docs(orchestration): approve planning design, Souveraine survey, and foundation plan

specs/2026-09-03-planning-task-orchestration-benchmark-protocol.md

@@ -0,0 +1,115 @@
+# Planning and Task Orchestration Benchmark Protocol
+
+**Status:** Proposed protocol; thresholds remain provisional until a measured
+baseline is approved. **Implementation permission:** none.
+
+## Environment fingerprint
+
+Every run records commit, dirty-state hash, OS/kernel, CPU model/count, RAM,
+GPU/driver, storage device/filesystem, Python/Rust/runtime versions, provider
+endpoint/model/digest, power profile, background-load profile, and UTC time.
+Results from different fingerprints are not merged silently.
+
+## Fixture manifest
+
+A versioned manifest pins event schemas, agent/config/resource snapshots,
+deterministic provider responses, tool outputs, evidence blobs, task graph,
+surface capabilities, random seeds, and expected typed invariants. Sensitive
+values use deterministic redacted fixtures. The manifest hash appears in every
+result and ReceiptRecord.
+
+## Run discipline
+
+- Each scenario runs five paired batches. A batch contains 10 excluded warm-up
+  operations followed by exactly 100 measured operations; replay/crash batches
+  contain one warm-up and exactly 10 measured 100,000-envelope runs.
+- Interactive/background isolation runs at idle, 50%, and saturated background
+  quotas with fixed concurrency.
+- Model-output equality uses the deterministic provider. Real-model runs measure
+  resource use and typed invariants, never prose identity.
+- Report p50, p95, maximum, median absolute deviation, failures, retries, CPU,
+  peak RSS, disk bytes, network bytes, model calls, and tokens.
+- Compare paired baseline/candidate batches on the same fingerprint and
+  manifest. The Metric Contracts table is the sole authority for each metric's
+  per-batch statistic, unit, direction, threshold, and regression rule. Its
+  named statistic replaces p95 where the row specifies median, maximum, count,
+  or exact proportion. Raw failures are never discarded; any typed-invariant or
+  capability loss is an immediate failure. If fewer than five valid paired
+  batches remain, the run is invalid, not inconclusive-by-convenience.
+
+## Workloads
+
+1. Single direct-user turn with no tools.
+2. Tool-heavy turn with 20 evidence blobs and one retryable failure.
+3. 100 concurrent partitions with strict per-partition ordering.
+4. 100,000-envelope append, projection, checkpoint, restart, and replay.
+5. N+1 no-change, changed-evidence, deadline, and failure paths.
+6. Reflection and synthesis with capped and uncapped evidence manifests.
+7. Resource routing under stable health, version change, outage, and fallback.
+8. Mixed direct-user, cancellation, verification, telemetry, and archival load.
+9. Local/server/remote/TUI semantic-parity suite.
+
+## Metric contracts
+
+All relative comparisons use five paired batches. For continuous duration and
+byte metrics, the comparison value is the median of the five paired differences
+for the named statistic and the noise bound is
+`max(measurement_resolution * 10, 3 * MAD)`. For integer counts, the bound is
+`max(1, 3 * MAD)`. Deterministic invariant proportions use exact fixture
+counts and admit no statistical waiver.
+
+| Metric | Workload | Statistic and unit | Direction | Absolute contract | Regression rule |
+|---|---|---|---|---|---|
+| Reflex latency | 1-3 | per-operation p95 milliseconds | lower | <= 10 ms excluding external I/O | fail if above threshold or paired regression exceeds duration noise and 5% |
+| Durable append-to-publish latency | 2-4 | per-envelope p95 milliseconds | lower | <= 25 ms locally | same duration rule |
+| Projection read latency | 3-4 | per-read p95 milliseconds | lower | <= 20 ms | same duration rule |
+| Interactive start latency | 8 | request-to-lease p95 milliseconds | lower | <= 100 ms at every background load | same duration rule; saturated load cannot be averaged with idle |
+| Replay recovery | 4 | p95 seconds across 50 measured runs | lower | < 2 s for 100,000 envelopes | fail if above threshold or paired regression exceeds duration noise and 5% |
+| Queue depth | 3,8 | p95 and maximum queued items per priority lane | lower | no reserved lane reaches capacity; configured lane maximum is recorded in baseline | fail on overflow or integer-count regression beyond noise and 5% |
+| Model-call avoidance | 5 | exact avoided/eligible no-change fixtures, percent | higher | >= 80% with zero missed changed-evidence fixture | any lower proportion fails; no noise waiver |
+| Model calls | 2,5-7 | median calls per completed fixture | lower | all mandatory cognitive outputs still present | integer-count regression fails unless approved trade record applies |
+| Input/output tokens | 2,5-7 | median tokens per completed fixture | lower | fixture completion and evidence manifest unchanged | paired regression beyond integer noise and 5% fails |
+| Disk I/O | 2-4,7 | median bytes written/read per fixture | lower | every accepted record reaches eventual provenance | paired regression beyond byte noise and 5% fails |
+| Network I/O | 3,7,9 | median bytes per completed fixture | lower | typed event/receipt parity unchanged | paired regression beyond byte noise and 5% fails |
+| CPU time | 1-8 | median process CPU milliseconds per fixture | lower | none provisional; baseline record sets owner-approved ceiling | paired regression beyond duration noise and 5% fails |
+| Peak RSS | 3-5,8 | maximum resident MiB per batch | lower | none provisional; baseline record sets owner-approved ceiling | paired regression beyond byte noise and 5% fails |
+| Priority isolation | 8 | p95 start latency and exact urgent-arrival fixtures yielding background capacity | lower latency; 100% required yields | direct-user <= 100 ms; every urgent arrival under saturated background load causes at least one bounded background yield; zero dropped cancellation/halt events | any missed yield or dropped event fails; duration rule for latency |
+| Semantic parity | 9 | exact passed capability invariants / total | equal | 100% on every production entry path or valid approved exception | any unexplained mismatch fails; no noise waiver |
+| Duplicate suppression | 4-5 | exact duplicate effects committed | lower | zero duplicate canonical effects; duplicate delivery remains replayable evidence | any duplicate effect fails; no noise waiver |
+
+Metrics not declared as optimization targets remain guardrails: they may improve
+or stay within noise, but may not regress beyond their rule merely because one
+headline latency moved in the flattering direction. Machines are terribly good
+at winning the metric they were handed and pawning the furniture to do it.
+
+The implementation plan must name one or more optimization targets before a run.
+Eligible targets are reflex latency, append-to-publish latency, projection read
+latency, interactive start latency, replay recovery, model calls, tokens, disk
+I/O, network I/O, CPU time, or peak RSS. Queue depth, priority isolation,
+semantic parity, duplicate suppression, and all typed capabilities are always
+guardrails, never targets that may be traded away.
+
+## Baselines and acceptance
+
+The first approved implementation phase writes two distinct records. The
+**operational baseline** measures pre-change Rune for comparable costs and
+latencies only. The **semantic reference baseline** is recorded after the
+smallest unoptimized implementation satisfies every approved schema, authority,
+receipt, entry-path, and capability contract. Only the semantic reference owns
+golden fixtures for optimization comparisons. Each record contains its type,
+manifest, fingerprint, raw-result hashes, derived statistics, noise bounds,
+thresholds, and Nick's approval. Threshold changes require a new record linked
+to the old one, reasons, raw evidence, capability-parity result, and explicit
+approval; CI configuration cannot quietly move the goalposts.
+
+An optimization is accepted only when:
+
+1. every typed invariant and required capability remains present;
+2. no production entry path degrades outside an approved exception;
+3. every approved absolute threshold is met;
+4. at least one declared target metric improves beyond measured noise;
+5. no other contracted metric regresses beyond its noise bound unless Nick
+   approves a named trade record that states the reliability gain, affected
+   workload, expiry, restoration test, and a hard cap of 5% regression;
+6. raw logs and reproduction commands are retained;
+7. rollback restores the prior baseline behavior.

