doc": "" }, { "pair": 105, "a_id": "REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT", "b_id": "REQ-NOTIF-MIGRATE", "a_title": "A clean `spt rc` attach to a LIVE spt-hosted (`endpoint run`) harness must DELIVER the harness's PTY output. KEYSTONE \u2014 the operator's central 'attach", "b_title": "One-shot field migration: on first run the new binary auto-dismisses existing rows with from_id = spt-update (kinds consent/rollback) \u2014 the known-stal", "a_doc": "", "b_doc": "6. Field migration: one-shot targeted auto-dismiss" }, { "pair": 106, "a_id": "REQ-HAZARD-LIVEHOST-BOOT-RACE", "b_id": "REQ-READY-AGENT-RESUME", "a_title": "The brain's daemon-hosted Psyche lifecycle surfaces a host-FAILURE on the live perch (harness-diagnosable) and runs net-INDEPENDENTLY. When reconcile_", "b_title": "An offline ReadyAgent shows in `spt endpoint run`'s picker Resume-from-history and resumes correctly \u2014 closing the gap that today only LiveAgents do. ", "a_doc": "", "b_doc": "`spt endpoint run` is the spt-hosted bringup for BOTH endpoint types** (v0.12.0): The bringup core is **type-agnostic** \u2014 the endpoint TYPE is the adapter manifest's concern, not a separate bringup mo" }, { "pair": 107, "a_id": "REQ-HAZARD-PSYCHE-RESIDENCY-EXPECTATION", "b_id": "REQ-LISTEN-SESSION-ID-FALLBACK", "a_title": "W3 (F030 hazard; paid-for: hall-bf churn ordinal 6491+ + adapter v0.13.2 bad-ship brick 2026-07-04): a psyche failure of ANY shape must NOT remove or ", "b_title": "F-034 leg c (perri/hertz field finding 2026-07-09): a session that goes live LATE (hours after SessionStart, or after a daemon restart) must still be ", "a_doc": "7.30 A Psyche failure of ANY shape must NEVER remove or alter the parent endpoint's ready/hosted state `[REQ-HAZARD-PSYCHE-RESIDENCY-EXPECTATION]` Failure (paid-for, field brick 2026-07-04, adapter v0", "b_doc": "Seed lifetime.** The seed lives **in the daemon's memory only** \u2014 no file \u2014 and survives until exactly one of: a successful `listen` bind consumes it, a newer `seed` for the same pid overwrites it, or" }, { "pair": 108, "a_id": "REQ-HAZARD-THRASH-GUARD-BLIND", "b_id": "REQ-UPDATE-FINISH-ENDPOINT-SURVIVAL", "a_title": "W3 (F030 hazard; paid-for: evidence #6, hall-bf ~12/min re-host NEVER tripped the C3(b) thrash guard \u2014 boot records were not ledger boundaries to the ", "b_title": "W3 (LIFECYCLE-TRUTH): daemon restart no longer massacres hosted endpoints \u2014 daemon start RE-RUNS previously-online spt-hosted endpoints. ROOT rig-prov", "a_doc": "7.31 The Psyche failure budget must count REAL per-event attempts \u2014 a resident rate-guard is blind to per-event churn `[REQ-HAZARD-THRASH-GUARD-BLIND]` Failure (paid-for, field evidence 2026-07-04):**", "b_doc": "" }, { "pair": 109, "a_id": "REQ-HEAVY-UNIT-CLASSIFICATION", "b_id": "REQ-SPOOL-TAKE-AUDIT", "a_title": "A unit test that stands up a REAL broker inside a lib/bin `#[cfg(test)]` block must sit in the `heavy-broker-pty` nextest group, and the classificatio", "b_title": "W5 (LIFECYCLE-TRUTH, RCA cost: proving WHO took delivered=1 rows burned an hour): the spool records the taker per row \u2014 leg enum (relay-backlog / hook", "a_doc": "", "b_doc": "" }, { "pair": 110, "a_id": "REQ-INST-2", "b_id": "REQ-NET-3", "a_title": "Per-node files, synced Psyche mind", "b_title": "Cross-node Psyche sync over P2P replaces gh-repo-sync", "a_doc": "", "b_doc": "" }, { "pair": 111, "a_id": "REQ-NET-3", "b_id": "REQ-SESSION-ADAPTER-RECORDED", "a_title": "Cross-node Psyche sync over P2P