[ { "aDoc": "Product-surface amendment (2026-06-05 — M7 D3): ", "bTitle": "Trust lifecycle verbs, elevation-gated: spt subnet leave (membership exit) and spt subnet prune (removes a dead identity's trust + regis", "aTitle": "Guided join e2e: spt subnet join CLI initiator + always-on daemon pairing responder", "b": "REQ-SUBNET-6", "a": "REQ-SUBNET-2", "bDoc": "" }, { "aDoc": "7.40 A commune/signoff drop is deleted ONLY after every applicable tier is durably committed — an un-committable slice preserves the drop, never delete-then-lose `[REQ-HAZARD-COMMUNE-INGEST-BLACKHOLE]", "bTitle": "W4 (LIFECYCLE-TRUTH): single-flight wake per endpoint — the WAKE/RESUME respawn seam must not launch twice for one wake. ROOT (perri parentage + recov", "aTitle": "REDISPATCH-TRUTH W1 (KNOWN-HAZARDS 7.41, hertz field RCA 2026-07-16 — 4/5 endpoints frozen per brain cycle): a fresh dispatcher must NEVER re-serve a ", "b": "REQ-SPAWN-COLLISION-GUARD-LIVE-DUP", "a": "REQ-HAZARD-REDISPATCH-CONTROL-STEAL", "bDoc": "" }, { "aDoc": " **A turn closes when the endpoint goes idle — not when the next input arrives.** The moment the endpoint reports it stopped working, the trailing turn is finished: `partial` drops away and it", "bTitle": "B4 (F028, hall-b diagnosis, verified 0.22.0): `--resume` respawns a SECOND harness onto the SAME session without reaping the first. Observed live: res", "aTitle": "A digest turn's records gain their stable `seq` at the endpoint's IDLE TRANSITION — the adapter-reported, already-authoritative turn-finished signal —", "b": "REQ-RESUME-REAP-PRIOR-HARNESS", "a": "REQ-DIGEST-SEAL-ON-IDLE", "bDoc": "" }, { "aDoc": "", "bTitle": "A failed psyche turn preserves BOTH captured streams as evidence: TurnError::Failed carries the child's stdout alongside stderr, and the failure displ", "aTitle": "Windows inbound reachability: the elevated install leg registers the inbound-UDP firewall rule (New-NetFirewallRule); the daemon self-detects blocked ", "b": "REQ-PSYCHE-TURN-STREAM-EVIDENCE", "a": "REQ-INSTALL-7", "bDoc": "" }, { "aDoc": "", "bTitle": "B2 (F028, hall-b diagnosis, verified 0.22.0): respawn/`--resume` feeds the SPT session id to `claude -r`. After the 02:05 daemon bounce respawn built ", "aTitle": "`spt rc ` — user CLI attaching a local terminal to a broker-held PTY, reusing the cross-node attach machinery (attach.rs request_attach → send_att", "b": "REQ-RESUME-HARNESS-SESSION-ID", "a": "REQ-RC-1", "bDoc": "" }, { "aDoc": "", "bTitle": "Adapter-agnostic harness-hosted seed + bind-time adapter/profile resolution (ADR-0021): `api seed` carries only parent_pid + session_id (+ optional cw", "aTitle": "Adapter-injected env aliases (SPT/OWL/LIVE)", "b": "REQ-START-5", "a": "REQ-START-4", "bDoc": "Startup flows (the two topologies): **Harness-hosted (e.g. spt-plugin; the harness binary is user-launched, harness is the parent).** Key constraint: the SPT *live agent* does not exist until the agen" }, { "aDoc": "", "bTitle": "DEFERRED (post-LIFECYCLE-TRUTH, operator-ruled 2026-07-07 — mint now, impl a FUTURE milestone): make the update swap LOSSLESS for live hosted endpoint", "aTitle": "No endpoint process terminates/suspends during self-update", "b": "REQ-UPDATE-FINISH-COMMUNE-FLUSH", "a": "REQ-UPD-3", "bDoc": "" }, { "aDoc": "7.32 The effective resting state MUST be derived through ONE shared liveness-aware function — a stored-intent-alone read lies about cold perches `[REQ-EFFECTIVE-INSTANCE-STATE]`: ### 7.33 NO bare `.lo", "bTitle": "REDISPATCH-TRUTH W1 (KNOWN-HAZARDS 7.41, hertz field RCA 2026-07-16 — 4/5 endpoints frozen per brain cycle): a fresh dispatcher must NEVER re-serve a ", "aTitle": "B-1 (REMOTE-TRUTH triage §B-1, PIVOTED @e5eb99a): NO bare `.lock().unwrap()` on a broker-resident lock reachable from serve/dispatch — a brain-only se", "b": "REQ-HAZARD-REDISPATCH-CONTROL-STEAL", "a": "REQ-HAZARD-BROKER-FLOOR-LOCK-POISON", "bDoc": "7.40 A commune/signoff drop is deleted ONLY after every applicable tier is durably committed — an un-committable slice preserves the drop, never delete-then-lose `[REQ-HAZARD-COMMUNE-INGEST-BLACKHOLE]" }, { "aDoc": "", "bTitle": "Live activity buffer (session digest): projection of normalized session logs, snapshot-pull (spt endpoint digest) + structured-delta-stream contract +", "aTitle": "Deferred rows survive poll drain (4.4)", "b": "REQ-TERM-4", "a": "REQ-HAZARD-DEFERRED-SURVIVE-DRAIN", "bDoc": "" }, { "aDoc": "", "bTitle": "PresenceChannel broker endpoint (seam day-one)", "aTitle": "Messaging payloads carry typed operation commands + file blobs", "b": "REQ-EP-4", "a": "REQ-EP-3", "bDoc": "" }, { "aDoc": "", "bTitle": "F-034 leg c (perri/hertz field finding 2026-07-09): a session that goes live LATE (hours after SessionStart, or after a daemon restart) must still be ", "aTitle": "A dispatcher-SEEDED attach Request is honored ONCE — the wire replay's copy of that same Request must not re-establish it. (Seed: DAEMON-LIFECYCLE W1 ", "b": "REQ-LISTEN-SESSION-ID-FALLBACK", "a": "REQ-ATTACH-SEED-REQUEST-DOUBLE-SERVE", "bDoc": "`api seed --pid --session-id `: **Seed lifetime.** The seed lives **in the daemon's memory only** — no file — and survives until exactly one of: a successful `listen` bind consumes " }, { "aDoc": "Decision: 1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual persisted state + hosting authority — never from manifest capability alone. Legacy hybrid", "bTitle": "A clean `spt rc` attach to a LIVE spt-hosted (`endpoint run`) harness must DELIVER the harness's PTY output. KEYSTONE — the operator's central 'attach", "aTitle": "REGISTRY-LIFECYCLE W3 (ADR-0041 decision 6, operator deployah stop/run wedge): cycle verbs share ONE liveness authority — the ALREADY_LIVE dup-guard l", "b": "REQ-HAZARD-ENDPOINT-RUN-ATTACH-OUTPUT", "a": "REQ-ENDPOINT-CYCLE-HONEST", "bDoc": "" }, { "aDoc": "", "bTitle": "D-1 (REMOTE-TRUTH triage §D-1): `spt endpoint run --id ` with NO --adapter, when names an EXISTING perch, REUSES that perch's recorded info.a", "aTitle": "spt-hosted harness bringup: `spt endpoint run` spawns an adapter's `[session.self]` command template into a broker-held PTY (the spawn-session seam, b", "b": "REQ-RUN-ID-REUSES-ADAPTER", "a": "REQ-HOST-RUN-1", "bDoc": "" }, { "aDoc": "Manifest seams (outbound contract, detailed): **resume-session seam** — two distinct forms: - **fresh-with-preload:** resume with *cleared* context (a fresh session) + psyche-download. Accepts a `$psy", "bTitle": "spt-hosted startup: spawn-session then api bind (no file)", "aTitle": "Adapter-callable resume-context pull verb + not-yet-synthesized commune/signoff drop append (legacy-SPT parity, operator-directed 2026-06-24). GAP: sp", "b": "REQ-START-3", "a": "REQ-RESUME-CONTEXT-PULL", "bDoc": "" }, { "aDoc": "7.32 The effective resting state MUST be derived through ONE shared liveness-aware function — a stored-intent-alone read lies about cold perches `[REQ-EFFECTIVE-INSTANCE-STATE]`: ### 7.33 NO bare `.lo", "bTitle": "Concurrent info.json writers must serialize under the per-perch lock (5.16): an unlocked whole-record write racing a locked RMW is a silent lost updat", "aTitle": "B-1 (REMOTE-TRUTH triage §B-1, PIVOTED @e5eb99a): NO bare `.lock().unwrap()` on a broker-resident lock reachable from serve/dispatch — a brain-only se", "b": "REQ-HAZARD-INFO-RMW-LOST-UPDATE", "a": "REQ-HAZARD-BROKER-FLOOR-LOCK-POISON", "bDoc": "5.15 Fixed atomic-write tmp name → concurrent writers collide (loser renames a consumed file) `[REQ-HAZARD-ATOMIC-TMP-COLLISION]`: ### 5.16 Unlocked whole-record info.json write races a locke" }, { "aDoc": "", "bTitle": "V-2 (WORKER-TRUTH triage, operator rider): non-drivable endpoint classes never render as `spt endpoint run` picker rows — a worker perch cannot be dri", "aTitle": "B-5 (F029, operator): `spt endpoint run`'s interactive picker window/tab is untitled — hard to find among many terminals. Set the window/tab title to ", "b": "REQ-WORKER-PICKER-EXCLUDED", "a": "REQ-PICKER-WINDOW-TITLE", "bDoc": "" }, { "aDoc": "", "bTitle": "Interactive `spt endpoint run` picker (ratatui TUI): bare `spt endpoint run` (no --adapter/--id) enters an in-process picker (flags-present = the REQ-", "aTitle": "Project-scoped working directory for spt-hosted bringup: `spt endpoint run` lands the broker-spawned harness PTY in the user's PROJECT cwd, not the da", "b": "REQ-RUN-PICKER", "a": "REQ-HOST-RUN-2", "bDoc": "Shell sleep/wake (offline ↔ online): **spt-hosted bringup picker (`spt endpoint run`)** (M12-W2): The user-facing bringup flow for spt-hosted endpoints. **Bare `spt endpoint run`** (no `--ada" }, { "aDoc": "", "bTitle": "[adapter] host_binaries declares the harness executable basenames a kind=\"harness\" adapter hosts agents inside (e.g. host_binaries = [\"claude\"]); bind", "aTitle": "OS-service registration (REQ-INSTALL-1's deferred third leg): Linux systemd USER service + loginctl enable-linger (linger rides the elevated install l", "b": "REQ-MANIFEST-8", "a": "REQ-INSTALL-8", "bDoc": "Startup flows (the two topologies): **Bind-time adapter/profile resolution (ADR-0021).