specs/2026-09-03-planning-task-orchestration-design.md

@@ -0,0 +1,694 @@
+# Planning and Task Orchestration Design
+
+**Status:** Approved by Nick  
+**Updated:** 2026-09-03  
+**Authority:** Running design record; revised after each settled decision  
+**Implementation state:** Not started; implementation plan pending approval
+
+## [S1] Purpose
+
+Design a planning and execution system that preserves intent, challenges weak
+assumptions, records evidence, delegates work in accuracy-sized batches, and
+keeps every active stage visible until verified. Planning must not drift into
+execution: Nick retains the explicit right to say **start**.
+
+## [S2] Selected architecture
+
+Use a layered nervous system, subconscious, and deterministic scheduler:
+
+- deterministic evidence records what is available, authorized, started,
+  verified, failed, or blocked;
+- the subconscious interprets meaningful changes, contradictions, and task fit;
+- the scheduler advances approved work within explicit boundaries;
+- foundation models are replaceable reasoning resources, not the source of
+  identity, task truth, or completion truth.
+
+Rejected alternatives:
+
+1. A single orchestration model is simple but can hallucinate availability,
+   completion, or resource state and wastes inference on mechanical checks.
+2. A scheduler alone is reliable but too rigid for changing intent,
+   contradictory research, and nuanced capability matching.
+
+## [S3] Planning and task experience
+
+**Section status:** Approved by Nick; safeguards and TUI pin visibility recorded.
+
+### Entering planning
+
+- Nick can enter Planning Mode directly.
+- Rune may suggest it based on ambiguity, risk, scope, research need, cost,
+  visual design, or irreversibility.
+- Entry always requires consent.
+- Planning lives in a named, switchable Chat thread; ordinary Chat remains
+  available.
+
+### Planning
+
+- Rune interviews intent before proposing implementation.
+- The answers create a research brief.
+- Research, sources, notes, decisions, and the living report may be recorded
+  automatically.
+- Isolated experiments require a falsifiable hypothesis and predefined
+  verification.
+- Research continues until evidence converges or uncertainty is honestly
+  bounded.
+- Rune proposes planning completion; Nick confirms or reopens it.
+
+### Task-pane report
+
+- Every planning thread owns a living, versioned report.
+- It contains the current understanding, rationale, alternatives, unresolved
+  questions, evidence, stages, and execution strategy.
+- Chat carries discussion; the report carries settled decisions.
+- The report stays compact, with detail available on demand.
+
+### Pinning
+
+- The root plan remains pinned until the goal is complete.
+- The active stage and batch remain pinned until verified.
+- Once verified, the completed unit is unpinned and its successor is pinned.
+- The latest verified checkpoint remains pinned until replaced or the plan
+  reaches a terminal state.
+- Pinning is a state invariant, not a display convention: at most one stage and
+  one batch may hold the operational pin for a plan.
+- Pin transfer is transactional and evidence-backed. A crash must leave either
+  the prior pin or its successor valid, never an untracked gap or two active
+  owners.
+- A stale-pin watchdog reports inactivity, lost ownership, or expired evidence
+  but cannot infer completion or move the pin itself.
+- Initial stage/batch activation is a distinct transaction backed by a valid
+  start ApprovalRecord; it does not require a fictional predecessor receipt.
+- Completion, cancellation, or supersession transactionally clears root,
+  stage, batch, and checkpoint pins after recording the terminal receipt.
+- Older detail moves into durable Gitea history; live model context keeps only
+  compact state and references.
+
+### Pinned-item visibility in the TUI
+
+- The persistent context header shows a compact text indicator such as
+  **Pinned: 4**. It remains visible across Chat, Planning, and Task views.
+- Hovering or focusing the indicator opens a concise tooltip listing the pinned
+  root plan, active stage, active batch, and latest verified checkpoint.
+- Each tooltip row shows item type, short title, state, and age; blocked or
+  stale items use an accessible text label as well as color.
+- The indicator is keyboard-focusable. Enter opens the full pinned-items view,
+  so essential state is never trapped behind hover behavior.
+- The count is derived from canonical pin records rather than maintained as a
+  separate UI counter.
+
+### Gitea delegation
+
+- Plan confirmation settles a plan version but creates no external task. Only
+  Nick's explicit **start** approval for that exact version authorizes the
+  Delegator to create a Ready parent issue, stage issues, and accuracy-sized
+  batch issues.
+- Issues carry dependencies, acceptance criteria, canaries, capability
+  assignment, resource posture, and evidence requirements.
+- Every batch targets one independently verifiable outcome and has a bounded
+  context budget. File count and line count alone do not define batch size.
+- Code batches use isolated branches, pull requests, and protected checks.
+- Authority is field-specific rather than duplicated: the Intent and Plan Store
+  owns intent, design, plan versions, and approvals; Gitea owns accepted remote
+  issue/PR/milestone coordination state and the merged branch; the Verification
+  Ledger owns observed execution and completion. The TUI projects all three
+  with provenance.
+- When Gitea is unavailable, Rune writes intended mutations to a local
+  append-only outbox with stable IDs. They remain pending intents, not accepted
+  Gitea state. Reconnection applies version preconditions and deterministic
+  conflict rules; it never silently overwrites newer remote state.
+
+### Starting and revising
+
+- Nothing executes until Nick says **start** from the report or its Planning
+  thread.
+- Goal changes trigger impact review. Valid work survives; affected work
+  pauses; revisions require approval.
+- Internal phases advance only after verification.
+- Objective work closes on proof; subjective outcomes wait for Nick's
+  judgment.
+
+### Advisory viability
+
+- The report ends with a **Viability Card** covering intent clarity, evidence
+  maturity, technical feasibility, resources, dependencies, verification,
+  reversibility, and model-task fit.
+- It shows a summary score, each dimension, contrary evidence, and fatal
+  weaknesses; an average cannot conceal a zero.
+- Every dimension also exposes confidence and evidence age so a precise-looking
+  score cannot disguise weak or stale inputs.
+- The score updates as evidence and conditions change, then calibrates against
+  actual outcomes.
+- It is always advisory. It informs whether a plan is worth pursuing but never
+  overrules Nick or becomes a hidden permission gate.
+
+## [S4] Settled decisions
+
+1. Planning is critical inquiry, not task-list formatting.
+2. Planning and ordinary Chat remain switchable.
+3. Planning may record artifacts automatically but may not begin execution.
+4. The root plan, active stage, active batch, and latest checkpoint have
+   explicit rolling pin semantics.
+5. The Delegator converts an approved plan into a Gitea issue hierarchy built
+   from small, verifiable batches.
+6. Gitea carries durable tracking; the TUI presents the live operational view.
+7. Viability appears at the end of the report and is always advisory.
+8. Pin ownership and transfer are enforced invariants with stale-pin detection.
+9. The persistent TUI context header exposes the pin count, a focusable tooltip,
+   and keyboard access to full pin details.
+10. A local append-only outbox preserves Gitea-bound state during outages while
+    Gitea remains the durable source of truth.
+11. Batch size follows one verifiable outcome plus a bounded context budget.
+12. One durable event/effect spine, not a model or UI path, carries execution
+    and completion authority.
+13. Reflex, N+1, reflection, and synthesis are independent cognitive timescales
+    with separate triggers, budgets, cursors, and health.
+14. Resource eligibility is deterministic; model routing is advisory; final
+    assignment and fallback are recorded scheduler decisions.
+15. Efficiency comes from references, projections, partitioned parallelism,
+    adaptive no-change suppression, and immutable snapshots—not functionality
+    removal.
+16. Performance changes must pass semantic-parity and capability-preservation
+    canaries as well as latency and resource budgets.
+17. Canonical authority is field-specific: internal plan records own intent and
+    approval, Gitea owns accepted coordination objects and merged code, and the
+    Verification Ledger owns observed completion.
+18. Approved execution advances by event-driven batch chaining: a verified
+    receipt deterministically selects the next unit and hands it a compact
+    context manifest, so no model must re-process the plan.
+19. Chaining never crosses the consent boundary, never skips a receipt, and
+    resumes from the last verified receipt after any interruption.
+
+## [S5] Open design work
+
+1. Implementation plan generation (in progress after design approval).
+
+## [S6] Decision trace
+
+- Nick required every stage and batch to remain pinned until completion, with
+  the pin advancing only after verification.
+- Nick required a final-plan Delegator that creates Gitea issues in small
+  batches to protect code accuracy.
+- Nick required Gitea to carry as much durable task and goal tracking as
+  practical.
+- Nick required viability to appear at the report's end, inform whether work is
+  worth pursuing, and remain advisory.
+- Nick required this design to be recorded continuously in a running file.
+- Rune recommended transactional pin invariants, offline Gitea reconciliation,