replaces gh-repo-sync", "b_title": "D-2 (REMOTE-TRUTH triage \u00a7D-2 + operator Q5 @c248afc): the session ledger records the adapter[:profile] a session ran under, so a later resume can res", "a_doc": "", "b_doc": "" }, { "pair": 112, "a_id": "REQ-PSYCHE-CONTEXT-FILE-INDIRECTION", "b_id": "REQ-PSYCHE-EPHEMERAL-DRIVER", "a_title": "W4 (F030; doyle Q2 ruling + perri file-always freeze, 2026-07-04): the composed psyche mind ({psyche_context}) rides the SHIM argv today \u2014 a real ~20K", "b_title": "W1 (F030, design \u00a73): each psyche-relevant event runs exactly ONE bounded per-event turn through the existing driver stack (psyche_turn_and_relay for ", "a_doc": "Psyche-download \u2014 `{psyche_context_file}` (file-always, replaces `{psyche_context}`).** The composed Psyche mind rides a **file**, never the command argv: before each turn spt-core writes the mind int", "b_doc": "Psyche**: The Psyche companion's own perch, distinct from its paired LiveAgent's perch. First-class endpoint type so messages addressed to a LiveAgent's Psyche route directly without ambiguity. **A Ps" }, { "pair": 113, "a_id": "REQ-PSYCHE-ROLE-OPTIONAL-SKIP", "b_id": "REQ-SESSIONS-LOG-ENDPOINT-ATTRIBUTION", "a_title": "W1 (LIFECYCLE-TRUTH): a manifest with NO [session.echo_commune] role SKIPS commune-sync (debug-level note, no strike) instead of hard-failing the turn", "b_title": "C2 (F028, infra; ROOT-CAUSED + severity-upgraded doyle RCA 2026-07-03): cross-endpoint perch contamination \u2014 a foreign psyche's SessionStart hook REBI", "a_doc": "", "b_doc": "" }, { "pair": 114, "a_id": "REQ-SESSIONS-LOG-ENDPOINT-ATTRIBUTION", "b_id": "REQ-WORKER-SID-SYMMETRIC-AUTH", "a_title": "C2 (F028, infra; ROOT-CAUSED + severity-upgraded doyle RCA 2026-07-03): cross-endpoint perch contamination \u2014 a foreign psyche's SessionStart hook REBI", "b_title": "W-2 (WORKER-TRUTH triage, operator-ruled 2026-07-06): worker verbs go sid-symmetric with every sibling id-scoped verb \u2014 worker-start mints NO token an", "a_doc": "", "b_doc": "`api worker-stop --session-id ` \u00b7 `api worker-poll --session-id `" }, { "pair": 115, "a_id": "REQ-CI-LOCAL-GATE-DISPOSAL", "b_id": "REQ-RELEASE-CHANNEL-PRIVATE", "a_title": "Local gate-battery parity (path-scoped reap before target disposal + free-byte proof): a local self-hosted gate battery that creates a throwaway Cargo", "b_title": "THE-FORKENING W2 (ADR-0036 \u00a72): the publish pipeline targets `BigscreenVR/spt-bs-releases` \u2014 release.yml assemble/draft/flip retargeted (draft lands o", "a_doc": "", "b_doc": "" }, { "pair": 116, "a_id": "REQ-ADAPTER-UPDATE-INPLACE", "b_id": "REQ-HAZARD-BROKER-FLOOR-LOCK-POISON", "a_title": "Bug #18: spt adapter update fails at re-register with os error 2 because it derives the install dir from the update repo NAME (_github/) instead", "b_title": "B-1 (REMOTE-TRUTH triage \u00a7B-1, PIVOTED @e5eb99a): NO bare `.lock().unwrap()` on a broker-resident lock reachable from serve/dispatch \u2014 a brain-only se", "a_doc": "", "b_doc": "7.33 NO bare `.lock().unwrap()` on a broker-resident lock reachable from serve/dispatch \u2014 a poison permanently wedges every attach `[REQ-HAZARD-BROKER-FLOOR-LOCK-POISON]` Failure (paid-for class):** a" }, { "pair": 117, "a_id": "REQ-ADAPTER-UPDATE-POST", "b_id": "REQ-UPD-9", "a_title": "Composite adapter update \u2014 an avenue-agnostic `[update.post]` sub-table `{ command, self_verifies }` run AFTER the primary avenue (gh_release/file_pul", "b_title": "`gh_release` adapter [update] avenue (optional signing): an adapter declares `[update] avenue = \"gh_release\", repo = \"user/repo\"` (+ optional `asset`,", "a_doc": "`[update.post]` \u2014 the composite post-step (since v0.16.0) / Composite update \u2014 `[update.post]` (since v0.16.0).