** Because the seed is adapter-agnostic, `listen`/`poll` resolve the owning adapter/profile when they bind, as a p" }, { "aDoc": "", "bTitle": "Direct-write precedence marker (with node id) guards stale overwrite (6.5)", "aTitle": "Drop files are daemon-owned single-writer (6.4)", "b": "REQ-HAZARD-DIRECT-WRITE-PRECEDENCE", "a": "REQ-HAZARD-DROP-FILE-SINGLE-WRITER", "bDoc": "" }, { "aDoc": "", "bTitle": "W-3 (WORKER-TRUTH triage): worker records must not persist indefinitely past their useful life — 6 dead-pid workers leaked OFFLINE on flynn (kill-path", "aTitle": "A LOCAL subnet roster entry whose backing perch is erased does NOT keep advertising Active (no phantom perch-less endpoint). `api session-end --e", "b": "REQ-WORKER-REAP", "a": "REQ-HAZARD-ROSTER-GHOST", "bDoc": "" }, { "aDoc": "Inbound `api` surface (detailed): **`spt endpoint purge `** (CLI, not `api`) — the standalone, formal **full teardown**: wipe an endpoint and *every* record keyed on it. It is the dev/CI sibling o", "bTitle": "Ephemeral perch cleanup on every ring exit path (3.1)", "aTitle": "`spt endpoint purge ` fully removes an endpoint AND every record keyed on it — the formal teardown devs/CI need for clean test setup/reset. NOT co", "b": "REQ-HAZARD-EPHEMERAL-CLEANUP", "a": "REQ-ENDPOINT-PURGE", "bDoc": "" }, { "aDoc": "5.7 Elevated commands spawn the daemon with the wrong token `[REQ-HAZARD-ELEVATED-DAEMON-SPAWN]`: ### 5.8 Console children of the console-less daemon flash visible windows `[REQ-HAZARD-CHILD-", "bTitle": "Windows at-logon autostart runs the daemon in the background with no persistent window: the scheduled task launches `spt daemon start` (which spawn_de", "aTitle": "Console-subsystem children of the console-less daemon spawn with CREATE_NO_WINDOW, or each spawn flashes a visible blank window on the user's desktop ", "b": "REQ-INSTALL-10", "a": "REQ-HAZARD-CHILD-CONSOLE-FLASH", "bDoc": "" }, { "aDoc": "", "bTitle": "Thread-spanning digest across session boundaries: a per-endpoint session ledger (`/sessions.log`) appended at first bind and by `api boundary` ", "aTitle": "C-2 (F029, SEAM-2 pinned — B6's SECOND HALF, the live-wake blocker; perri wakep9 vs wakep4 gate-state dump + doyle code trace): at a /clear, CC fires ", "b": "REQ-TERM-6", "a": "REQ-HAZARD-BOUNDARY-READY-STRAND", "bDoc": "" }, { "aDoc": "", "bTitle": "A node's gossiped per-endpoint registry Status reflects real liveness, so a remote viewer never paints a DEAD endpoint as ONLINE. ROOT (confirmed + ga", "aTitle": "B2 KEYSTONE: a daemon-hosted (spt-hosted) endpoint's info.json status is RECONCILED to real liveness, not left latched online. The broker exit-waiter ", "b": "REQ-PRESENCE-LIVENESS-TRUTH", "a": "REQ-HAZARD-HOSTED-LIVENESS-RECONCILE", "bDoc": "" }, { "aDoc": "", "bTitle": "W2/D4 (JOIN-TRUTH): the JOINER side is no longer blind to its own ceremony clock — `spt subnet join --verbose` prints the joiner's derived TOTP step, ", "aTitle": "A bound endpoint's `info.cwd` is SET at bind so a freshly-created perch appears under its own project tab. ROOT (found, v0.13.0): `info.cwd` is NEVER ", "b": "REQ-JOIN-VERBOSE-CLOCK", "a": "REQ-HAZARD-BIND-CWD-UNSET", "bDoc": "" }, { "aDoc": "", "bTitle": "A node's gossiped per-endpoint registry Status reflects real liveness, so a remote viewer never paints a DEAD endpoint as ONLINE. ROOT (confirmed + ga", "aTitle": "Daemon-hosted perches (Psyche, spt-hosted Self) derive liveness from the daemon endpoint table + info.json status, never is_process_alive(info.pid) (2", "b": "REQ-PRESENCE-LIVENESS-TRUTH", "a": "REQ-HAZARD-DAEMON-HOSTED-LIVENESS", "bDoc": "" }, { "aDoc": "Decision: 1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual persisted state + hosting authority — never from manifest capability alone. Legacy hybrid", "bTitle": "RC-RENDER-TRUTH W1 (ADR-0042 decision 2, operator-spotted second root seam): resume launch transitions an existing offline perch to UNBOUND before/wit", "aTitle": "REGISTRY-LIFECYCLE W2 (ADR-0041 decision 3, rest-normalize P0): definitive hosted-session loss normalizes TERMINALLY and ATOMICALLY — one store-level ", "b": "REQ-RESUME-UNBOUND-STAMP", "a": "REQ-REST-TERMINAL-NORMALIZE", "bDoc": "Decisions: 1. **`spt rc` consults the honest-session authority before the offline fast-fail.** Normal `spt rc ` runs the same bounded `SessionProbe::has_live_session_honest` gate `endpoin" }, { "aDoc": "", "bTitle": "Endpoint-stop and brain-death reconcile MUST reap a brain-less perch's orphan detached Psyche via the cmdline-scoped guard (`psyche_orphan_should_reap", "aTitle": "Soft-cleanup preserves state, removes only the ready marker (6.2)", "b": "REQ-HAZARD-STOP-PATH-PSYCHE-ORPHAN-REAP", "a": "REQ-HAZARD-SOFT-CLEANUP", "bDoc": "Conformance checklist (condensed): | # | Invariant | spt-core surface | |---|---|---| | 1.1 | Grace wait precedes INIT_SIGNOFF | daemon teardown | | 1.4/4.4 | Deferred rows excluded from event-stream " }, { "aDoc": "", "bTitle": "An inbound `spt send` is DELIVERED to an spt-hosted endpoint (brought up via `spt endpoint run` → `api bind`, broker holds its PTY, NO `api listen` re", "aTitle": "Local message delivery: TCP-first to a registered address, spool fallback when offline; id->address via registry (stale-clean first); reply routing (_", "b": "REQ-SEND-SPT-HOSTED", "a": "REQ-MSG-1", "bDoc": "" }, { "aDoc": "", "bTitle": "W3 (F030 hazard; paid-for: hall-bf churn ordinal 6491+ + adapter v0.13.2 bad-ship brick 2026-07-04): a psyche failure of ANY shape must NOT remove or ", "aTitle": "W4 (LIFECYCLE-TRUTH, KNOWN-HAZARDS): `api listen --parent-pid N` watches parent liveness and exits loud on parent death. ROOT (mobile-gw RCA): --paren", "b": "REQ-HAZARD-PSYCHE-RESIDENCY-EXPECTATION", "a": "REQ-HAZARD-LISTEN-ORPHAN", "bDoc": "7.29 Control/viewer stamps CONVERGE to broker session-table truth, not merely edge-trigger `[REQ-HAZARD-CONTROL-STAMP-CONVERGENCE]`: ### 7.30 A Psyche failure of ANY shape must NEVER remove or alter t" }, { "aDoc": "Decisions: 1. **One FIFO sequencer per attach sink.** The PTY drain/output writer is the sole sequencer for terminal Output and Exit: Exit is enqueued behind all prior output for each sink (d", "bTitle": "REGISTRY-LIFECYCLE W2 (KNOWN-HAZARDS 7.45 — the umbrella conformance seam for ADR-0041): endpoint lifecycle state converges to truth from EVERY death ", "aTitle": "RC-RENDER-TRUTH W3 (ADR-0043 decision 1, hertz stale-glyphs RCA leg 1 P0): the PTY drain/output writer is the SOLE FIFO sequencer for terminal Output ", "b": "REQ-HAZARD-ENDPOINT-LIFECYCLE", "a": "REQ-BROKER-OUTPUT-BEFORE-EXIT", "bDoc": "7.44 Streams and seats on a long-lived connection must have bounded lifetime — one-way rows terminal at FIN, seats released at serve completion, no per-chunk full-state rewrites in a drain loop `[REQ-" }, { "aDoc": "", "bTitle": "Control/viewer stamps must CONVERGE to broker session-table truth for every session-backed endpoint, not merely edge-trigger — the UPWARD companion to", "aTitle": "A bound endpoint's `info.cwd` is SET at bind so a freshly-created perch appears under its own project tab. ROOT (found, v0.13.0): `info.cwd` is NEVER ", "b": "REQ-HAZARD-CONTROL-STAMP-CONVERGENCE", "a": "REQ-HAZARD-BIND-CWD-UNSET", "bDoc": "7.28 A relative manifest path resolves against the ENDPOINT, never the daemon `[REQ-STORE-CONTEXT-BRANCH-FILL]`: ### 7.29 Control/viewer stamps CONVERGE to broker session-table truth, not mer" }, { "aDoc": "The daemon: broker and brain: …with one exception, because you are allowed to mean it: **`spt daemon stop` sticks.