+  and confidence-aware viability and batch sizing; Nick approved all three.
+- Nick required a compact TUI header indicator showing the number of pinned
+  items, with a tooltip identifying them.
+- The pin indicator is placed in the persistent context header rather than a
+  transient status message because pin state must remain continuously visible.
+- Repository inspection confirmed that subconscious-related modules exist but
+  no subconscious pass is wired into the live TUI/operator response path.
+- Nick required the subconscious design to absorb the development ideas behind
+  Souveraine and FIMEG in their strongest primary-source form, then advance
+  them where evidence supports doing so rather than merely copying them.
+- Nick warned that apparently secondary, costly, risky, or conflicting
+  mechanisms may be critical to capability. Research must therefore separate
+  faithful reconstruction from later evaluation and may not prune capability
+  by assumption.
+- Nick approved the optimized subconscious/resource architecture and then the
+  component, data-flow, failure, verification, and provisional performance
+  design.
+- The primary-source survey examined 47 records and mapped 41 claims. It did
+  not reach claim saturation, so remaining uncertainty is carried as seven
+  explicit pre-implementation ablations.
+- Nick approved the resulting one-spine subconscious/resource architecture and
+  then asked for greater efficiency and performance without losing intent or
+  functionality.
+- Rune added batched durable append, partitioned ordering, materialized views,
+  content-addressed evidence, non-erasing coalescing, adaptive cognition,
+  two-stage routing, immutable snapshots, priority lanes, and measured
+  capability-preservation contracts; Nick approved those refinements.
+- Nick approved the complete design and required explicit batch-chaining and
+  context-minimization contracts so the LLM never holds or re-processes the
+  full plan during execution.
+- The current phase remains planning and research only; implementation is not
+  authorized.
+
+## [S7] Subconscious research gate
+
+**Status:** Primary-source survey completed; synthesis incorporated below.
+
+The subconscious architecture cannot be finalized from metaphor, remembered
+summaries, or dormant Rune modules. Research must first:
+
+1. identify and verify the authoritative Souveraine and FIMEG sources;
+2. reconstruct their development history, goals, mechanisms, and explicit
+   constraints from primary material;
+3. separate implemented behavior from aspiration and terminology;
+4. map transferable mechanisms onto Rune's actual live runtime;
+5. identify contradictions, missing evidence, and opportunities to advance the
+   architecture without creating another parallel authority path.
+
+Research must preserve before it judges. It may not discard a mechanism merely
+because it conflicts with Rune's current architecture, appears expensive or
+risky, or seems unnecessary in isolation. Each mechanism must be reconstructed
+in its original system context, including dependencies and interactions that
+may be critical to capability. Evaluation comes afterward through an
+interaction map, explicit trade-offs, and—where evidence remains insufficient—a
+proposed comparative experiment or ablation. Any recommendation to omit or
+constrain a source mechanism must state what capability may be lost and the
+evidence supporting that trade.
+
+Planned artifacts are a structured research question, auditable source and
+claim logs, a synthesis report, and a source-linked revision of this design.
+
+Artifacts:
+
+- `survey/souveraine/question.md`
+- `survey/souveraine/sources.tsv`
+- `survey/souveraine/claims.tsv`
+- `survey/souveraine/report.md`
+
+## [S8] Technical subconscious and resource architecture
+
+**Section status:** Approved by Nick after capability-preserving efficiency and
+performance refinements. Research did not reach claim saturation, so
+uncertainties remain explicit ablations rather than silently resolved.
+
+### Research conclusion
+
+Souveraine's capability comes from combining durable identity, distinct
+cognitive timescales, embodied tools, event-driven surfaces, and one
+constitutive substrate. Its principal failure mode is authority divergence:
+local, server, remote, subagent, schedule, provider, and UI paths can describe
+the same system while executing materially different capabilities. Rune must
+preserve the mechanisms while replacing parallel composition roots and
+model-authored truth with one evidence-backed execution spine. Full evidence
+and contradiction mapping lives in `survey/souveraine/report.md`.
+
+### Canonical event and effect spine
+
+- Every meaningful input becomes an immutable typed envelope with a stable ID,
+  causal parent, actor/device identity, plan/task/pin references, authorization
+  context, evidence timestamp, and schema version.
+- Envelopes are committed to a durable append-only store before fan-out. The
+  in-memory event bus is a low-latency projection, never durable completion
+  truth.
+- Consumers own replayable offsets and idempotency keys. Lag, restart, or an
+  unavailable surface cannot silently discard accepted work.
+- Effects become true only after the authority layer commits them and records a
+  verification receipt. Model prose, displayed status, and emitted events are
+  not execution evidence.
+
+### Three execution strata
+
+1. **Reflex layer:** deterministic, cheap, and idempotent checks produce facts
+   about availability, process state, budget, deadlines, stale pins, and failed
+   verification. Reflexes cannot reinterpret intent or mutate goals.
+2. **Subconscious layer:** bounded reasoning passes consume evidence capsules
+   and emit proposals such as surface, persist, investigate, reroute,
+   reschedule, or halt. Every proposal carries sources, confidence, expiry,
+   estimated cost, and possible capability loss. It cannot directly mutate
+   canonical task, memory, resource, or completion state.
+3. **Scheduler/effect layer:** deterministic policy validates authority,
+   dependency state, budgets, current versions, and idempotency, then commits
+   accepted effects and their receipts transactionally.
+
+N+1 review, wider reflection, and long-range synthesis are independent
+consumers with separate triggers, budgets, cursors, and health. They remain
+parts of one identity, but no single enable flag owns the others' lifecycle.
+
+### Subconscious state and surfacing
+
+- Preserve distinct ledger, inbox, inner-voice, and conversation-history roles,
+  but place them under one versioned schema with stable record IDs and explicit
+  ownership.
+- The subconscious may queue an ordinary observation, an urgent interjection,
+  or a halt proposal. Urgency changes scheduler treatment, not authority.
+- Surfacing records remain pending until acknowledged by a specific primary
+  turn or explicitly dismissed; reading a queue is not equivalent to delivery.
+- Every persistence or surfacing action links back to the evidence capsule and
+  originating event IDs.
+
+### Resource authority
+
+- One canonical registry records providers, models, tools, workers, surfaces,
+  and stores with observed health, capabilities, cost, locality, authorization,
+  concurrency, and evidence age.
+- A deterministic eligibility filter removes impossible candidates. An
+  advisory router ranks eligible resources. The scheduler records the chosen
+  assignment, rationale, and bounded fallback chain.
+- Subagents inherit the same authority object. They cannot bypass provider,
+  locality, budget, depth, timeout, or concurrency policy.
+- Unknown or stale resource state produces structured unavailability or lower
+  confidence, never silent fallback presented as the requested resource.
+
+### Memory and synthesis
+
+- Episodic records have stable IDs and explicit synthesis states.
+- A synthesis transaction records exactly which input IDs were included, the
+  output ID, previous cursor, and commit receipt before advancing the cursor.
+- Syntheses form a cumulative linked chain or retrievable hierarchy. Loading
+  the newest synthesis cannot erase access to earlier compressed continuity.
+- Identity and system pins have explicit budgets and priority classes. Overflow
+  raises visible context pressure and invokes an approved strategy; recursive
+  pinning never grows without measurement.
+- Git remains provenance and rollback history. Hot mutable cursors, queues, and
+  ownership transfers use atomic storage rather than treating commits as
+  locks.
+
+### Entry-path and surface parity
+
+- Local, server, remote, TUI, voice, and network surfaces call the same
+  conversation constructor and production composition root.
+- **Capability-set parity** requires every production entry path to support the
+  approved baseline for cancellation, images, history, tools, surfacings,
+  failures, completion receipts, and telemetry.
+- **Negotiation correctness** applies only to explicitly approved exceptions.
+  Structured absence must include the lost capability, owner approval, reason,
+  expiry, and restoration canary. Honest absence is not parity and cannot make
+  a degraded path production-equivalent.
+- External-to-internal conversation mappings are bidirectional and durable so
+  responses can return to the originating room, device, or peer.
+- Transport identity and portable agent identity remain distinct. Configured
+  peer keys are pinned and checked before events enter the canonical spine.
+
+### Failure handling
+
+- A failed provider or tool call records a typed failure outcome; stream closure
+  cannot masquerade as clean completion.
+- Configuration changes validate, persist, and atomically swap a complete
+  runtime snapshot. Failure leaves the previous snapshot authoritative.
+- Scheduled and background work receives a durable run ID, completion/failure