** An optional **avenue-agnostic** sub-table that runs a delegated **post-step** *after* ", "b_doc": "adapter update declaration** (manifest field): Each adapter manifest declares how spt-core should *ripple-update the adapter itself* (see Self-update). One of: **file-pull** (a plugin-directory lookup" }, { "pair": 118, "a_id": "REQ-BROKER-ATTACH-JOURNAL-RESILIENT", "b_id": "REQ-HAZARD-UPDATE-ROLLBACK", "a_title": "A poisoned EffectJournal mutex or a sick NetHost runtime must NOT permanently brick all future attaches. Bug #16 (URGENT): a live spt-hosted endpoint ", "b_title": "Self-update rejects version rollback; metadata expiry + adapter content signing (codex #5)", "a_doc": "", "b_doc": "" }, { "pair": 119, "a_id": "REQ-DAEMON-2", "b_id": "REQ-UPDATE-RESTART-SAFE-SWAP", "a_title": "Broker/brain split for seamless self-update", "b_title": "THE-FORKENING W4 (operator-grilled 2026-07-14; RETIRES findings-backlog seed #12 REQ-UPDATE-ONE-STEP-SAFE-SWAP): `spt update --restart` = the one-step", "a_doc": "Restoration field-run evidence (D7-4) \u2014 the seamless-update acceptance", "b_doc": "update composite (`spt update`)** \u2014 the plain verb is the primary form: `update fetch --apply` then `update adapters` (core-first order); with core already current, only adapters update. `--core-only`" }, { "pair": 120, "a_id": "REQ-HAZARD-BROKER-PROCESS-ISOLATION", "b_id": "REQ-UPDATE-FINISH-COMMUNE-FLUSH", "a_title": "Broker and brain are separate processes: the broker runs as its own long-lived per-machine process that survives every brain restart, so a routine (br", "b_title": "DEFERRED (post-LIFECYCLE-TRUTH, operator-ruled 2026-07-07 \u2014 mint now, impl a FUTURE milestone): make the update swap LOSSLESS for live hosted endpoint", "a_doc": "6.7 Broker and brain MUST be separate processes (in-process collapse silently breaks no-endpoint-drop update) `[REQ-HAZARD-BROKER-PROCESS-ISOLATION]` Failure:** the daemon hosts the broker as a backgr", "b_doc": "" }, { "pair": 121, "a_id": "REQ-HAZARD-ROLLBACK-STATE-COMPAT", "b_id": "REQ-REL-2", "a_title": "A brain must not irreversibly migrate durable state before update ready-promotion: the readiness-gated auto-rollback (ADR-0018 Q7) spawns the N-1 bina", "b_title": "Release asset set consumable by the self-updater: platform binaries, SHA256SUMS, SignedRelease metadata, manifest schema, mock-adapter zip; tag-trigge", "a_doc": "6.8 No irreversible durable-state migration before update ready-promotion `[REQ-HAZARD-ROLLBACK-STATE-COMPAT]` Failure:** the readiness-gated auto-rollback (ADR-0018 Q7) spawns the *previous* binary a", "b_doc": "M6-D6/D7 (ADR-0015). How a release ships. CI builds; the maintainer signs locally \u2014 release keys never enter CI." }, { "pair": 122, "a_id": "REQ-INSTALL-13", "b_id": "REQ-UPDATE-TRIAL-DRAIN-DRIVE", "a_title": "Adapter add is non-destructive & idempotent-safe (F-018): `spt adapter add --github|--release` REFUSES when the target `_github/` home already b", "b_title": "UPDATE-WEDGE (counter-54, doyle-ruled 2026-07-09 \u2014 regression of the v0.29.0 seamless brain-swap): a brain generation DRIVES the broker's controller-l", "a_doc": "adapter registration (`spt adapter add`)**: How a node comes to *know* an adapter \u2014 harness or shell. An explicit **`spt