** Auto-start is a convenience, and a convenience never overrules an explicit", "bTitle": "TEARDOWN-AUTHORITY W1 HAZARD (ADR-0045 decision 8; hertz RCA 2 — hit doyle's OWN live production endpoint, recoverable only by out-of-band scoped kill", "aTitle": "An operator stop outranks every implicit daemon ensure. (ADR-0047 decision 2, AMENDING REQ-DAEMON-3's anchor; hertz v0.39.4 field bug 2, RCA accepted ", "b": "REQ-HAZARD-TEARDOWN-DEADEND", "a": "REQ-ENSURE-DAEMON-STOP-INHIBIT", "bDoc": "7.48 At most one input-capable controller lease per PTY session — takeover revokes atomically and loudly, input is fenced to the active lease, node identity is never a lease `[REQ-HAZARD-CONTROLLER-LE" }, { "aDoc": "", "bTitle": "Public SDK surface is spt-proto, spt-runtime, spt-msg", "aTitle": "Many small acyclically-layered crates", "b": "REQ-ARCH-2", "a": "REQ-ARCH-1", "bDoc": "" }, { "aDoc": "Decisions: 1. **Distinct viewport/lease identity.** Each rc invocation/attach stream mints a unique controller lease id, carried through SubscribeReq, the controller slot, and Input/Resize. N", "bTitle": "Remote-attach controller/viewer model (CONTEXT.md:317): a session's broker OutputLog serves ONE interactive controller (input + EXCLUSIVE PTY resize; ", "aTitle": "RC-RENDER-TRUTH W2 (ADR-0044 decisions 1+2, hertz same-machine --take split-brain RCA P0-A/B, doyle seam-verified broker.rs resolve_subscribe 1296-131", "b": "REQ-RCVIEW-1", "a": "REQ-CONTROLLER-LEASE-IDENTITY", "bDoc": "Shell sleep/wake (offline ↔ online): **BUILT (M12 W2.5).** The controller/viewer model is implemented end-to-end. Attach intent is **three-valued** (`AttachIntent = Viewer | Control | Take`, " }, { "aDoc": "Echo-commune — the I/O contract: - **Failure (paid-for, found by todlando during TEARDOWN-AUTHO" }, { "aDoc": "", "bTitle": "REGISTRY-LIFECYCLE W1 (ADR-0040 decision 2, hertz defect B leg 2): broker stream_infos excludes initiated_locally rows SERVER-SIDE (retired already ex", "aTitle": "#4: remote endpoint details (harness + project history) are gossiped, not faked. Today from_resource_row (crates/spt/src/picker/model.rs:340) hardcode", "b": "REQ-STREAM-INFOS-SERVER-FILTER", "a": "REQ-GOSSIP-ADAPTER-PROJECTS", "bDoc": "" }, { "aDoc": "", "bTitle": "Anti-drift: rustdoc/schema/exports/CLI-help generated + CI-checked", "aTitle": "CI (operator-ruled 2026-07-16, from PR #8 review): a PR whose ENTIRE diff is Markdown OUTSIDE docs-site/ runs THIN CI — the heavy build/test jobs (tes", "b": "REQ-DOCS-5", "a": "REQ-CI-DOCS-ONLY-THIN", "bDoc": "" }, { "aDoc": "`[env]` — env-var table: **`direction = \"read\"` — capture a launch-env var for template substitution.** A `read` directive names an environment variable spt-core **captures from the session's", "bTitle": "Durable active-profile pointer for bind-time profile selection (ADR-0021): adapters/active-profiles.toml at the registry ROOT (sibling to the per-adap", "aTitle": "Bug #17: spt endpoint digest returns NO_DIGEST for a ccs-profile endpoint (claude-spt:ccs) though [digest] is wired and the transcript exists — under ", "b": "REQ-INSTALL-12", "a": "REQ-DIGEST-PROFILE-ENV", "bDoc": "Startup flows (the two topologies): **Bind-time adapter/profile resolution (ADR-0021).** Because the seed is adapter-agnostic, `listen`/`poll` resolve the owning adapter/profile when they bind, as a p" }, { "aDoc": "", "bTitle": "SEED (inactive — observability, perri-backed 2026-07-26): a status a reader can act on should be distinguishable from a status a record actually holds", "aTitle": "A6 (F028, operator, 4 asks): `spt endpoint list` render polish. (a) the 'Shared subnets' line is NOT dim — LIGHT_GRAY = \"37\" (cli.rs:3019) is standard", "b": "REQ-SHELL-LIST-DERIVED-PROVENANCE", "a": "REQ-ENDPOINT-LIST-RENDER-POLISH", "bDoc": "" }, { "aDoc": "", "bTitle": "Resuming an endpoint session that HAS conversation history brings up a BLANK session. ROOT (doyle, code-grounded + CONTEXT — case-3 spt-core MISSING f", "aTitle": "Project-scoped working directory for spt-hosted bringup: `spt endpoint run` lands the broker-spawned harness PTY in the user's PROJECT cwd, not the da", "b": "REQ-SESSION-RESUME-TEMPLATE", "a": "REQ-HOST-RUN-2", "bDoc": "`[session.]` — outbound templates: **Resuming an existing harness session (since v0.13.0).** `[session.self]` is the *fresh* bringup; `[session.resume]` is the **native-resume** sibling" }, { "aDoc": "", "bTitle": "Bugs #11 + #15 (display): spt endpoint list renders status as plain text while the picker turns the same ResourceRow into the W5 colored EpDisplay pal", "aTitle": "User-facing CLI output is human-readable: DIRECT-USER commands (e.g. adapter update/list/use) render friendly prose instead of raw CODE:RESULT markers", "b": "REQ-ENDPOINT-LIST-PALETTE", "a": "REQ-CLI-4", "bDoc": "" }, { "aDoc": "Instances: **Remote-control vs local operation (two distinct modes — not the same as instances):** - **Operate locally:** drive the native instance on *your* machine (its local files, its syn", "bTitle": "`spt rc` overlays a persistent endpoint-identity marker so the operator always groks which endpoint they control: a reserved TOP status row via a DECS", "aTitle": "Bug #4: spt rc to a remote endpoint fails with 'no live session' though endpoint list shows it Active — rc.rs:1063 resolves only the LOCAL broker sess", "b": "REQ-RC-IDENTITY", "a": "REQ-RC-CROSS-NODE-ATTACH", "bDoc": "" }, { "aDoc": "", "bTitle": "inject-input methods configurable per activity-state", "aTitle": "Activity/idle reported via api sentinels, not PTY quiescence", "b": "REQ-SEAM-INJECT", "a": "REQ-SEAM-ACTIVITY", "bDoc": "" }, { "aDoc": "Decision: 1. **One-way (fire-and-forget) stream families are terminal at FIN, sender-side.** The registry feed pump retires its own row after successful write+FIN via the existing `net-stream", "bTitle": "RESCOPED at W2 activation 2026-07-22 (doyle verify-first, C3-retirement precedent): the CLEAN-CASE chain this REQ was minted for is ALREADY SHIPPED un", "aTitle": "REGISTRY-LIFECYCLE W1 (ADR-0040 decision 1, hertz defect B leg 1): a one-way fire-and-forget stream family is TERMINAL at successful FIN, sender-side ", "b": "REQ-STREAM-LIFETIME-CLASS", "a": "REQ-ONEWAY-STREAM-TERMINAL", "bDoc": "Amendment 1 (2026-07-22, DAEMON-LIFECYCLE W2) — teardown authority is opener-declared class PLUS transport liveness, enforced at the three places decision 6 could not see: " }, { "aDoc": "Runtime model: **adapter profile** (ratified 2026-06-11, Gateway grill; future spt-core milestone — first beneficiaries `spt-claude-code` and the usbip shell): A named **sparse overlay** on i", "bTitle": "D-2 (REMOTE-TRUTH triage §D-2 + operator Q5 @c248afc): the session ledger records the adapter[:profile] a session ran under, so a later resume can res", "aTitle": "Adapter profiles — sparse leaf-replace overlays (shipped + local), composite : addressing, shadow-refusal, tighten-only consent floo", "b": "REQ-SESSION-ADAPTER-RECORDED", "a": "REQ-MANIFEST-2", "bDoc": "" }, { "aDoc": "", "bTitle": "Bug #2: a remote node endpoint count drifts (0/2, 1/3) because node_status_rows (cli.rs:5314) increments the per-node total unconditionally, counting ", "aTitle": "Trust lifecycle verbs, elevation-gated: spt subnet leave (membership exit) and spt subnet prune (removes a dead identity's trust + regis", "b": "REQ-SUBNET-COUNT-ROUTABLE", "a": "REQ-SUBNET-6", "bDoc": "" }, { "aDoc": "3. The equal-generation rung is idempotent for the same