+  receipt, retry policy, and visible owner.
+- Stale evidence, replay gaps, cursor conflicts, and split-brain ownership are
+  first-class blocked states requiring reconciliation rather than inference.
+
+### Required ablations before implementation
+
+1. Independent N+1/reflection/synthesis toggles over 30- and 110-turn fixtures.
+2. Item-ID synthesis cursor versus date cursor under same-day and capped input.
+3. Local/server/remote semantic parity with a deterministic provider.
+4. Resource routing under provider outage, locality restriction, and subagent
+   inheritance.
+5. Event-bus lag and restart with and without durable replay.
+6. Ratatui/tuie capability rehearsal before either engine is removed.
+7. Git-backed versus transactional hot-state writes under concurrent turns.
+
+Each item is specified as an executable, planning-safe experiment card in
+`survey/souveraine/ablations.md`. No ablation mutates Rune's live runtime;
+Souveraine tests use its disposable checkout, architecture-only mechanisms use
+a disposable harness, and Rune integration tests wait for their implementation
+phase.
+
+### Efficiency and performance refinements
+
+These refinements change physical execution, not semantic guarantees. No event,
+cognitive timescale, surface capability, evidence link, or verification path is
+removed.
+
+1. **Split hot transport from durable history.** Commit envelopes through a
+   batched write-ahead append, then publish compact references on the in-memory
+   bus. Consumers fetch payloads only when needed. This retains the complete
+   record while keeping large tool outputs and media off the latency-sensitive
+   path.
+2. **Partition ordering by authority key.** Preserve strict order per
+   agent/conversation/task while allowing unrelated partitions to execute in
+   parallel under bounded concurrency. Global serialization is expensive and
+   unnecessary; global disorder is worse. The partition key makes the bargain
+   explicit.
+3. **Use incremental materialized views.** Task state, pin state, resource
+   health, and current context are checkpointed projections with source offsets
+   and hashes. Normal reads become constant-size lookups; replay remains the
+   recovery and audit mechanism rather than the price of every screen refresh.
+4. **Deduplicate evidence capsules by content hash.** Events and proposals carry
+   references to immutable evidence blobs instead of repeatedly copying tool
+   output, transcripts, or source text into queues and prompts. A bounded
+   manifest supplies only the relevant slices to a model.
+5. **Coalesce without erasing.** High-frequency telemetry is durably archived
+   in cold segments while the hot bus emits typed windows such as latest value,
+   min/max, count, and anomaly references. Urgent, state-transition, authority,
+   and completion events are never coalesced.
+6. **Use adaptive cognitive triggers with maximum-latency guarantees.** N+1,
+   reflection, and synthesis may debounce bursts, reuse unchanged evidence, and
+   skip a model call when a deterministic no-change canary passes. A forced
+   deadline preserves each timescale's function even during quiet periods.
+7. **Route in two stages.** The deterministic eligibility filter runs first and
+   is cached by task signature plus resource-state version. A small local model
+   ranks eligible choices; a larger model is used only for low-confidence or
+   high-impact ambiguity. Cache invalidation follows observed health, policy,
+   capability, or cost changes—not a timer alone.
+8. **Share immutable runtime snapshots.** Configuration, policy, capability,
+   and resource tables are compiled once into a versioned snapshot. Hot paths
+   use lock-light reads; validated updates atomically swap the snapshot. This
+   avoids repeated parsing while preventing live/disk split-brain.
+9. **Give priority lanes reserved capacity.** Halt, cancellation, verification
+   failure, and direct-user turns cannot queue behind archival synthesis or
+   bulk telemetry. Background work has explicit CPU, inference, I/O, and token
+   quotas and yields before interactive latency degrades.
+10. **Make performance a verified contract.** Canaries measure p50/p95 turn
+    dispatch latency, queue depth, replay recovery time, duplicate suppression,
+    model-call avoidance, token/I/O cost per turn, and semantic parity. An
+    optimization is accepted only when these improve without losing receipts,
+    source links, surface parity, or cognitive outputs on the reference
+    fixtures.
+
+### Acceptance boundary
+
+This section defines architecture, not implementation permission. It is
+acceptable only if each entry path produces equivalent identity, tool,
+history, cancellation, surfacing, failure, and completion semantics; every
+canonical mutation has a receipt; each cognitive timescale can fail or be
+disabled without suppressing the others; and omissions name the capability
+they trade away.
+
+## [S9] Components, data flow, failures, and verification
+
+**Section status:** Approved by Nick; independent consistency defects revised.
+
+### Component boundaries
+
+| Component | Owns | Must not own |
+|---|---|---|
+| Intent and Plan Store | Versioned goals, decisions, stages, batches, viability, and scoped approvals | Execution or inferred completion |
+| Pin Registry | Transactional root/stage/batch/checkpoint ownership and stale evidence | Task truth duplicated from Gitea |
+| Durable Event Store | Immutable envelopes, offsets, causal links, payload references | Interpretive conclusions |
+| Projection Engine | Incremental task, pin, resource, context, and TUI views | Canonical writes without source events |
+| Evidence Store | Content-addressed artifacts, slices, hashes, provenance | Authority decisions |
+| Reflex Engine | Deterministic facts and no-change canaries | Goal revision or model judgment |
+| Cognitive Workers | N+1, reflection, synthesis proposals and confidence | Direct canonical mutation |
+| Resource Registry | Observed capabilities, health, locality, cost, permissions, freshness | Choosing ineligible resources |
+| Advisory Router | Ranking eligible resources and explaining trade-offs | Final assignment or silent fallback |
+| Authority Scheduler | Policy, dependencies, budgets, leases, idempotency, effects, retries | Inventing evidence or owner consent |
+| Delegation Planner | Translating a started plan version into ordered Gitea coordination mutations | Approving the plan or marking execution complete |
+| Gitea Outbox/Reconciler | Pending remote mutations, version preconditions, retries, accepted remote IDs, and explicit conflicts | Treating queued intent as accepted remote state |
+| Effect Adapters | Tool, provider, Gitea, memory, surface, and device execution | Declaring their own success |
+| Verification Ledger | Receipts, canary results, semantic parity, rollback evidence | Treating requested work as completed work |
+| Surface Gateway | Bidirectional IDs, capability negotiation, event projection | Entry-path-specific agent construction |
+
+Each component exposes a versioned interface. The production composition root
+constructs exactly one instance of every authority-bearing component and passes
+references into local, server, remote, TUI, voice, and future device adapters.
+
+### Canonical records
+
+- **IntentRecord:** goal, owner, constraints, version, approval boundary.
+- **PlanRecord:** research links, alternatives, stages, dependencies, viability.
+- **ApprovalRecord:** approver, plan version, approved item/version set,
+  dependency closure, scope, granted/revoked timestamps, and superseding record.
+- **PinRecord:** plan/item IDs, pin type, owner lease, evidence, state, version.
+- **EventEnvelope:** event ID, parent ID, partition key, actor/device IDs,
+  timestamps, schema, authorization, payload hash.
+- **EvidenceCapsule:** immutable content hash, source, slices, freshness,
+  confidentiality, verification state.
+- **ProposalRecord:** cognitive worker, evidence IDs, action, confidence, expiry,
+  cost, capability-loss note.
+- **ResourceSnapshot:** observed capabilities, health, locality, cost, limits,
+  permissions, source evidence, version.
+- **EffectRecord:** accepted proposal/request, policy decision, resource lease,
+  idempotency key, attempt state.
+- **OutboxRecord:** mutation ID, remote target, expected remote version, plan and
+  ApprovalRecord versions, ordering key, payload hash, attempt state, returned
+  remote ID/version, conflict state, and resolver identity.
+- **ReceiptRecord:** observed result, verifier, canary evidence, completion state,
+  rollback pointer.
+- **ProjectionCheckpoint:** source offset, state hash, projection schema.
+
+All records carry stable IDs and schema versions. Schema migration is whole-path:
+writers, readers, projections, APIs, tests, docs, and migration tooling move
+together rather than maintaining a permanent old/new dialect bazaar.
+
+### End-to-end planning flow
+
+1. A Planning thread creates or resumes an IntentRecord and pins the root plan.
+2. Questions and research write EvidenceCapsules and versioned PlanRecords.
+3. Settled decisions update the running report; unresolved claims remain linked
+   to evidence or ablations.
+4. Viability projects from current evidence and resource snapshots. It advises;
+   it never authorizes.
+5. Nick's explicit **start** creates an ApprovalRecord for a precise plan
+   version and item/version set. Impact analysis computes the dependency closure
+   of later edits, emits a receipt, and revokes only intersecting approvals;
+   ambiguous impact revokes the whole approval rather than guessing.
+6. The Delegator materializes Gitea parent, stage, and context-bounded batch
+   issues through an outbox-backed effect. Returned durable IDs are recorded.
+7. Initial operational pins activate from the valid ApprovalRecord. Later stage