adapter add `** (or **`--github `**) validates the manifest ag", "b_doc": "brain-trial promotion (readiness + drained)** \u2014 the broker supervises the swapped-in brain through a bounded readiness **trial** and *promotes* the new binary only when it both signals ready for its o" }, { "pair": 123, "a_id": "REQ-RELEASE-MUSL-ARTIFACT", "b_id": "REQ-UPD-4", "a_title": "MUSL-TIER W3 (CI build + signed release + update-set publish + self-update E2E): release.yml gains a musl matrix entry (build on kitsubito; install mu", "b_title": "Update gated on user confirmation by default; opt-in full-auto", "a_doc": "", "b_doc": "" }, { "pair": 124, "a_id": "REQ-UPD-4", "b_id": "REQ-UPD-6", "a_title": "Update gated on user confirmation by default; opt-in full-auto", "b_title": "Platform-targeted update sets and debug rollout: signed multi-platform update metadata, recipient platform selection, channel-scoped monotonic counter", "a_doc": "", "b_doc": "Build plan \u2014 `xtask debug-converge` (deferred follow-up) / Debug rollout runbook" }, { "pair": 125, "a_id": "REQ-UPDATE-GH-TRANSPORT", "b_id": "REQ-UPDATE-TRIAL-DRAIN-DRIVE", "a_title": "THE-FORKENING W1 (ADR-0036, operator-ruled 2026-07-14): the release channel is PRIVATE (`BigscreenVR/spt-bs-releases`) and the gh CLI is the mandated ", "b_title": "UPDATE-WEDGE (counter-54, doyle-ruled 2026-07-09 \u2014 regression of the v0.29.0 seamless brain-swap): a brain generation DRIVES the broker's controller-l", "a_doc": "release channel (private, gh-carried)** \u2014 the release channel is a **private** GitHub repo (`BigscreenVR/spt-bs-releases`, ADR-0036); the **gh CLI is the mandated carrier** for release discovery and a", "b_doc": "brain-trial promotion (readiness + drained)** \u2014 the broker supervises the swapped-in brain through a bounded readiness **trial** and *promotes* the new binary only when it both signals ready for its o" }, { "pair": 126, "a_id": "REQ-PICKER-CHANGE-ADAPTER-FLOW", "b_id": "REQ-UPDATE-PROMOTE-DRAINED", "a_title": "B-2 (F029, operator; LARGEST item): `ConfirmOption::ChangeAdapter` wrongly routes into the CREATE flow (Screen::CreateAdapter \u2192 CreateId \u2192 CreateHome ", "b_title": "W3 (LIFECYCLE-TRUTH, mechanic-d MOVED FROM W2 per doyle gate verdict @e5ae7a9 \u2014 binding): the update-apply brain-generation promotion completes only w", "a_doc": "", "b_doc": "" }, { "pair": 127, "a_id": "REQ-HAZARD-WORKER-PATH", "b_id": "REQ-SESSION-RESUME-TEMPLATE", "a_title": "Single source of truth for Worker/Psyche perch location (1.5)", "b_title": "Resuming an endpoint session that HAS conversation history brings up a BLANK session. ROOT (doyle, code-grounded + CONTEXT \u2014 case-3 spt-core MISSING f", "a_doc": "", "b_doc": "Resuming an existing harness session (since v0.13.0).** `[session.self]` is the *fresh bringup; `[session.resume]` is the **native-resume** sibling. spt-core selects `[session.resume]` over `[session." }, { "pair": 128, "a_id": "REQ-SOFT-END-PRESERVES-LIVE-LISTENER", "b_id": "REQ-VIEWER-SKIP-TO-LIVE-ON-EVICT", "a_title": "F-2 (REMOTE-TRUTH triage \u00a7F-2, field-repro'd hall-bf 2026-07-04): a /clear must not sever a SURVIVING poll listener's relay address \u2014 post-clear owl-p", "b_title": "A `rc --view` VIEWER that overflows its broker subscription queue and is EVICTED (OutputLog::append try_send Full \u2192 viewers.remove, REQ-HAZARD-VIEWER-", "a_doc": "", "b_doc": "BUILT (M12 W2.5).