connection: ", "bTitle": "TOTP-seeded SPAKE2 pairing", "aTitle": "The equal-generation lease rung is idempotent for the same connection. (ADR-0047 decision 3, AMENDING ADR-0044's ladder inside the equal-gen rung; her", "b": "REQ-PAIR-1", "a": "REQ-ATTACH-IDEMPOTENT-REPLAY", "bDoc": "" }, { "aDoc": "", "bTitle": "W-2 (WORKER-TRUTH triage, operator-ruled 2026-07-06): worker verbs go sid-symmetric with every sibling id-scoped verb — worker-start mints NO token an", "aTitle": "Ed25519 identity primitive: keypair, detached sign/verify, stable pubkey<->hex", "b": "REQ-WORKER-SID-SYMMETRIC-AUTH", "a": "REQ-NODE-IDENTITY", "bDoc": "`api worker-start [--agent-id ] [--agent-type ]`: ### `api worker-stop --session-id ` · `api worker-poll --session-id `" }, { "aDoc": "", "bTitle": "MUSL-TIER W3 (CI build + signed release + update-set publish + self-update E2E): release.yml gains a musl matrix entry (build on kitsubito; install mu", "aTitle": "MUSL-TIER W2 (register the musl platform, self-IDENTIFY): add x86_64-unknown-linux-musl to the W1 registry — a current_platform() cfg arm (target_arch", "b": "REQ-RELEASE-MUSL-ARTIFACT", "a": "REQ-PLATFORM-MUSL", "bDoc": "" }, { "aDoc": "Conformance checklist (condensed): | # | Invariant | spt-core surface | |---|---|---| | 1.1 | Grace wait precedes INIT_SIGNOFF | daemon teardown | | 1.4/4.4 | Deferred rows excluded from event-stream ", "bTitle": "The picker renders a FOUR-state endpoint status (extending the W2 online/offline duality): the list-item square AND a color-coded STATUS line at the t", "aTitle": "A shell instance's ONLINE-ness is DERIVED (recorded status AND its recorded `shell.pid` not provably dead), never the recorded `status` field alone — ", "b": "REQ-PICKER-1", "a": "REQ-HAZARD-SHELL-STALE-ONLINE", "bDoc": "" }, { "aDoc": "", "bTitle": "Stale registry entries degrade to fallback, never hard-fail (4.3)", "aTitle": "Sweep stale lockfiles on daemon boot (1.3)", "b": "REQ-HAZARD-REGISTRY-STALE-CLEAN", "a": "REQ-HAZARD-STALE-INDEX-LOCK", "bDoc": "" }, { "aDoc": "", "bTitle": "Single source of truth for Worker/Psyche perch location (1.5)", "aTitle": "A LOCAL subnet roster entry whose backing perch is erased does NOT keep advertising Active (no phantom perch-less endpoint). `api session-end --e", "b": "REQ-HAZARD-WORKER-PATH", "a": "REQ-HAZARD-ROSTER-GHOST", "bDoc": "" }, { "aDoc": "", "bTitle": "Agent endpoints vs Shells distinction in the type model", "aTitle": "Day-one endpoint types; open type system", "b": "REQ-EP-2", "a": "REQ-EP-1", "bDoc": "" }, { "aDoc": "7.50 The liveness oracle answers from the process table, never from a handle a caller still holds `[REQ-LIVENESS-ORACLE-SOUND]`: - **Failure (paid-for, found by todlando during TEARDOWN-AUTHO", "bTitle": "A node's gossiped per-endpoint registry Status reflects real liveness, so a remote viewer never paints a DEAD endpoint as ONLINE. ROOT (confirmed + ga", "aTitle": "TEARDOWN-AUTHORITY W2 (todlando W1 gate-round-0 finding, doyle-scoped from the LANDED W1 code 2026-07-19): 'does this pid still exist' has ONE answer ", "b": "REQ-PRESENCE-LIVENESS-TRUTH", "a": "REQ-LIVENESS-ORACLE-SOUND", "bDoc": "" }, { "aDoc": "", "bTitle": "During a resize transition, LIVE DELIVERY is barriered along with the grid parse: no attached sink (controller or viewer) ever receives mixed-geometry", "aTitle": "B5 (F028, perri F-a; DEFECT daemon, OBSERVED-ONCE, HIGH): the peer pump STALLS under rapid rc attach/EOF-detach/--take churn. Fresh 0.22.0 daemon ~10m", "b": "REQ-RC-RESIZE-PRESENTATION-BARRIER", "a": "REQ-PEER-PUMP-CHURN-STALL", "bDoc": " 1. **One-way (fire-and-forget) stream families are terminal at FIN, sender-side.** The registry feed pump retires its own row after successful write+FIN via the existing `net-stream" }, { "aDoc": "Always-on endpoints: resident supervised adapter binaries, `#`-sigil addressed: ", "bTitle": "cross-node Gateway user-msg honored via advertised endpoint_type: a user-msg from a Gateway-typed origin survives the receive_wan funnel as user-msg (", "aTitle": "`#` always-on address sigil: a reserved LEADING sigil marking an AlwaysOnEndpoint, extending the REQ-INST-10 grammar to `[subnet:]#id[@node]`. Mandato", "b": "REQ-MSG-6", "a": "REQ-EP-9", "bDoc": "Endpoint types: _Implemented posture_: the **local** user-backed origins are honored end-to-end — a locally-hosted Gateway endpoint (info.json `state=\"gateway\"`) and the local user's CLI (M9-" }, { "aDoc": "", "bTitle": "A5 (F028, operator #6): resume-from-history labels EVERY session with the endpoint's newest project. data.rs:480-496 resume_rows_for clones project_hi", "aTitle": "A LOCAL subnet roster entry whose backing perch is erased does NOT keep advertising Active (no phantom perch-less endpoint). `api session-end --e", "b": "REQ-RESUME-ROW-PER-PROJECT", "a": "REQ-HAZARD-ROSTER-GHOST", "bDoc": "" }, { "aDoc": "Release runbook: ", "bTitle": "Two-key release-signing trust anchor: primary + offline never-used recovery, both pubkeys embedded in the binary's trusted set, manual local signing (", "aTitle": "Release asset set consumable by the self-updater: platform binaries, SHA256SUMS, SignedRelease metadata, manifest schema, mock-adapter zip; tag-trigge", "b": "REQ-REL-3", "a": "REQ-REL-2", "bDoc": "" }, { "aDoc": "", "bTitle": "spawn-psyche seam (fresh + resume templates)", "aTitle": "Hard cutover from pairwise trust: delete peers.json + the is_trusted authorization path (no migration — expendable test fleet, re-pairs fresh under th", "b": "REQ-SEAM-PSYCHE", "a": "REQ-MESH-5", "bDoc": "" }, { "aDoc": "", "bTitle": "session-surface abstraction; send-keys + send-line injection", "aTitle": "Drive channel (owner->shell, REST-only, never-spooled, latest-wins): the owner->shell mirror of sensory for continuous real-time control (scroll/crank", "b": "REQ-TERM-2", "a": "REQ-SHELL-3", "bDoc": "" }, { "aDoc": "", "bTitle": "A VIEW is independent from the endpoint: closing the tab/window where `spt endpoint run` was invoked must detach ONLY the `spt rc` attach pump — the d", "aTitle": "On un-host, the detached `{id}-psyche` HARNESS PROCESS is reaped — not just its in-brain pulse-driver thread. Today stop_host (livehost.rs:203) trips ", "b": "REQ-HAZARD-VIEWER-CLOSE-DETACH", "a": "REQ-HAZARD-UNHOST-PSYCHE-REAP", "bDoc": "Terminal wrapper: **A view is independent from the endpoint** (invariant): An spt-hosted endpoint runs in a **daemon-owned PTY, decoupled from whatever terminal launched it**. Closing the tab" }, { "aDoc": "Startup defaults (`endpoint run --save`): Infrastructure endpoints (a gateway the phone treats as always-there) should not need hands-on bringup after a box reboot or daemon restart. `spt end", "bTitle": "THE-FORKENING W1 (ADR-0036 §3, bootstrap shape b operator-ruled): virgin-box install = `gh release download` the platform binary + ONE self-install ve", "aTitle": "MSG-IDENTITY W5 / F-038 (flynn operator-directed ask 2026-07-10, SPT-CORE-NEEDS #7 + deployah field-confirm same day: mobile-gw alive=false after the ", "b": "REQ-INSTALL-BOOTSTRAP-VERB", "a": "REQ-ENDPOINT-AUTOSTART", "bDoc": "Installation: **Installer form (gh bootstrap, ADR-0036):** install gh → `gh auth login` (org membership) → `gh release download` the platform binary from the private channel → one **self-install verb*" }, { "aDoc": "", "bTitle": "RULED DESIGN, delivery unowned (doyle 2026-07-26): when a caller hands identity resolution an EXPLICIT non-empty $OWL_SESSION_ID that resolves to NO p", "aTitle": "MSG-IDENTITY W6 / F-039 (deployah field-acceptance follow-up 2026-07-10, RCA-FIRST — mint per the v0.30.6 PASS handoff): ambient CONN_WRITE_POISONED l", "b": "REQ-WHOAMI-EXPLICIT-SID-REFUSAL", "a": "REQ-CONN-POISON-DIAL-SCOPE", "bDoc": "" }, { "aDoc": "Live, daemon-coordinated adapter update: // Amendment (W3 build, 2026-06-22): ", "bTitle": "THE-FORKENING W4 (operator-grilled 2026-07-14): `spt update adapters [[,...]]