+   and batch pins transfer transactionally only after the prior unit has a
+   verified ReceiptRecord. Terminal plan states clear all operational pins.
+
+### End-to-end execution flow
+
+1. An approved batch emits a WorkRequested event with acceptance canaries.
+2. Reflexes assemble current dependencies, repository state, resource health,
+   authority, and evidence freshness.
+3. The eligibility filter rejects impossible resources. The advisory router
+   ranks the remainder; the scheduler leases one with a bounded fallback chain.
+4. An isolated adapter executes under the batch's branch/worktree, capability,
+   context, token, I/O, and time budgets.
+5. Tool and provider outputs become evidence blobs plus compact progress events.
+6. Verification runs independently from the implementation claim. Failure
+   emits typed diagnostics and a retry or blocked decision; success emits a
+   receipt linked to commands, outputs, commit, PR, and required checks.
+7. Gitea and TUI projections update from the same durable events. A successful
+   display refresh is never substituted for a receipt.
+8. Only a verified receipt closes the batch and advances its operational pin.
+
+### Cognitive flow
+
+- Reflexes run on every relevant event and suppress exact no-change duplicates.
+- N+1 consumes a bounded capsule after meaningful turns or at its maximum
+  deadline, emitting omissions, conflicts, commitments, or surfacing proposals.
+- Reflection runs at task/session boundaries and its deadline, reviewing linked
+  evidence and outcomes rather than an arbitrary transcript tail.
+- Synthesis runs on evidence pressure or its safety deadline, committing exact
+  input IDs and a linked output before advancing its cursor.
+- Each cadence owns a queue, budget, cursor, health record, and dead-letter
+  stream. Failure in one cadence cannot prevent another from running.
+- Accepted lessons enter governed memory as provisional records; promotion and
+  identity changes still require their existing evidence gates.
+
+### Failure state machine
+
+Effects move through **requested → eligible → leased → running → observed →
+verified**. Exceptional states are **deferred**, **retryable_failure**,
+**terminal_failure**, **blocked**, **cancelled**, **superseded**, and
+**reconciliation_required**.
+
+- Every transition requires the expected record version and an event ID.
+- A lease expiry permits reassignment but never implies the original attempt
+  stopped; late results are quarantined for reconciliation.
+- Retry policy distinguishes transport, capacity, policy, invalid-input,
+  implementation, and verification failures. Two identical implementation
+  failures trigger critique rather than a third ceremonial collision with the
+  same wall.
+- Offline Gitea mutations remain in the append-only outbox with stable IDs.
+  Their lifecycle is **queued → sending → accepted**, with
+  **retryable_failure**, **conflict**, **cancelled**, and **superseded**
+  alternatives. Reconnection compares the expected remote version: an
+  unchanged target applies once by mutation ID; an already-applied payload
+  records the returned remote version; a newer remote version enters conflict;
+  deleted or unauthorized targets enter blocked. Only Nick or a policy named in
+  the ApprovalRecord may resolve content conflicts.
+- Cancellation has reserved capacity and reaches adapters directly. Completion
+  arriving after cancellation is recorded but not silently accepted.
+- Projection corruption rebuilds from the last valid checkpoint plus durable
+  events; the event store remains untouched.
+- Evidence or resource health older than policy permits becomes **unknown**,
+  never false or healthy by default.
+
+### Verification matrix
+
+| Contract | Canary evidence |
+|---|---|
+| One authority path | Composition-root inventory; fail on duplicate stores, schedulers, or registries |
+| Entry-path parity | Capability-set parity is mandatory; approved exceptions must prove negotiation correctness, expiry, and restoration |
+| Pin invariants | Crash/property tests prove one owner, no gap after committed transfer, no advance without receipt |
+| Event durability | Lag, restart, duplicate delivery, corrupt projection, and replay tests |
+| Cognitive independence | Toggle/fail each cadence separately across 30/110-turn fixtures |
+| Synthesis continuity | Same-day, capped-input, duplicate, crash-before-commit, and cumulative-retrieval tests |
+| Resource governance | Outage, stale health, locality, permission, budget, subagent inheritance, and fallback tests |
+| Scheduler correctness | Lease expiry, late result, cancellation race, idempotent retry, and dependency tests |
+| Gitea resilience | Offline outbox, conflicting remote update, required-check failure, and reconciliation tests |
+| Schema migration | Old fixture migrates once; all current readers reject unmigrated dialects with actionable errors |
+| Performance | Versioned benchmark protocol measures p50/p95 latency, queue depth, replay time, I/O, tokens, model calls, and interactive-priority isolation |
+| Capability preservation | Deterministic golden fixtures and typed invariants compare cognitive outputs, evidence links, surfaces, and rollback paths before/after optimization |
+
+### Initial performance budgets
+
+Budgets are provisional baselines to measure and revise, not decorative promises:
+
+- reflex processing: p95 under 10 ms excluding external I/O;
+- hot event publish after durable append: p95 under 25 ms locally;
+- projection read for header/task pane: p95 under 20 ms;
+- direct-user work begins despite background load: p95 under 100 ms;
+- unchanged-evidence cognitive pass avoids a model call in at least 80% of the
+  deterministic no-change fixture cases;
+- replay from the latest projection checkpoint: under 2 seconds for 100,000
+  envelopes on Nick's current machine;
+- no measurable semantic-parity loss across the reference fixture matrix.
+
+The first implementation phase records the current pre-change system only as an
+operational cost/latency baseline; it cannot stand in for capabilities that do
+not yet exist. Foundation then builds the smallest semantically complete,
+unoptimized reference implementing every approved record, receipt, authority,
+and entry-path contract. That reference supplies the golden capability fixtures
+and becomes the sole before/after baseline for optimization. Both baselines are
+owner-approved BenchmarkBaselineRecords, but only the second can accept or
+reject capability preservation. The reproducible workload, environment
+fingerprint, sample counts, determinism controls, tolerance rules, and
+baseline-change process are defined in
+`specs/2026-09-03-planning-task-orchestration-benchmark-protocol.md`. A budget
+without a baseline is merely a wish wearing a stopwatch.
+
+## [S10] Batch chaining and context minimization
+
+**Section status:** Approved by Nick; added at his request so approved
+execution never requires the LLM to hold or re-process the full plan.
+
+### Successor selection
+
+- Within an approved plan, verified batches chain by event, not by model
+  attention. A BatchCompletionReceipt triggers a deterministic successor
+  selector that consults the dependency graph and approval scope, then emits
+  WorkRequested for exactly the next eligible unit.
+- A successor becomes eligible only when every dependency has a verified
+  receipt, the unit is within the approved item/version set, and resources are
+  available. The selector records its choice and rationale as an EffectRecord;
+  it cannot choose a unit whose dependencies are unverified.
+- If multiple units become eligible, the scheduler orders them by declared
+  dependency order and priority policy, never by model preference.
+
+### Per-unit context bundle
+
+- Each worker receives a bounded handoff manifest: unit ID, dependency of
+  verified receipts, acceptance canaries, resource posture, evidence
+  references, schema versions, and the exact expected receipt contract.
+- The manifest contains references and hashes, not copied transcripts or plan
+  history. Workers resolve evidence slices on demand through the Evidence
+  Store's bounded manifest.
+- No worker may load the full IntentRecord or PlanRecord; anything beyond the
+  manifest requires an explicit, logged resolution request with a budget.
+
+### Chain boundaries
+
+- Chaining applies strictly within approved execution. Planning to execution
+  remains gated by Nick's explicit **start**; mode changes, goal revisions, and
+  scope changes invalidate eligibility according to the ApprovalRecord rules.
+- A chain never skips receipt verification. Failed or unverified units enter
+  retryable_failure, terminal_failure, or blocked through the failure state
+  machine. A successor can never be selected on a predecessor's self-report.
+- Subjective or owner-judgment outcomes pause the chain and wait for Nick;
+  objective units continue only while their dependency closure is objective.
+
+### Resume and idempotency
+
+- After interruption, crash, or restart, execution resumes from the last
+  verified receipt, not from the first unit. The successor selector is
+  deterministic on the same durable event state, so re-entry produces the same
+  next unit.
+- Unit execution carries idempotency keys; a repeated WorkRequested event after
+  a crash replays the same EffectRecord instead of spawning a duplicate.
+- Cancellation is recorded as a terminal state for the chain position, and any
+  successor selection after cancellation requires a fresh explicit start
+  approval for the remaining scope.
+
+### Verification
+
+- Chain canaries prove: exactly one eligible successor per receipt; no
+  successor on unverified dependencies; bounded manifest size; no full-plan
+  reads; identical successor choice on replay from the same event state; and
+  no chain advance after cancellation or outside approval scope.