** The controller/viewer model is implemented end-to-end. Attach intent is **three-valued** (`AttachIntent = Viewer | Control | Take`, wire-default `Control`): `Control` to a FREE end" }, { "pair": 129, "a_id": "REQ-MSG-5", "b_id": "REQ-MSG-SELF-DETECT-ANCESTRY", "a_title": "user-msg envelope kind + daemon identity gate: a Gateway endpoint / the local user's CLI author user-msg (the user's authority); agent-family senders ", "b_title": "#9 (F026, operator field bug): a perch-owned `spt send` from an endpoint's OWN session must self-identify, not mis-stamp `cli@` (whose replies b", "a_doc": "A message sent from a Gateway carries **the user's authority** \u2014 it *is* the user speaking through a device \u2014 and is delivered typed **`user-msg`** (ratified 2026-06-12) so receiving agents weight it ", "b_doc": "" }, { "pair": 130, "a_id": "REQ-ENDPOINT-ONLINE-TRUTH", "b_id": "REQ-HAZARD-CONTROL-STAMP-LIFETIME", "a_title": "REGISTRY-LIFECYCLE W2 (ADR-0041 decisions 1+2, emphasys C1 P0): ONLINE is earned, not declared \u2014 cmd_listen stamps status=online only from actual pers", "b_title": "#2: a control/viewer stamp never outlives its session \u2014 every teardown path clears what attach stamped. The broker exit-waiter (broker.rs ~:1844) send", "a_doc": "1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual persisted state + hosting authority \u2014 never from manifest capability alone. Legacy hybrid rows self-heal at ", "b_doc": "7.27 A control/viewer stamp must NEVER outlive its session \u2014 every teardown path clears what attach stamped `[REQ-HAZARD-CONTROL-STAMP-LIFETIME]` Failure (F-026 #2, live evidence HFENDULEAM):** an spt" }, { "pair": 131, "a_id": "REQ-HAZARD-INJECT-WORKER-POISON", "b_id": "REQ-HAZARD-REDISPATCH-CONTROL-STEAL", "a_title": "The per-session inject-worker floor Mutex is SHARED by the inject worker (open/flush) and the controller-input path (dispatch_input Layer C buffer_if_", "b_title": "REDISPATCH-TRUTH W1 (KNOWN-HAZARDS 7.41, hertz field RCA 2026-07-16 \u2014 4/5 endpoints frozen per brain cycle): a fresh dispatcher must NEVER re-serve a ", "a_doc": "", "b_doc": "7.41 A fresh dispatcher must NEVER re-serve a terminal stream \u2014 historical replay must not steal or clear a live controller `[REQ-HAZARD-REDISPATCH-CONTROL-STEAL]` Failure (paid-for, hertz field RCA 2" }, { "pair": 132, "a_id": "REQ-RC-IDENTITY", "b_id": "REQ-RC-RECONNECT", "a_title": "`spt rc` overlays a persistent endpoint-identity marker so the operator always groks which endpoint they control: a reserved TOP status row via a DECS", "b_title": "B-3 (REMOTE-TRUTH triage \u00a7B-3, the operator-asked UX): the rc attach viewport RECONNECTS on a severed transport instead of print-and-exit. Pre-fix rc ", "a_doc": "", "b_doc": "| # | Fault injected | Blast radius (by design) | Survives untouched | Recovery | Evidence | |---|---|---|---|---|---| | 1 | **Brain killed mid-PTY-stream** (logic crash / routine self-update) | Logic" }, { "pair": 133, "a_id": "REQ-HAZARD-ENDPOINT-LIFECYCLE", "b_id": "REQ-HAZARD-STOP-PATH-PSYCHE-ORPHAN-REAP", "a_title": "REGISTRY-LIFECYCLE W2 (KNOWN-HAZARDS 7.45 \u2014 the umbrella conformance seam for ADR-0041): endpoint lifecycle state converges to truth from EVERY death ", "b_title": "Endpoint-stop and brain-death reconcile MUST reap a brain-less perch's orphan detached Psyche via the cmdline-scoped guard (`psyche_orphan_should_reap", "a_doc": "7.45 Endpoint lifecycle state converges to truth from every death path \u2014 no optimistic online without authority, no surviving control stamps, no immortal wake intent, no untruthful create `[REQ-HAZARD", "b_doc": "| # | Invariant | spt-core surface | |---|---|---| | 1.1 | Grace wait precedes INIT_SIGNOFF | daemon teardown | | 1.4/4.4 | Deferred rows excluded from event-stream drain | daemon spool drain | | 2.1/" }, { "pair": 134, "a_id": "REQ-HAZARD-BRAIN-RESTART-LIFECYCLE-REHYDRATE", "b_id": "REQ-TRANSLATE-BINARY-LIVENESS-DECAY", "a_title": "B4 (deepest): a bare brain restart (broker survives) REHYDRATES the live-agent lifecycle so post-restart endpoints are hosted + attachable. Today resu", "b_title": "SUPERSEDED by REQ-TRANSLATE-COMMIT-MISS-TOLERANCE (F029 C-1). B6 (F028, perri F-e) was ROOT-PINNED as the commit-deadline-miss fault: at a checkpoint ", "a_doc": "", "b_doc": "" }, { "pair": 135, "a_id": "REQ-PRESENCE-LIVENESS-TRUTH", "b_id": "REQ-PSYCHE-EPHEMERAL-DRIVER", "a_title": "A node's gossiped per-endpoint registry Status reflects real liveness, so a remote viewer never paints a DEAD endpoint as ONLINE. ROOT (confirmed + ga", "b_title": "W1 (F030, design \u00a73): each psyche-relevant event runs exactly ONE bounded per-event turn through the existing driver stack (psyche_turn_and_relay for ", "a_doc": "", "b_doc": "Psyche**: The Psyche companion's own perch, distinct from its paired LiveAgent's perch. First-class endpoint type so messages addressed to a LiveAgent's Psyche route directly without ambiguity. **A Ps" }, { "pair": 136, "a_id": "REQ-PRESENCE-LIVENESS-TRUTH", "b_id": "REQ-WORKER-LIST-VISIBILITY", "a_title": "A node's gossiped per-endpoint registry Status reflects real liveness, so a remote viewer never paints a DEAD endpoint as ONLINE. ROOT (confirmed + ga", "b_title": "V-1 (WORKER-TRUTH triage, operator rider): worker perches leave the DEFAULT `spt endpoint list` view \u2014 they are process-local machinery, not subnet ci", "a_doc": "", "b_doc": "" }, { "pair": 137, "a_id": "REQ-MSG-5", "b_id": "REQ-MSG-IDLE-TRANSLATION-BINARY", "a_title": "user-msg envelope kind + daemon identity gate: a Gateway endpoint / the local user's CLI author user-msg (the user's authority); agent-family senders ", "b_title": "spt-hosted idle message delivery via an adapter TRANSLATION BINARY (ADR-0022). New opt-in manifest section `[message-idle-translation-binary]` = a TAB", "a_doc": "A message sent from a Gateway carries **the user's authority** \u2014 it *is* the user speaking through a device \u2014 and is delivered typed **`user-msg`** (ratified 2026-06-12) so receiving agents weight it ", "b_doc": "`[message-idle-translation-binary]` \u2014 spt-hosted idle delivery / `[message-idle-translation-binary]` \u2014 spt-hosted idle delivery (ADR-0022) Opt-in. The adapter's **idle-delivery translation binary**: a" }, { "pair": 138, "a_id": "REQ-MSG-DELIVERY-AXES", "b_id": "REQ-WAN-SEND-DELIVERY", "a_title": "Activity-gated inbound delivery + per-message send control as THREE ORTHOGONAL AXES plus opaque metadata (ADR-0028; grilled w/ operator 2026-06-23). S", "b_title": "Bug #9/#10: cross-node spt send reports SENT(WAN) but does not deliver, even on stable-IP pairs. Real root: spt send resolves the dial with id-only ad", "a_doc": "Activity-gated message delivery + send-modifier axes", "b_doc": "" }, { "pair": 139, "a_id": "REQ-RC-QUALIFIED-TARGET-CANONICAL", "b_id": "REQ-RC-RESIZE-PRESENTATION-BARRIER", "a_title": "RC-RENDER-TRUTH W1 (ADR-0042 decision 4, hertz elevated-endpoints RCA core leg 2, doyle seam-confirmed rc.rs establish_attach): the resolver's canonic", "b_title": "During a resize transition, LIVE DELIVERY is barriered along with the grid parse: no attached