` = thin ALIAS over the existing `spt adapter update` engine (cli.r", "aTitle": "An adapter update is live and daemon-coordinated (the adapter analog of brain self-update, ADR-0004): for an endpoint with a running RESIDENT adapter ", "b": "REQ-UPDATE-ADAPTERS-VERB", "a": "REQ-ADAPTER-LIVE-UPDATE", "bDoc": "Self-update: **update composite (`spt update`)** — the plain verb is the primary form: `update fetch --apply` then `update adapters` (core-first order); with core already current, only adapters update" }, { "aDoc": "", "bTitle": "Bug #12: `spt rc` to an endpoint renders ANSI escapes LITERALLY (raw ←[K / color codes) on a Win10 conhost console, garbling the viewport — while `end", "aTitle": "Bugs #14 + #7/#8 (marker half): feature-flag the top-right StatusRow endpoint-id marker OFF (rc.rs:198-307). It is a one-shot absolutely-positioned pa", "b": "REQ-RC-WIN-VT-OUTPUT", "a": "REQ-RC-IDMARKER-DISABLE", "bDoc": "" }, { "aDoc": "Cold-start multi-session resume (restoration D4-2, ADR-0018 Q6): query the broker for **every** hosted session and re-attach **each** in resume mode from the broker's per-session delivered cursor (`re", "bTitle": "Peer-propagated update over P2P", "aTitle": "UPDATE-WEDGE round 3 (v0.30.5, doyle-ruled Option A 2026-07-09 — the v0.30.4 field-verify re-wedge, root code-PROVEN + dead-peer-INDEPENDENT): the dae", "b": "REQ-UPD-1", "a": "REQ-BRAIN-RESUME-NO-CONN-DEADLOCK", "bDoc": "" }, { "aDoc": "Shell model (detailed): **per-capability approval gates** (ratified 2026-06-11, Gateway grill): the same `require_approval` enum may ride **individual capability entries** in a shell manifest", "bTitle": "Bug #4: spt rc to a remote endpoint fails with 'no live session' though endpoint list shows it Active — rc.rs:1063 resolves only the LOCAL broker sess", "aTitle": "Per-capability approval gates (class-keyed): the require_approval enum may ride INDIVIDUAL [shell.capabilities] entries — gating the dangerous ACT, no", "b": "REQ-RC-CROSS-NODE-ATTACH", "a": "REQ-CONSENT-3", "bDoc": "Instances: **Remote-control vs local operation (two distinct modes — not the same as instances):** - **Operate locally:** drive the native instance on *your* machine (its local files, its syn" }, { "aDoc": "", "bTitle": "Idempotent/exactly-once delivery across brain restart at every broker boundary (codex #14)", "aTitle": "No double-delivery via legacy inbox (4.5)", "b": "REQ-HAZARD-RESTART-IDEMPOTENT", "a": "REQ-HAZARD-INBOX-NO-DOUBLE", "bDoc": "" }, { "aDoc": "Context: ## Decision ", "bTitle": "RESCOPED at W2 activation 2026-07-22 (doyle verify-first, C3-retirement precedent): the CLEAN-CASE chain this REQ was minted for is ALREADY SHIPPED un", "aTitle": "REDISPATCH-TRUTH W1 (ADR-0038, hertz fix A): finished/terminal stream rows are RETIRED from redispatch eligibility — NetShared.streams today has NO re", "b": "REQ-STREAM-LIFETIME-CLASS", "a": "REQ-REDISPATCH-FINISHED-RETIRE", "bDoc": "Amendment 1 (2026-07-22, DAEMON-LIFECYCLE W2) — teardown authority is opener-declared class PLUS transport liveness, enforced at the three places decision 6 could not see: " }, { "aDoc": "Restoration field-run evidence (D7-4) — the seamless-update acceptance: ", "bTitle": "All binaries signature-verified before handoff", "aTitle": "Broker/brain split for seamless self-update", "b": "REQ-UPD-2", "a": "REQ-DAEMON-2", "bDoc": "" }, { "aDoc": "", "bTitle": "THE-FORKENING W1 (ADR-0036 §3, bootstrap shape b operator-ruled): virgin-box install = `gh release download` the platform binary + ONE self-install ve", "aTitle": "Linux elevation install leg: install.sh symlinks the binary into a sudo-reachable path (/usr/local/bin; graceful print-the-one-liner when unelevated) ", "b": "REQ-INSTALL-BOOTSTRAP-VERB", "a": "REQ-INSTALL-6", "bDoc": "Installation: **Installer form (gh bootstrap, ADR-0036):** install gh → `gh auth login` (org membership) → `gh release download` the platform binary from the private channel → one **self-install verb*" }, { "aDoc": "", "bTitle": "#5: after 'Start now' in the endpoint picker, swap the bottom Options panel to a 'Choose project' list: (1) the endpoint's most recent project dir, (2", "aTitle": "C-2 (REMOTE-TRUTH triage §C-2 #4 + addendum @3442ce5): a REMOTE suspended picker row offers `Wake now` — waking the endpoint THROUGH its owning node's", "b": "REQ-PICKER-START-PROJECT-CHOICE", "a": "REQ-PICKER-REMOTE-WAKE", "bDoc": "" }, { "aDoc": "5.14 Corrupt info.json read as ABSENT → fail-open readers gossip a wiped perch ONLINE `[REQ-HAZARD-CORRUPT-PERCH-COHERENCE]`: ### 5.15 Fixed atomic-write tmp name → concurrent writers collide", "bTitle": "Windows test fixtures MUST NOT leak their temp dirs — find and fix the leak that accumulated 14,319 `.tmp*` dirs (163 GB) in %TEMP% on hfenduleam over", "aTitle": "Concurrent atomic writers to the same target must not share a tmp name (5.15): a fixed tmp sibling makes one writer's rename consume the other's stage", "b": "REQ-TEST-TMPDIR-HYGIENE", "a": "REQ-HAZARD-ATOMIC-TMP-COLLISION", "bDoc": "" }, { "aDoc": "", "bTitle": "Per-machine re-pair trust overwrite: registry rows carry a hashed stable machine identifier (OS machine id /etc/machine-id|MachineGuid, domain-separat", "aTitle": "Hard cutover from pairwise trust: delete peers.json + the is_trusted authorization path (no migration — expendable test fleet, re-pairs fresh under th", "b": "REQ-SUBNET-7", "a": "REQ-MESH-5", "bDoc": "" }, { "aDoc": "Decision: 1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual persisted state + hosting authority — never from manifest capability alone. Legacy hybrid", "bTitle": "On an endpoint's ACTIVE→IDLE transition the daemon DRAINS its pending spool (deferred AND non-deferred) through the same shared spt-hosted inject leg ", "aTitle": "REGISTRY-LIFECYCLE W2 (ADR-0041 decisions 1+2, emphasys C1 P0): ONLINE is earned, not declared — cmd_listen stamps status=online only from actual pers", "b": "REQ-MSG-IDLE-EDGE-DRAIN", "a": "REQ-ENDPOINT-ONLINE-TRUTH", "bDoc": "" }, { "aDoc": "", "bTitle": "Broker/brain IPC + handoff argv version-tolerant (2.3)", "aTitle": "Wire-protocol version independent of crate semver, N-1 compat window", "b": "REQ-HAZARD-HANDOFF-ARGV-COMPAT", "a": "REQ-ARCH-3", "bDoc": "" }, { "aDoc": "", "bTitle": "Ephemeral perch cleanup on every ring exit path (3.1)", "aTitle": "Soft-cleanup preserves state, removes only the ready marker (6.2)", "b": "REQ-HAZARD-EPHEMERAL-CLEANUP", "a": "REQ-HAZARD-SOFT-CLEANUP", "bDoc": "" }, { "aDoc": "", "bTitle": "Single path/registry source of truth; no layout ambiguity (6.1)", "aTitle": "No hard-delete of a parent hosting non-empty children (6.3)", "b": "REQ-HAZARD-SINGLE-PATH-SOURCE", "a": "REQ-HAZARD-CASCADE-WIPE-GUARD", "bDoc": "" }, { "aDoc": "2. Supersession: a required-namespaced coalesce key, latest-wins: ", "bTitle": "RULING OWED (unratified — do NOT satisfy without one): may a shell adapter own a DETACHED process that deliberately OUTLIVES its shell's link-break? T", "aTitle": "Coalesce-key supersession: producer-stamped key REQUIRED in namespaced form : (e.g. spt-core:update-staged) — the produce front door rejec", "b": "REQ-SHELL-ADAPTER-OWNED-DETACHED-SERVICE", "a": "REQ-NOTIF-COALESCE", "bDoc": "" }, { "aDoc": "", "bTitle": "Stale signoff sentinel does not kill a fresh start (3.2)", "aTitle": "GATEWAY-LIVENESS DEFECT A (flynn field bug 2026-07-09, confirmed independent): a re-bind MUST preserve the daemon-owned resting intent (rest_state, D9", "b": "REQ-HAZARD-STALE-SIGNOFF-SENTINEL", "a": "REQ-HAZARD-BIND-REST-STATE-CARRY", "bDoc": "" }, { "aDoc": "", "bTitle": "Thread-spanning digest across session boundaries: a per-endpoint session ledger (`/sessions.log`) appended at first bind and by `api boundary` ", "aTitle": "#10 (F026 micro): `spt | ` must not PANIC when stdout closes early. A closed downstream reader mid-print panics with ", "b": "REQ-TERM-6", "a": "REQ-CLI-BROKEN-PIPE-TOLERANT", "bDoc": "" }, { "aDoc": "Decision: 1. **Online is earned, not declared.