survey/souveraine/ablations.md

@@ -0,0 +1,123 @@
+# Planning-safe ablation cards
+
+These experiments resolve architectural uncertainty without mutating Rune's
+live runtime. Owner for execution and acceptance is Nick unless explicitly
+delegated after **start**. Every run writes raw results and a signed manifest
+under the future plan's evidence directory.
+
+## A1 — Cognitive independence
+
+- **Target:** disposable cadence harness modeled on the recorded Souveraine
+  contracts; later repeated as an implementation acceptance gate for Rune.
+- **Hypothesis:** disabling or failing one cadence does not suppress another.
+- **Fixture:** deterministic 30- and 110-turn transcripts with N+1, reflection,
+  and synthesis independently on/off/failing.
+- **Measure:** invocation counts, input IDs, outputs, failures, latency, tokens.
+- **Pass:** each enabled cadence meets its trigger/deadline in 100% of fixtures;
+  another cadence's state changes no expected invocation.
+- **Capability risk:** missed immediate correction, reflection, or continuity.
+- **Decision:** retain separate queues/triggers or revise coupling before build.
+
+## A2 — Synthesis cursor integrity
+
+- **Target:** disposable cursor harness using Souveraine-shaped journal data.
+- **Hypothesis:** item-ID transactions cover every input exactly once, unlike a
+  date-only cursor under same-day and capped batches.
+- **Fixture:** duplicate dates, late arrivals, 60k-character overflow, crash
+  before/after output commit, and replay.
+- **Measure:** omitted, duplicated, falsely covered, and recoverable item IDs.
+- **Pass:** zero omission/false coverage; replay converges to one committed
+  output per input set.
+- **Capability risk:** irreversible continuity loss.
+- **Decision:** item-ID cursor is mandatory unless another scheme meets the same
+  invariant.
+
+## A3 — Entry-path semantic parity
+
+- **Target:** planning-safe disposable conversation/transport harness using
+  Rune's documented current entry-path contracts; later repeated against real
+  adapters as an implementation acceptance gate.
+- **Hypothesis:** one seeded request yields equivalent identity, tools, history,
+  images, cancellation, surfacings, failure, and receipt semantics locally and
+  through server, remote, and TUI paths.
+- **Fixture:** deterministic provider, fixed agent snapshot, identical request,
+  injected tool failure, cancellation, image, and pending surfacing.
+- **Measure:** typed event sequence and canonical-state hashes.
+- **Pass:** exact invariant equality; approved negotiation exceptions must match
+  their owner, expiry, and restoration records.
+- **Capability risk:** entry-path-dependent identity or functionality.
+- **Decision:** no degraded path becomes production until parity passes.
+
+## A4 — Resource routing and inheritance
+
+- **Target:** disposable registry/router/scheduler harness.
+- **Hypothesis:** eligibility removes impossible resources and every child task
+  inherits locality, provider, budget, depth, timeout, and concurrency policy.
+- **Fixture:** provider outage, stale health, forbidden cloud, cost ceiling,
+  local overload, nested subagents, and fallback exhaustion.
+- **Measure:** eligible set, rank, lease, fallback, cost, and policy violations.
+- **Pass:** zero ineligible leases or child-policy escapes; identical inputs and
+  snapshot version yield identical eligible sets. Ranking efficacy is measured
+  on a fixed task/resource matrix: the advisory router must select an
+  owner-labelled acceptable top-three resource in at least 90% of cases and
+  never outrank an ineligible resource.
+- **Capability risk:** silent cloud use, runaway workers, or false availability.
+- **Decision:** alter filters/leases before connecting real providers.
+
+## A5 — Event lag and replay
+
+- **Target:** disposable event-store/bus/projection harness.
+- **Hypothesis:** bounded-bus lag affects latency only; durable offsets restore
+  every non-coalescible event and the same projection hash; revoked keys cannot
+  regain authority, an explicitly recovered/rotated key can resume authorized
+  operation, and no partition permits two simultaneous autonomous hearth
+  leases.
+- **Fixture:** 100k envelopes, forced receiver lag, duplicate delivery, restart,
+  corrupt projection, interrupted checkpoint, revoked/rotated peer keys,
+  duplicate agent identity, two claimed hearths, and a network partition that
+  later heals.
+- **Measure:** loss, duplication after idempotency, recovery time, state hash,
+  rejected signer count, key-recovery result, and concurrent-hearth ownership.
+- **Pass:** zero lost authority/completion events, identical final hash, recovery
+  within the owner-approved benchmark baseline, all unpinned/revoked signers
+  rejected, the approved replacement key completes a signed round trip, and
+  never more than one active hearth lease during or after a partition. If
+  availability must yield to preserve this invariant, the isolated side enters
+  an explicit read-only/limb state rather than acting autonomously.
+- **Capability risk:** silent work loss or fabricated completion state.
+- **Decision:** event durability is prerequisite for scheduler authority.
+
+## A6 — UI engine capability rehearsal
+
+- **Target:** existing ratatui and tuie paths in disposable checkouts.
+- **Hypothesis:** an engine may be retired only after the candidate supports the
+  approved capability baseline.
+- **Fixture:** chat, resume, tools, images, cancellation, interjection, voice,
+  schedules, settings, manager, onboarding, pins, failures, accessibility.
+- **Measure:** pass/fail plus event and receipt parity per capability.
+- **Pass:** 100% required capability parity; exceptions require explicit owner
+  approval, expiry, and restoration canary.
+- **Capability risk:** removing a working surface behind a prettier scaffold.
+- **Decision:** keep both engines until parity, then remove confirmed bloat only
+  with Nick's separate approval.
+
+## A7 — Git provenance versus transactional hot state
+
+- **Target:** disposable concurrent-write harness.
+- **Hypothesis:** atomic hot records plus asynchronous Git provenance preserve
+  history while reducing contention and eliminating lost cursor/queue updates.
+- **Fixture:** concurrent turns, queue updates, pin transfer, crash windows,
+  malformed write, delayed Git commit, rollback, and identical long transcripts
+  processed with cull, microcompact, sliding-window, sliding-reflect, and summary
+  policies.
+- **Measure:** lost updates, recovery point, write latency, provenance coverage,
+  retained commitments/source links, token reduction, and retrieval accuracy on
+  a fixed question set.
+- **Pass:** zero lost canonical updates; every committed record eventually maps
+  to provenance; rollback reconstructs the same accepted state. A compaction
+  strategy is acceptable only if it retains every golden commitment and source
+  link while meeting the approved token target; otherwise the result remains a
+  workload-specific trade-off rather than a default.
+- **Capability risk:** either audit loss or fragile hot-path serialization.
+- **Decision:** choose the fastest design satisfying both atomicity and eventual
+  provenance.

survey/souveraine/claims.tsv

@@ -0,0 +1,42 @@
+id	claim	support_sources	contradict_sources	confidence
+C001	The public checkout is not independently buildable because required tuie path dependencies are absent	S001,S002		high
+C002	Local and server-created conversations do not preserve equivalent identity memory and skill semantics	S003		high
+C003	Remote conversation resume is an API-design gap rather than only an unwired client call	S004		high
+C004	Non-loopback CLI remote chat lacks the authenticated backend used by the TUI path	S005		high
+C005	Memory configuration contains controls that persist but do not govern live repositories	S006		high
+C006	N+1 currently acts as a load-bearing host for reflection Archivist and compaction warnings	S007,S009		high
+C007	Documented or configured post-turn cadences diverge from hard-coded execution behavior	S008		high
+C008	Compaction is advisory and model-invoked rather than a deterministic truncation policy	S009		medium-high
+C009	Subagent governance controls and per-agent provider isolation are incomplete	S010		high
+C010	Removing ratatui before parity would remove functional terminal chat capabilities	S011		high
+C011	Sensorium and Matrix include meaningful structure but are not fully operational output surfaces	S012		medium-high
+C012	Commit summaries and configuration surfaces cannot be treated as execution evidence	S006,S008,S012		high
+C013	The architecture pivoted from local-first language to one server-authoritative Rust substrate with local and remote viewports	S013,S014		high
+C014	The stated lineage combines Coquette and a Unified Consciousness prototype with mechanisms studied from Letta-Code jcode and Claw-Open	S013,S015,S016		medium-high
+C015	Early plans distinguish intended phases and stubs from implemented mechanisms and must not be read as current behavior	S015,S016,S017		high
+C016	Public-source documentation is intentionally incomplete and some claimed archives are absent from the public branch	S017,S027,S028		high
+C017	Tools are deliberately framed as embodied sensors and subagents as bounded forks of the operational substrate	S018		medium-high
+C018	The nervous system joins bounded event broadcast cron identity credentials and durable event records but durability varies by entry path	S019,S036		high
+C019	Subconscious state is deliberately distributed across ledger boxes inner voice and persisted conversation rather than held in one blob	S019,S029,S030		high
+C020	N+25 reflection is a bounded tool-using maintenance pass but its configured controls and write authority diverge from runtime	S020,S029,S043		high
+C021	N+100 Archivist is implemented but its date cursor and bounded input can mark unseen journal material as covered	S021,S029,S031		high
+C022	Federation separates machine transport identity from portable agent identity but configured peer trust is not enforced by the bridge	S022,S023,S038		high
+C023	Hearth and limb roles express a valuable single-home invariant but live split-brain prevention remains incomplete	S024,S038		medium-high
+C024	Provider abstraction and per-agent routing exist but richer capability routing and subagents do not consistently use them	S025,S032,S035		high
+C025	The dual-UI migration preserves experimental work but produces capability divergence and continuing dependency residue	S026,S042,S046		high
+C026	Development history and current public state must be reconstructed together because current docs intentionally omit superseded and private context	S027,S028,S046		high
+C027	N+1 is incorrectly coupled as the lifecycle host for reflection Archivist and pressure warnings	S007,S009,S029,S043		high
+C028	Recursive pinning of every system markdown file preserves identity but creates unbounded context-pressure risk	S030		medium-high
+C029	Injecting only the newest non-cumulative synthesis can remove older compressed continuity from active context	S030,S031		high
+C030	Archivist cursoring needs item-level transactional progress rather than a maximum date marker	S031		high
+C031	Subagent background role depth concurrency timeout and provider-governance promises exceed current execution controls	S032		high
+C032	Schedule creation manual triggers and runtime sensing disagree on paths and semantics	S033,S034,S043		high
+C033	LocalBackend and standalone server instantiate different autonomous services despite sharing the same core server	S034,S040		high
+C034	Model physics and task-fit routing exist as a disconnected advisory subsystem rather than the authority for runtime selection	S035		high
+C035	EventBus provides useful decoupling but bounded non-replay delivery cannot serve as completion or durable task truth	S036,S038		high
+C036	Matrix has architectural shape but is neither registered nor capable of a complete inbound-to-visible-reply loop	S037		high
+C037	Federation authenticates self-declared signers but does not pin configured peer keys or replay disconnect gaps	S038		high
+C038	Remote transport is a lossy projection that can erase lifecycle evidence and make inference failure resemble clean completion	S039		high
+C039	Mode-specific composition roots are the main cause of local server and remote capability divergence	S039,S040		high
+C040	Conversational voice is operational in ratatui but demonstrative in tuie and is not a surface-neutral sensorium capability	S041,S042		high
+C041	Configuration persistence does not prove runtime authority and some updates create live-versus-disk split state	S043,S045		high