sink (controller or viewer) ever receives mixed-geometry", "a_doc": "1. **`spt rc` consults the honest-session authority before the offline fast-fail. Normal `spt rc ` runs the same bounded `SessionProbe::has_live_session_honest` gate `endpoint run` uses (ADR-0041 ", "b_doc": "the presentation barrier over live delivery: during a resize transition the ring keeps recording but controller and viewer delivery is suppressed; commit lands the grid at the target geometry and push" }, { "pair": 140, "a_id": "REQ-HAZARD-ATTACH-WEDGE", "b_id": "REQ-REGISTRY-APPLY-TRANSACTIONAL", "a_title": "A legitimately dead PTY child (real crash/kill) + an undrained operator pump must NOT wedge the broker for all other clients. ROOT (v0.12.0 real-harne", "b_title": "REGISTRY-LIFECYCLE W1 (ADR-0040 decision 3, hertz defect B leg 3): registry feed application is TRANSACTIONAL per feed \u2014 serve_registry_feed merges de", "a_doc": "", "b_doc": "1. **One-way (fire-and-forget) stream families are terminal at FIN, sender-side.** The registry feed pump retires its own row after successful write+FIN via the existing `net-stream-retire` verb (best" }, { "pair": 141, "a_id": "REQ-PICKER-1", "b_id": "REQ-REDISPATCH-FINISHED-RETIRE", "a_title": "The picker renders a FOUR-state endpoint status (extending the W2 online/offline duality): the list-item square AND a color-coded STATUS line at the t", "b_title": "REDISPATCH-TRUTH W1 (ADR-0038, hertz fix A): finished/terminal stream rows are RETIRED from redispatch eligibility \u2014 NetShared.streams today has NO re", "a_doc": "", "b_doc": "Decision" }, { "pair": 142, "a_id": "REQ-BRAIN-HASH-ONCE", "b_id": "REQ-SUBNET-1", "a_title": "REGISTRY-LIFECYCLE W1 (ADR-0040 rider; dropped THE-FORKENING W4 rider escalated \u2014 hertz re-measured live 2026-07-17: 61.29 MiB/s predicted vs 63.91 ob", "b_title": "spt subnet noun namespace: status view (bare + status [NAME] [--nodes]), create (QR/otpauth), show-code; spt pair deleted", "a_doc": "", "b_doc": "" }, { "pair": 143, "a_id": "REQ-REL-3", "b_id": "REQ-SUBNET-ADMIN-RESURFACE", "a_title": "Two-key release-signing trust anchor: primary + offline never-used recovery, both pubkeys embedded in the binary's trusted set, manual local signing (", "b_title": "Rotation re-surfaces the NEW admin key exactly once, to the human who just proved the OLD one, via a PARKED pending seed (ADR-0051 \u00a72a + the parked-pe", "a_doc": "", "b_doc": "2a. Surfaced only to a proven admin \u2014 at mint and at rotation (amended 2026-07-30, fast-follow grill)" }, { "pair": 144, "a_id": "REQ-ATTACH-RESIZE-REPAINT", "b_id": "REQ-SUBNET-8", "a_title": "RESCOPED 2026-07-22 by ADR-0047 Amendment 2 (doyle-ratified): this REQ no longer asserts a defect. Its original claim \u2014 that the attach-stream resize ", "b_title": "Status render honesty: zero-subnet text is daemon-aware ('No subnets registered \u2014 this node is standalone.' + daemon-running-dependent blurb, never im", "a_doc": "Failure (paid-for THREE TIMES \u2014 v0.39.3 geometry-epoch, v0.39.4 presentation barrier, and still red in the field; pinned by hertz's ENLYZEAM production byte capture 2026-07-22, doyle seam-verified sam", "b_doc": "" }, { "pair": 145, "a_id": "REQ-PICKER-PURGE-STRUCTURED", "b_id": "REQ-SCREENGRID-REPAINT-MODE-REPLAY", "a_title": "RC-RENDER-TRUTH W3 (ADR-0043 decision 3, hertz stale-glyphs RCA leg 3 P0): core verbs invoked from inside an active TUI return STRUCTURED outcomes and", "b_title": "RC-RENDER-TRUTH W3 (ADR-0043 decision 4, hertz stale-glyphs RCA leg 4 P1): ScreenGrid cold repaint replays EVERY tracked render-affecting mode \u2014 DECST", "a_doc": "1. **One FIFO sequencer per attach sink.