** A creator may stamp `status=online` only from actual persisted state + hosting authority — never from manifest capability alone. Legacy hybrid", "bTitle": "W1 (F030, design §3): each psyche-relevant event runs exactly ONE bounded per-event turn through the existing driver stack (psyche_turn_and_relay for ", "aTitle": "REGISTRY-LIFECYCLE W3 (ADR-0041 decision 6, operator deployah stop/run wedge): cycle verbs share ONE liveness authority — the ALREADY_LIVE dup-guard l", "b": "REQ-PSYCHE-EPHEMERAL-DRIVER", "a": "REQ-ENDPOINT-CYCLE-HONEST", "bDoc": "Endpoint types: **Psyche**: The Psyche companion's own perch, distinct from its paired LiveAgent's perch. First-class endpoint type so messages addressed to a LiveAgent's Psyche route directly without" }, { "aDoc": "", "bTitle": "No double-delivery via legacy inbox (4.5)", "aTitle": "REGISTRY-LIFECYCLE W4 fast-follow (hertz v0.37.0 field-verify CPU-gate FAIL RCA 2026-07-17, doyle seam-verified same day; timing-pinned ~16s burst clu", "b": "REQ-HAZARD-INBOX-NO-DOUBLE", "a": "REQ-GOSSIP-PROJECT-DERIVE-ONCE", "bDoc": "" }, { "aDoc": "", "bTitle": "ConPTY reader must auto-answer DSR (ESC[6n) or all child output stalls (5.5)", "aTitle": "TEARDOWN-AUTHORITY W3 rider (hertz RCA 2026-07-19): a Device Status Report query yields EXACTLY ONE Cursor Position Report. Rides W3 because it is the", "b": "REQ-HAZARD-CONPTY-DSR", "a": "REQ-DSR-SINGLE-CPR", "bDoc": "" }, { "aDoc": "Decision: 1. **One FIFO sequencer per attach sink.** The PTY drain/output writer is the sole sequencer for terminal Output and Exit: Exit is enqueued behind all prior output for each sink (d" }, { "aDoc": "4.7 Concurrent SQLite openers must not fail with \"database is locked\": ### 4.8 Registry merge ordered by epoch, never wall-clock (red-team #8) - **Failure:** the per-subnet registry replicate", "bTitle": "RETIRED at W2 verify-first (doyle 2026-07-22): the C3 poll-vs-reap ordering race (hertz emphasys RCA 2026-07-16, P1) was ALREADY CLOSED by REQ-CONTROL", "aTitle": "Registry merge ordered by per-node monotonic epoch, never wall-clock — a stale Active can't clobber a newer Offline (4.8, red-team #8)", "b": "REQ-STAMP-CONVERGENCE-ORDER", "a": "REQ-HAZARD-REGISTRY-EPOCH-LEASE", "bDoc": "" }, { "aDoc": "`shell_text` — free text: ## `shell_file` — a landed file", "bTitle": "THE-FORKENING W4 (operator-grilled 2026-07-14): plain `spt update` = `update fetch --apply` THEN `update adapters` (core-first doctrine order); when c", "aTitle": "A shell binary can mechanically resolve where its files land. (flynn spt-alchemy clean-room audit 2026-07-21, doyle code-verified, seed pair item 2, P", "b": "REQ-UPDATE-DEFAULT-COMPOSITE", "a": "REQ-SHELL-PERCH-DIR", "bDoc": "Self-update: **update composite (`spt update`)** — the plain verb is the primary form: `update fetch --apply` then `update adapters` (core-first order); with core already current, only adapters update" }, { "aDoc": "Shell sleep/wake (offline ↔ online): **BUILT (M12 W2.5).** The controller/viewer model is implemented end-to-end. Attach intent is **three-valued** (`AttachIntent = Viewer | Control | Take`, ", "bTitle": "REDISPATCH-STALL W1 (ADR-0038 Amendment, fix 6): terminal-exclusion enforced PRE-SERVE + ownership/generation validation on attach/detach — a stale wo", "aTitle": "Remote-attach controller/viewer model (CONTEXT.md:317): a session's broker OutputLog serves ONE interactive controller (input + EXCLUSIVE PTY resize; ", "b": "REQ-SERVE-OWNERSHIP-GENERATION", "a": "REQ-RCVIEW-1", "bDoc": "Consequences: ## Amendment — REDISPATCH-STALL (2026-07-16) " }, { "aDoc": "", "bTitle": "W4 (F030, design §3; F-017 sibling, general not psyche-only): nested {parent}/{nested} ids resolve under the PARENT's home — subnet-less resolution fo", "aTitle": "Bug #13: the endpoint run Subnet tab shows a machine once PER shared subnet (subnet_rows data.rs:253 iterates per-subnet, groups by subnet:node, no cr", "b": "REQ-PSYCHE-NESTED-RESOLUTION", "a": "REQ-PICKER-NODE-GROUPING", "bDoc": "then it exits — no resident process, no detach.: **`{subnet}` — the endpoint's home-subnet label.** A single `{subnet}` key fills to this endpoint's home-subnet label (`local` when unhomed), " }, { "aDoc": "", "bTitle": "TEARDOWN-AUTHORITY W1 (ADR-0045; two hertz field RCAs 2026-07-19, doyle code-verified + ruled): ONE shared topology-aware broker-teardown primitive be", "aTitle": "SEED (DEFERRED, doyle 2026-07-09 — post-counter-54 root-hardening for UPDATE-WEDGE; mint now, impl a FUTURE milestone): on a PLANNED brain-restart (`B", "b": "REQ-ENDPOINT-TEARDOWN-AUTHORITY", "a": "REQ-BRAIN-UPDATE-RESTART-CLEAN-CLOSE", "bDoc": "7.48 At most one input-capable controller lease per PTY session — takeover revokes atomically and loudly, input is fenced to the active lease, node identity is never a lease `[REQ-HAZARD-CONTROLLER-LE" }, { "aDoc": "Consequences: ## Amendment — REDISPATCH-STALL (2026-07-16) ", "bTitle": "PUMP-TRUTH W1 (RE-SCOPED post round-2 empirical lock — the DIAL is EXONERATED, healthy ~100ms): a pump worker-leg PEER-REPLY read to a connect-then-si", "aTitle": "REDISPATCH-STALL W1 (ADR-0038 Amendment, fixes 1+5): the opener ring-peek fallback fires ONLY on the explicit UnsupportedVerb/old-broker answer — tran", "b": "REQ-PUMP-DIAL-FASTFAIL", "a": "REQ-DISPATCH-FALLBACK-CIRCUIT", "bDoc": "" }, { "aDoc": "", "bTitle": "C2 (F028, infra; ROOT-CAUSED + severity-upgraded doyle RCA 2026-07-03): cross-endpoint perch contamination — a foreign psyche's SessionStart hook REBI", "aTitle": "The brain's daemon-hosted Psyche lifecycle surfaces a host-FAILURE on the live perch (harness-diagnosable) and runs net-INDEPENDENTLY. When reconcile_", "b": "REQ-SESSIONS-LOG-ENDPOINT-ATTRIBUTION", "a": "REQ-HAZARD-LIVEHOST-BOOT-RACE", "bDoc": "" }, { "aDoc": "", "bTitle": "tmp-write + atomic-rename + retry on Windows EBUSY (5.2)", "aTitle": "ConPTY reader must auto-answer DSR (ESC[6n) or all child output stalls (5.5)", "b": "REQ-HAZARD-EBUSY-RENAME", "a": "REQ-HAZARD-CONPTY-DSR", "bDoc": "" }, { "aDoc": "", "bTitle": "Home-subnet selection LAYER in the `spt endpoint run` ratatui Create-new picker (v0.14.1; the deferred half of REQ-RUN-MULTISUBNET-HOME's interactive ", "aTitle": "`spt endpoint run` / bare `spt` routes a TOTALLY-EMPTY scope straight to the endpoint-creation flow: when gather_endpoints() is empty (nothing attacha", "b": "REQ-RUN-PICKER-HOME", "a": "REQ-RUN-EMPTY-CREATE", "bDoc": "Shell sleep/wake (offline ↔ online): **spt-hosted bringup picker (`spt endpoint run`)** (M12-W2): The user-facing bringup flow for spt-hosted endpoints. **Bare `spt endpoint run`** (no `--ada" }, { "aDoc": "6.6 Surfaced context conflicts preserve both versions until dominated: ### 6.7 Broker and brain MUST be separate processes (in-process collapse silently breaks no-endpoint-drop update) `[REQ-HAZARD-BR", "bTitle": "Idempotent/exactly-once delivery across brain restart at every broker boundary (codex #14)", "aTitle": "Broker and brain are separate processes: the broker runs as its own long-lived per-machine process that survives every brain restart, so a routine (br", "b": "REQ-HAZARD-RESTART-IDEMPOTENT", "a": "REQ-HAZARD-BROKER-PROCESS-ISOLATION", "bDoc": "" }, { "aDoc": "**endpoint list always merges local perches**: `spt endpoint list` (and therefore `whoami`) **always** appends this node's **LOCAL perch roster** as a trailing section, in addition to the SEL", "bTitle": "The `endpoint list` SELF pin carries the Self endpoint's authored `endpoint description` (info::read_info(...).resources) when present, inline after t", "aTitle": "`spt endpoint list` always merges this node's LOCAL (unadvertised) perches into the view; the `--local` flag is REMOVED (operator decision 2026-06-17)", "b": "REQ-WHOAMI-1", "a": "REQ-ENDPOINT-LIST-MERGE-LOCAL", "bDoc": "**whoami** (alias for endpoint list): `spt whoami` is a thin **alias for `spt endpoint list`** — it prints the full view with the session's own endpoint **SELF-pinned first**, that pin carryi" }, { "aDoc": "Restoration field-run evidence (D7-4) — the seamless-update acceptance: ", "bTitle": "W5 (LIFECYCLE-TRUTH): the idle-inject TYPED delivery leg delivers multi-line bodies byte-complete. ROOT (4 field instances + spool diff): the typed le", "aTitle": "Broker/brain split for seamless self-update", "b": "REQ-INJECT-MULTILINE-INTEGRITY", "a": "REQ-DAEMON-2", "bDoc": "" }, { "aDoc": "", "bTitle": "Deferred rows survive poll drain (4.4)", "aTitle": "Deferred spool rows excluded from the event-stream drain (1.4)", "b": "REQ-HAZARD-DEFERRED-SURVIVE-DRAIN", "a": "REQ-HAZARD-DEFERRED-DRAIN", "bDoc": "" }, { "aDoc": "Decisions: 1. **`spt rc` consults the honest-session authority before the offline fast-fail.