survey/souveraine/mechanisms.tsv

@@ -0,0 +1,19 @@
+id	mechanism	implementation_status	interactions	disposition	rune_target	capability_loss_if_omitted	evidence	uncertainty	required_ablation
+M001	One constitutive substrate with multiple viewports	Partly implemented; entry paths diverge	Conversation construction, tools, memory, surfaces	adapt	S8 entry-path parity; S9 composition root	Identity and capability vary by interface	S003,S014,S039,S040	Production parity unmeasured	A3
+M002	N+1 immediate subconscious review	Implemented but coupled	Primary completion, inbox, tools, reflection, synthesis	preserve-and-decouple	S8 three strata; S9 cognitive flow	Immediate omissions and commitments go unnoticed	S007,S019,S029	Adaptive trigger selection is deferred tuning after semantic independence	A1
+M003	N+25 wider reflection	Implemented with hard-coded cadence and limited write authority	Transcript evidence, memory tools, post-turn lifecycle	preserve-and-decouple	S8 independent cadences; S9 cognitive flow	Cross-turn learning and correction weaken	S008,S020,S029,S043	Boundary-versus-deadline selection is deferred tuning; A1 tests independence only	A1
+M004	N+100 archival synthesis	Implemented with cursor risks	Journal items, synthesis chain, prompt injection	preserve-and-rebuild-cursor	S8 memory and synthesis	Long-horizon continuity degrades	S021,S030,S031	Hierarchy and cadence selection are deferred tuning; A2 tests lossless cursoring only	A2
+M005	Ledger, inbox, inner voice, and conversation channels	Implemented across separate stores	N+1, primary prompt, surfacing, durable memory	preserve-under-one-schema	S8 subconscious state; S9 records	Different retrieval and urgency semantics collapse	S019,S029,S030	Retention tiers are deferred tuning; A1 and A7 test independence and atomic provenance	A1,A7
+M006	Git-backed markdown provenance	Implemented	Identity, memory writes, reflection, synthesis	preserve-for-history	S8 memory and synthesis	Human-readable audit and rollback are lost	S006,S030,S031	Hot-write architecture	A7
+M007	Recursive system-memory pinning	Implemented without explicit budget	Prompt assembly, identity, context pressure	constrain-with-budget	S8 memory and synthesis	Overconstraint could omit identity context; unconstrained growth exhausts context	S030	Priority/overflow tuning is deferred; A3 and A7 guard parity and retention	A3,A7
+M008	Tools as embodied sensors	Implemented conceptually and structurally	Capability catalog, prompts, subagents	preserve	S8 resource authority	Agent orientation and boundary legibility weaken	S018	Description-quality evaluation is deferred UX research; A4 tests authority only	A4
+M009	EventBus nervous system	Implemented as bounded non-durable broadcast	Cron, surfaces, federation, registry, telemetry	adapt-with-durable-spine	S8 canonical spine; S9 event store	Decoupling is lost if removed; events are lost if copied unchanged	S019,S036,S038	Throughput and replay cost	A5
+M010	Schedules and background turns	Implemented with path and mode divergence	Cron sensor, local backend, turn injector, surfacing	preserve-and-unify	S9 scheduler and effects	Proactive commitments and reminders fail	S033,S034,S040,S043	Quota tuning is deferred; A4 and A5 test authority and durability	A4,A5
+M011	Per-agent provider routing	Partly implemented; subagents bypass it	Primary, subconscious, reflection, Archivist, subagents	preserve-and-enforce	S8 resource authority	Sovereignty, locality, cost, and model fit erode	S025,S032,S035	Ranking quality	A4
+M012	Task-aware model physics router	Implemented but disconnected	Catalog, task signature, context pressure	adapt-as-advisory	S8 two-stage routing	Potential efficiency and fit gains are lost	S035	Ranking efficacy unmeasured	A4
+M013	Subagent forks	Implemented with unenforced controls	Tools, memory root, provider, nesting, background work	preserve-with-inherited-authority	S8 resource authority; S9 scheduler	Parallel investigation and bounded delegated work disappear	S010,S018,S032	Optimal depth/concurrency are deferred tuning; A4 tests inherited limits	A4
+M014	Agent versus device cryptographic identity	Implemented	Federation transport, reach/consult, consent	preserve-and-enforce-peer-pinning	S8 surface parity and trust	Portable identity or transport accountability is lost	S022,S023,S038	Key lifecycle and recovery	A5
+M015	Hearth and limb single-home model	Partly implemented	Federation, device registry, split-brain handling	preserve-invariant	S8 failure handling; S9 authority	Competing autonomous homes can act concurrently	S024,S038	Consensus under partition	A5
+M016	Surface-neutral sensorium	Architectural shape; Matrix incomplete	EventBus, room mapping, remote transport, UI	preserve-goal-not-stubs	S8 entry-path parity; S9 surface gateway	New surfaces fork behavior or cannot return replies	S037,S039,S040	Surface baseline	A3,A6
+M017	Dual ratatui/tuie engines	Both present; capability parity absent	Chat state, voice, manager controls, dependencies	preserve-until-measured	S8 parity; S9 verification	Premature removal loses voice or working controls	S026,S041,S042,S046	Replacement completeness	A6
+M018	Context compaction strategies	Implemented but model-invoked and N+1-warning-bound	Prompt pressure, memory tool, evidence retention	preserve-with-explicit-policy	S8 memory; S9 scheduler	Context exhaustion if omitted; evidence loss if applied opaquely	S009,S029,S030	Strategy-by-workload quality	A2,A7

survey/souveraine/question.md

@@ -0,0 +1,60 @@
+# Souveraine/Fimeg architecture survey
+
+## Research question
+
+Which mechanisms, development choices, constraints, and capability-bearing
+interactions in Souveraine's public primary-source history should Rune preserve,
+adapt, test, or reject when designing a subconscious and resource architecture
+that has one authoritative execution path?
+
+## Sub-questions
+
+1. What lineage, goals, and system boundaries does the author state?
+2. Which mechanisms are implemented, which are aspirational, and which are
+   configured but disconnected?
+3. How do N+1 subconscious work, reflection, Archivist synthesis, memory,
+   providers, subagents, sensorium, scheduling, and UI surfaces interact?
+4. Which couplings are capability-critical, accidental, or contradicted by live
+   behavior?
+5. What would Rune lose by omitting each mechanism?
+6. Which uncertainties require an ablation rather than an architectural guess?
+
+## Ideal answer
+
+An evidence-linked mechanism and interaction map that separates source intent
+from observed implementation, exposes contradictions, states capability-loss
+risk for every omission, and translates findings into testable design changes
+without introducing a second authority path.
+
+## Scope and stopping rule
+
+- Primary material only: public repository files, commit history, task/design
+  records, forge metadata, and author-authored documentation.
+- Public revision baseline: Codeberg branch `public` at
+  `80bfb3a59935e51b4df21abbf4f9545ee9a0af56`.
+- Examine at least 30 distinct source records, including dead ends and
+  contradictions, or stop after five consecutive examined sources add no
+  material claim.
+- Record whether claim saturation was reached rather than pretending a source
+  count proves completeness.
+- Planning and research only; no Rune runtime implementation.
+
+## Search clusters
+
+- Souveraine subconscious N+1 consciousness engine reflection Archivist
+- Souveraine memory git compaction identity substrate
+- Souveraine provider per-agent resource routing subagent
+- Souveraine EventBus sensorium Matrix federation device registry
+- Souveraine scheduler cron reminders background work
+- Fimeg Souveraine design task roadmap architecture
+- git history N+1 reflection memory provider subagent sensorium
+- implemented versus configured unused TODO stub unimplemented
+- local remote backend semantic parity conversation prompt skills
+- tuie ratatui migration capability parity
+
+## Baseline
+
+The cold baseline used three obvious repository searches: documentation and
+manifest inspection, runtime symbol search, and recent commit-history review.
+It produced twelve initial source records and twelve claims, but no complete
+development-history reconstruction and no source-linked Rune mapping.