** The PTY drain/output writer is the sole sequencer for terminal Output and Exit: Exit is enqueued behind all prior output for each sink (drain EOF/completion ", "b_doc": "1. **One FIFO sequencer per attach sink.** The PTY drain/output writer is the sole sequencer for terminal Output and Exit: Exit is enqueued behind all prior output for each sink (drain EOF/completion " }, { "pair": 146, "a_id": "REQ-RC-RESIZE-PRESENTATION-BARRIER", "b_id": "REQ-RUN-EMPTY-CREATE", "a_title": "During a resize transition, LIVE DELIVERY is barriered along with the grid parse: no attached sink (controller or viewer) ever receives mixed-geometry", "b_title": "`spt endpoint run` / bare `spt` routes a TOTALLY-EMPTY scope straight to the endpoint-creation flow: when gather_endpoints() is empty (nothing attacha", "a_doc": "the presentation barrier over live delivery: during a resize transition the ring keeps recording but controller and viewer delivery is suppressed; commit lands the grid at the target geometry and push", "b_doc": "" }, { "pair": 147, "a_id": "REQ-ACL-DISCOVER-GATE", "b_id": "REQ-WORKER-LIST-VISIBILITY", "a_title": "DISCOVER is a real gated surface: registry resolve/advertise and the resources blurb are filtered per viewer, so discovery leaks nothing a viewer coul", "b_title": "V-1 (WORKER-TRUTH triage, operator rider): worker perches leave the DEFAULT `spt endpoint list` view \u2014 they are process-local machinery, not subnet ci", "a_doc": "resource advertisement (subnet resource registry)**: A per-endpoint **free-text blurb** describing the services/functions the endpoint can serve \u2014 an agent **yellow-pages** for service discovery, dist", "b_doc": "" }, { "pair": 148, "a_id": "REQ-ER-NOT-ADVERTISED", "b_id": "REQ-MESH-5", "a_title": "The engine room is NOT registry-advertised by default, and is advertised only to endpoints it has whitelisted (ADR-0052 decision 3). An advertised gov", "b_title": "Hard cutover from pairwise trust: delete peers.json + the is_trusted authorization path (no migration \u2014 expendable test fleet, re-pairs fresh under th", "a_doc": "Refuses all inbound except replies to its own outbound (knocks and knock-codes ARE accepted); online **only while a controller is attached** \u2014 detach drops it offline and every empowerment dies with i", "b_doc": "" }, { "pair": 149, "a_id": "REQ-MESH-1", "b_id": "REQ-MSG-6", "a_title": "Membership proof (seed-proof): symmetric current-epoch seed-knowledge replaces is_trusted at EVERY inbound gate (registry apply, WAN receive, sync, no", "b_title": "cross-node Gateway user-msg honored via advertised endpoint_type: a user-msg from a Gateway-typed origin survives the receive_wan funnel as user-msg (", "a_doc": "", "b_doc": "_Implemented posture_: the **local** user-backed origins are honored end-to-end \u2014 a locally-hosted Gateway endpoint (info.json `state=\"gateway\"`) and the local user's CLI (M9-T4/T5). The **cross-node " }, { "pair": 150, "a_id": "REQ-PEER-ROUTE-CHAIN", "b_id": "REQ-SHELL-3", "a_title": "MESH-RECOVERY W1 (ADR-0039, RCA wave 1): dial-address resolution is the ROUTE CHAIN \u2014 exact peer-cache entry, then VALIDATED RosterEntry.address (addr", "b_title": "Drive channel (owner->shell, REST-only, never-spooled, latest-wins): the owner->shell mirror of sensory for continuous real-time control (scroll/crank", "a_doc": "Decision", "b_doc": "" } ]