** Normal `spt rc ` runs the same bounded `SessionProbe::has_live_session_honest` gate `endpoin", "bTitle": "REDISPATCH-STALL W1 (ADR-0038 Amendment, fix 6): terminal-exclusion enforced PRE-SERVE + ownership/generation validation on attach/detach — a stale wo", "aTitle": "RC-RENDER-TRUTH W1 (ADR-0042 decision 2, operator-spotted second root seam): resume launch transitions an existing offline perch to UNBOUND before/wit", "b": "REQ-SERVE-OWNERSHIP-GENERATION", "a": "REQ-RESUME-UNBOUND-STAMP", "bDoc": "Consequences: ## Amendment — REDISPATCH-STALL (2026-07-16) " }, { "aDoc": "1. Scope is a per-row, producer-chosen attribute: `node` | `subnet`: ", "bTitle": "Per-subnet serve-state: spt subnet detach [--save] / attach [--save] — daemon keeps running, stops/starts advertising + connecting for t", "aTitle": "Notif scope is a per-row producer-chosen attribute node|subnet: node-scoped rows (update/consent/rollback kinds) live and die on their node and NEVER ", "b": "REQ-SUBNET-5", "a": "REQ-NOTIF-SCOPE", "bDoc": "" }, { "aDoc": "", "bTitle": "#5: after 'Start now' in the endpoint picker, swap the bottom Options panel to a 'Choose project' list: (1) the endpoint's most recent project dir, (2", "aTitle": "Bug #13: the endpoint run Subnet tab shows a machine once PER shared subnet (subnet_rows data.rs:253 iterates per-subnet, groups by subnet:node, no cr", "b": "REQ-PICKER-START-PROJECT-CHOICE", "a": "REQ-PICKER-NODE-GROUPING", "bDoc": "" }, { "aDoc": "Session digest — `endpoint digest --json`: > **Reaching an endpoint on another machine.** The snapshot pull accepts a > qualified address — `spt endpoint digest --json`, `--last` an", "bTitle": "The `spt endpoint run` picker renders endpoint state IDENTICALLY for local and remote (subnet) rows — bound/unbound, controlled (+driver node), and ha", "aTitle": "The digest SNAPSHOT PULL crosses nodes: `spt endpoint digest <[subnet:]id@node>` (including `--after ` incremental polling) resolves and serves u", "b": "REQ-SUBNET-DISPLAY-PARITY", "a": "REQ-DIGEST-CROSS-NODE-PULL", "bDoc": "" }, { "aDoc": "", "bTitle": "Echo-commune fires before INIT_SIGNOFF on orphan teardown (3.3)", "aTitle": "Grace-period wait completes before composing INIT_SIGNOFF (1.1)", "b": "REQ-HAZARD-ECHO-BEFORE-SIGNOFF", "a": "REQ-HAZARD-GRACE-BEFORE-SIGNOFF", "bDoc": "" }, { "aDoc": "Terminal wrapper: **A view is independent from the endpoint** (invariant): An spt-hosted endpoint runs in a **daemon-owned PTY, decoupled from whatever terminal launched it**. Closing the tab", "bTitle": "RC-RENDER-TRUTH W3 (ADR-0043 decision 2, hertz stale-glyphs RCA leg 2 P0): rc display teardown is a display RAII guard SEPARATE from the OS input/raw-", "aTitle": "A VIEW is independent from the endpoint: closing the tab/window where `spt endpoint run` was invoked must detach ONLY the `spt rc` attach pump — the d", "b": "REQ-RC-VT-TEARDOWN", "a": "REQ-HAZARD-VIEWER-CLOSE-DETACH", "bDoc": "Decisions: 1. **One FIFO sequencer per attach sink.** The PTY drain/output writer is the sole sequencer for terminal Output and Exit: Exit is enqueued behind all prior output for each sink (d" }, { "aDoc": "1. Scope is a per-row, producer-chosen attribute: `node` | `subnet`: ", "bTitle": "`-` launcher shortcut generation (picker `s` keybind, M12-W2-T2.4): from any pre-start options set the picker writes/updates a `` shortcut** (picker `s` keybind, M12-W2): From any pre-start options set, `s` writes (or updates) a **`-` launcher** at the project root that bakes the current selec" }, { "aDoc": "", "bTitle": "spt binary CLI surface: send/ring/ready(+--once)/list/stop/whoami, stable arg shapes + exit codes", "aTitle": "User-facing CLI output is human-readable: DIRECT-USER commands (e.g. adapter update/list/use) render friendly prose instead of raw CODE:RESULT markers", "b": "REQ-MSG-2", "a": "REQ-CLI-4", "bDoc": "" }, { "aDoc": "7.21 Exactly ONE `controller_writer` per brain↔broker connection — a superseded writer must write nothing further `[REQ-HAZARD-CONTROLLER-WRITER-REORDER]`: ### 7.22 An idle delivery with no working tr", "bTitle": "Activity-gated inbound delivery + per-message send control as THREE ORTHOGONAL AXES plus opaque metadata (ADR-0028; grilled w/ operator 2026-06-23). S", "aTitle": "An idle delivery to a session whose translation binary is in a FAILED STATE — absent (none declared), spawn-failed, FAULTED, or its inject-worker chan", "b": "REQ-MSG-DELIVERY-AXES", "a": "REQ-HAZARD-IDLE-SILENT-NONDELIVERY", "bDoc": "Activity-gated message delivery + send-modifier axes: " }, { "aDoc": "", "bTitle": "Idempotent/exactly-once delivery across brain restart at every broker boundary (codex #14)", "aTitle": "Service-aware `daemon start`/`stop`: when an OS service manager has a registered spt-daemon for this user, `spt daemon start` and `spt daemon stop` dr", "b": "REQ-HAZARD-RESTART-IDEMPOTENT", "a": "REQ-DAEMON-6", "bDoc": "" }, { "aDoc": "7.52 An operator stop outranks every implicit ensure — no convenience path resurrects what the operator just killed `[REQ-HAZARD-STOP-RESPAWN-CONVOY]`: - **Failure (paid-for, hertz v0.39.4 fi", "bTitle": "Windows PID-recycling false positives guarded (5.1)", "aTitle": "KNOWN-HAZARDS 7.52: an operator stop outranks every implicit ensure — no convenience path resurrects what the operator just killed. The hazard-conform", "b": "REQ-HAZARD-WINDOWS-PID-RECYCLE", "a": "REQ-HAZARD-STOP-RESPAWN-CONVOY", "bDoc": "" }, { "aDoc": "7.21 Exactly ONE `controller_writer` per brain↔broker connection — a superseded writer must write nothing further `[REQ-HAZARD-CONTROLLER-WRITER-REORDER]`: ### 7.22 An idle delivery with no working tr", "bTitle": "An inbound `spt send` is DELIVERED to an spt-hosted endpoint (brought up via `spt endpoint run` → `api bind`, broker holds its PTY, NO `api listen` re", "aTitle": "An idle delivery to a session whose translation binary is in a FAILED STATE — absent (none declared), spawn-failed, FAULTED, or its inject-worker chan", "b": "REQ-SEND-SPT-HOSTED", "a": "REQ-HAZARD-IDLE-SILENT-NONDELIVERY", "bDoc": "" }, { "aDoc": "", "bTitle": "Two-slice envelope parser is panic-free and tolerant (4.2)", "aTitle": "commune/signoff are file-drops, not commands", "b": "REQ-HAZARD-ENVELOPE-PARSER-SAFE", "a": "REQ-API-3", "bDoc": "" }, { "aDoc": "", "bTitle": "W3 (v0.39.4 field bug 3 ROOT, pinned 2026-07-22): the rc client presents relayed bytes exactly as the emitter addressed them — KNOWN-HAZARDS 7.56. rc'", "aTitle": "W5 (LIFECYCLE-TRUTH): the idle-inject TYPED delivery leg delivers multi-line bodies byte-complete. ROOT (4 field instances + spool diff): the typed le", "b": "REQ-RC-NEWLINE-PRESENTATION-TRUTH", "a": "REQ-INJECT-MULTILINE-INTEGRITY", "bDoc": "7.56 The rc client presents relayed bytes exactly as the emitter addressed them — console output modes are part of presentation truth `[REQ-RC-NEWLINE-PRESENTATION-TRUTH]`: - **Failure (paid-" }, { "aDoc": "", "bTitle": "api boundary's rotation credential is designed, documented, and eventually anchor-proven (ADR-0032): the proof is the DEPARTED session's (prior sid / ", "aTitle": "C2-ROOT (F028, doyle RCA 2026-07-03): the identity-attribution ROOT behind REQ-SESSIONS-LOG-ENDPOINT-ATTRIBUTION — three composing defects let a psych", "b": "REQ-BOUNDARY-ROTATION-CREDENTIAL", "a": "REQ-BIND-HONEST-SELF-STAMP", "bDoc": "`api boundary --to-session-id --session-id `: // Boundary rotation credential: the departed-session catch-22 and the parent_pid anchor: " }, { "aDoc": "Immutable home subnet; fork (copy-then-diverge) is the cross-subnet move, not re-home: > **Delivered (M4-D9-5, 2026-06-04):** home assignment at creation > (`spt_store::home` — auto-if-one / ", "bTitle": "W-2 (WORKER-TRUTH triage, operator-ruled 2026-07-06): worker verbs go sid-symmetric with every sibling id-scoped verb — worker-start mints NO token an", "aTitle": "Immutable home subnet (assigned at creation: auto-if-one/ask-if-many) + spt fork (cross-subnet clone to a new identity, copy-then-diverge, not re-home", "b": "REQ-WORKER-SID-SYMMETRIC-AUTH", "a": "REQ-INST-15", "bDoc": "`api worker-start [--agent-id ] [--agent-type ]`: ### `api worker-stop --session-id ` · `api worker-poll --session-id `" }, { "aDoc": "`[digest]` — session-digest extractor: `[digest]` supports the same two locate strategies as `[history]` — pick with `strategy` // native: adapter pushes via `api history-log`; spt-core store", "bTitle": "W3 (LIFECYCLE-TRUTH): daemon restart no longer massacres hosted endpoints — daemon start RE-RUNS previously-online spt-hosted endpoints. ROOT rig-prov", "aTitle": "Bug #17 (W6b, closes eel-a end-to-end): [digest] gains a `fetcher` strategy mirroring [history]'s locate/normalize split (CONTEXT §history: [digest] m", "b": "REQ-UPDATE-FINISH-ENDPOINT-SURVIVAL", "a": "REQ-DIGEST-FETCHER-STRATEGY", "bDoc": "" }, { "aDoc": "5.13 Atomic write leaves data un-synced before the rename → NUL zero-fill on power loss `[REQ-HAZARD-PERCH-RECORD-POWER-LOSS]`: ### 5.14 Corrupt info.json read as ABSENT → fail-open readers g", "bTitle": "Authoritative/identity records fsync data before the rename (5.13): a hard reset must not resurrect a full-length NUL-filled record — SCOPED, not a bl", "aTitle": "Corrupt (present-but-unparseable) info.json is NOT absent: liveness/status readers agree a destroyed record is neither alive nor Active (counter-39 #2", "b": "REQ-HAZARD-PERCH-RECORD-POWER-LOSS", "a": "REQ-HAZARD-CORRUPT-PERCH-COHERENCE", "bDoc": "5.12 Native-PTY spawn of a bare program runs the wrong (non-PE) file on Windows `[REQ-HAZARD-WIN-PTY-PROGRAM-RESOLVE]`: ### 5.13 Atomic write leaves data un-synced before the rename → NUL zer" }, { "aDoc": "", "bTitle": "Remote-attach controller/viewer model (CONTEXT.md:317): a session's broker OutputLog serves ONE interactive controller (input + EXCLUSIVE PTY resize; ", "aTitle": "B-2 (REMOTE-TRUTH triage §B-2, REDUCED @bdc1242): a stale ONLINE+CONTROLLED stamp on a live-session perch self-heals — the info.json driven_by/control", "b": "REQ-RCVIEW-1", "a": "REQ-CONTROLLER-LIVENESS-REAP", "bDoc": "Shell sleep/wake (offline ↔ online): **BUILT (M12 W2.5).** The controller/viewer model is implemented end-to-end. Attach intent is **three-valued** (`AttachIntent = Viewer | Control | Take`, " }, { "aDoc": "Decision: 1. **`spt rc` consults the honest-session authority before the offline fast-fail.** Normal `spt rc ` runs the same bounded `SessionProbe::has_live_session_honest` gate `endpoin" }, { "aDoc": "5.5 ConPTY withholds output until DSR is answered `[REQ-HAZARD-CONPTY-DSR]`: ### 5.6 Windows detached children inherit a captured caller's pipe `[REQ-HAZARD-DETACHED-PIPE-INHERIT]` - **Failur", "bTitle": "RULING OWED (unratified — do NOT satisfy without one): may a shell adapter own a DETACHED process that deliberately OUTLIVES its shell's link-break? T", "aTitle": "Windows detached long-lived children must not inherit a captured caller's pipe: every detach-spawn of an immortal child (daemon, shell binary) runs bI", "b": "REQ-SHELL-ADAPTER-OWNED-DETACHED-SERVICE", "a": "REQ-HAZARD-DETACHED-PIPE-INHERIT", "bDoc": "" }, { "aDoc": "", "bTitle": "RC-RENDER-TRUTH W1 (ADR-0042 decision 1, hertz perri-contradiction RCA): normal `spt rc` consults the ADR-0041 single honest-session authority BEFORE ", "aTitle": "Concurrent liveness probes: `spt subnet status --nodes` fans out its offline/serve-probes (REQ-SUBNET-5) CONCURRENTLY — total wall-time bounded by the", "b": "REQ-RC-HONEST-SESSION-AUTHORITY", "a": "REQ-MESH-6", "bDoc": "Decisions: 1. **`spt rc` consults the honest-session authority before the offline fast-fail.** Normal `spt rc ` runs the same bounded `SessionProbe::has_live_session_honest` gate `endpoin" }, { "aDoc": "Amendment 1 (2026-07-22, DAEMON-LIFECYCLE W2) — teardown authority is opener-declared class PLUS transport liveness, enforced at the three places decision 6 could not see: ", "bTitle": "W3 (F030 hazard; paid-for: hall-bf churn ordinal 6491+ + adapter v0.13.2 bad-ship brick 2026-07-04): a psyche failure of ANY shape must NOT remove or ", "aTitle": "An spt-hosted endpoint driven by a REMOTE controller whose remote is gone but whose broker connection stays OPEN (a wedged/lost pump that never delive", "b": "REQ-HAZARD-PSYCHE-RESIDENCY-EXPECTATION", "a": "REQ-HAZARD-DRIVEN-BY-IDLE-REMOTE-EVICT", "bDoc": "7.29 Control/viewer stamps CONVERGE to broker session-table truth, not merely edge-trigger `[REQ-HAZARD-CONTROL-STAMP-CONVERGENCE]`: ### 7.30 A Psyche failure of ANY shape must NEVER remove or alter t" }, { "aDoc": "", "bTitle": "REGISTRY-LIFECYCLE W2 (ADR-0040 decision 6 + ADR-0041, emphasys C2 P0): streams declare a lifetime class at open — RC attach/view streams are Connecti", "aTitle": "`spt endpoint list` (bare/subnet view) renders an ALIGNED table with canonical node labels: cmd_endpoint_list prints subnet rows with `\\t` TAB separat", "b": "REQ-STREAM-LEASE-CLASSES", "a": "REQ-PICKER-5", "bDoc": "Decision: 1. **One-way (fire-and-forget) stream families are terminal at FIN, sender-side.** The registry feed pump retires its own row after successful write+FIN via the existing `net-stream" }, { "aDoc": "", "bTitle": "An spt-hosted endpoint driven by a REMOTE controller whose remote is gone but whose broker connection stays OPEN (a wedged/lost pump that never delive", "aTitle": "REGISTRY-LIFECYCLE W4 fast-follow (hertz v0.37.0 field-verify CPU-gate FAIL RCA 2026-07-17, doyle seam-verified same day; timing-pinned ~16s burst clu", "b": "REQ-HAZARD-DRIVEN-BY-IDLE-REMOTE-EVICT", "a": "REQ-GOSSIP-PROJECT-DERIVE-ONCE", "bDoc": "Amendment 1 (2026-07-22, DAEMON-LIFECYCLE W2) — teardown authority is opener-declared class PLUS transport liveness, enforced at the three places decision 6 could not see: " }, { "aDoc": "", "bTitle": "RESCOPED at W2 activation 2026-07-22 (doyle verify-first, C3-retirement precedent): the CLEAN-CASE chain this REQ was minted for is ALREADY SHIPPED un", "aTitle": "Bug #1: adapter add runs the install-as-first-update via conduct (cli.rs:6963) which on a non-zero exit prints only the exit code and DISCARDS the sub", "b": "REQ-STREAM-LIFETIME-CLASS", "a": "REQ-ADAPTER-ADD-SURFACE-ERRORS", "bDoc": "Amendment 1 (2026-07-22, DAEMON-LIFECYCLE W2) — teardown authority is opener-declared class PLUS transport liveness, enforced at the three places decision 6 could not see: " }, { "aDoc": "", "bTitle": "cross-node Gateway user-msg honored via advertised endpoint_type: a user-msg from a Gateway-typed origin survives the receive_wan funnel as user-msg (", "aTitle": "W5 (LIFECYCLE-TRUTH): the idle-inject TYPED delivery leg delivers multi-line bodies byte-complete. ROOT (4 field instances + spool diff): the typed le", "b": "REQ-MSG-6", "a": "REQ-INJECT-MULTILINE-INTEGRITY", "bDoc": "Endpoint types: _Implemented posture_: the **local** user-backed origins are honored end-to-end — a locally-hosted Gateway endpoint (info.json `state=\"gateway\"`) and the local user's CLI (M9-" }, { "aDoc": "7.46 An rc surface answers from live session authority, never a stale persisted projection — and a resuming perch is UNBOUND, not offline `[REQ-HAZARD-RC-ATTACH-TRUTH]`: ### 7.47 The physical terminal", "bTitle": "A self-owned subnet row reconciles its status to the LIVE roster: a Subnet-category row whose endpoint_id overlaps a local (is_local) roster id is sel", "aTitle": "RC-RENDER-TRUTH W3 (KNOWN-HAZARDS 7.47 — umbrella conformance seam for ADR-0043): the physical terminal is never mutated or terminated outside its ren", "b": "REQ-PICKER-3", "a": "REQ-HAZARD-RENDER-LIFECYCLE", "bDoc": "" } ]