survey/souveraine/report.md

@@ -0,0 +1,160 @@
+# Souveraine/Fimeg primary-source synthesis
+
+## Answer
+
+Souveraine's strongest transferable idea is not any single N+ cadence. It is the
+combination of durable identity, explicit temporal cognition, embodied tools,
+surface-independent events, and a single constitutive substrate. The public
+implementation also demonstrates the danger of letting those ideas acquire
+separate composition roots: configuration, local/server/remote modes,
+subagents, schedules, federation, and UI surfaces can all describe one system
+while executing different ones [S003, S029, S032-S040].
+
+Rune should preserve the mechanisms but replace implicit lifecycle coupling
+with one authoritative event/effect spine. Reflexes should gather facts;
+subconscious passes should propose bounded effects; an authority-aware
+scheduler should commit those effects transactionally; durable ledgers should
+record evidence and cursors; every surface should project the same canonical
+state. Model prose may interpret state, but must never become availability,
+completion, resource, or authorization truth.
+
+## Development reconstruction
+
+The documentary lineage begins with Coquette and a Unified Consciousness
+prototype, then explicitly studies Letta-Code, jcode, and Claw-Open [S013-S017].
+The design pivots from local-first language to one Rust substrate supporting
+local and remote viewports [S013-S014]. It then grows through sensor/tool
+framing, an event nervous system, first-class subconscious state, N+25
+reflection, N+100 synthesis, federation identity, provider abstraction, and a
+second UI engine [S018-S026]. A later documentation purge makes current-source
+inspection necessary but insufficient: some development rationale survives
+only in historical objects [S027-S028].
+
+The current public branch is therefore evidence of both architecture and
+migration. It is not a clean final specification. Configuration and commit
+language are claims to test, not execution proof [S006-S012, S043-S047].
+
+## Mechanisms worth preserving
+
+1. **Temporal cognition with distinct jobs.** N+1 notices immediate omissions,
+   N+25 reflects across a wider transcript, and N+100 synthesizes episodic
+   memory [S020-S021, S029-S031]. Preserve the separation of timescales, but
+   trigger each independently from typed events and policy rather than nesting
+   all three behind an N+1 boolean.
+2. **Durable multi-channel subconscious state.** Ledger, inbox, inner voice,
+   and conversation history serve different retrieval and surfacing purposes
+   [S019, S029-S030]. Preserve those roles under one schema with stable IDs,
+   transactional cursors, and explicit ownership.
+3. **Embodied, inspectable tools.** Treating tools as senses improves agent
+   orientation and makes capability boundaries legible [S018]. Preserve the
+   descriptions, but let deterministic capability records—not descriptions—say
+   whether a tool exists and is authorized.
+4. **Agent/device identity separation.** A portable identity and a transport
+   identity answer different trust questions [S022-S024, S038]. Preserve the
+   distinction and enforce configured peer-key pinning before accepting events.
+5. **One substrate, many surfaces.** A common backend contract and event
+   envelope are sound ambitions [S036-S040]. Preserve them through one
+   production composition root and parity canaries, not permissive defaults
+   that silently erase features.
+6. **Git-backed provenance.** Human-readable memory and auditable changes are
+   valuable [S006, S030-S031]. Preserve provenance while moving hot mutable
+   state and cursors to atomic records; Git commits are history, not a locking
+   primitive.
+
+## Contradictions that change Rune's design
+
+- Disabling N+1 also suppresses reflection, Archivist, and pressure warnings;
+  independent configuration is therefore not independent authority [S007-S009,
+  S027].
+- Archivist's date cursor can skip same-day or character-capped entries, while
+  newest-only synthesis can evict older compressed continuity [S030-S031].
+- Per-agent provider routing does not govern subagents, and the richer model
+  router is disconnected from live turn selection [S032, S035].
+- Schedule writers, sensors, and manual trigger semantics disagree; local-only
+  service startup means entry path changes autonomy [S033-S034, S040].
+- EventBus is bounded and non-replay while federation and surfaces rely on it;
+  it cannot be durable completion truth [S036, S038].
+- Remote mode loses history, cancellation, native images, tool lifecycle,
+  surfacings, and reliable failure semantics [S039].
+- Matrix and tuie demonstrate architectural shape without complete execution;
+  ratatui still carries working voice and mature interaction [S037, S041-S042].
+
+## Evidence-backed architecture for Rune
+
+### One spine
+
+All meaningful inputs become immutable typed envelopes with stable event IDs,
+causal parent IDs, actor/device identity, task/pin references, evidence age,
+and authorization context. A durable append-only event store records them
+before fan-out. The in-memory bus is only low-latency delivery; consumers resume
+from durable offsets after lag or restart.
+
+### Three execution strata
+
+1. **Reflex layer:** deterministic, cheap, idempotent facts such as tool
+   availability, process state, budget, deadlines, stale pins, and failed
+   checks. It cannot reinterpret intent.
+2. **Subconscious layer:** bounded model passes consume evidence capsules and
+   emit proposals: surface, persist, investigate, reschedule, reroute, or halt.
+   Proposals carry confidence, source IDs, expiry, cost, and possible
+   capability loss. They do not mutate canonical state directly.
+3. **Scheduler/effect layer:** validates authority, dependencies, budgets,
+   idempotency keys, and current versions, then commits accepted effects and
+   verification receipts transactionally.
+
+N+1, reflection, synthesis, and any future cadence are independent consumers
+with separate triggers, budgets, cursors, and health. One being may have several
+cognitive timescales; one toggle should not quietly lobotomize the others.
+
+### Resource authority
+
+A canonical resource registry records providers, models, tools, workers,
+surfaces, and storage with observed health, capabilities, cost, locality,
+authorization, and evidence timestamps. A deterministic eligibility filter
+removes impossible candidates; an advisory router ranks the remainder; the
+scheduler records the final assignment and fallback chain. Subagents inherit
+the same authority object and cannot bypass locality, provider, budget, depth,
+or concurrency policy.
+
+### Memory and synthesis
+
+Every episodic item has a stable ID and synthesis state. A synthesis transaction
+records the exact included IDs, output ID, prior cursor, and commit receipt;
+only then does it advance. Syntheses form a cumulative linked chain or a
+retrievable hierarchy, so newest does not mean only. Identity pins have explicit
+budgets and priorities; overflow becomes visible pressure, never silent
+truncation.
+
+### Surfaces and parity
+
+Local, server, remote, TUI, voice, and network surfaces use the same
+conversation constructor and event schema. Capability negotiation is explicit:
+unsupported features return structured absence rather than successful no-ops.
+Parity canaries replay one seeded turn across each entry path and compare
+identity hash, tools, history, images, cancellation, surfacings, failure state,
+and completion receipt.
+
+## Required pre-implementation ablations
+
+1. Independent N+1/reflection/synthesis toggles over 30/110-turn fixtures.
+2. Item-ID synthesis cursor versus date cursor under same-day and capped input.
+3. Local/server/remote semantic parity using a deterministic provider.
+4. Resource routing with provider outage, locality restriction, and subagent
+   inheritance.
+5. EventBus lag/restart with and without durable replay.
+6. Ratatui/tuie capability rehearsal before removing either engine.
+7. Git-backed versus transactional hot-state writes under concurrent turns.
+
+## Method
+
+The survey examined 47 distinct primary-source records from the public
+Codeberg repository branch `public` at revision
+`80bfb3a59935e51b4df21abbf4f9545ee9a0af56`, including current code,
+historical files, commits, configuration, and explicit task records. The minimum
+depth was exceeded. Claim saturation was **not** reached: late sources still
+added material findings about schedule authority, federation trust, remote
+failure semantics, and UI capability divergence. That is a limit, not an
+invitation to manufacture closure.
+
+The auditable trail is in `question.md`, `sources.tsv`, `claims.tsv`,
+`source-locators.tsv`, `mechanisms.tsv`, and `ablations.md`.

survey/souveraine/source-locators.tsv

@@ -0,0 +1,48 @@
+id	immutable_revision	locator	retrieved_utc	verification
+S001	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	README.md:11-23; Cargo.toml:61-62	2026-09-03	git object and paths verified
+S002	71d3418f0bd415f71d7e42ce9b7756f88d5e5164	.gitea/workflows/ci.yml:18-25	2026-09-03	git commit and path verified
+S003	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/backend/local/mod.rs:192-243,313-363; src/api/handlers.rs:104-124; src/server/turn.rs:145-185	2026-09-03	git object and paths verified
+S004	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/backend/remote.rs:122-133; src/api/mod.rs:17-24,39-46; docs/tasks/remote-conversation-loading.md	2026-09-03	git object and paths verified
+S005	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/main.rs:948-1037; src/backend/remote.rs:24-69,153-171; src/ui/chat/mod.rs:395-418	2026-09-03	git object and paths verified
+S006	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/core/config.rs:442-461; src/core/memory/mod.rs:105-141,328-387,423-443; src/server/agent_inventory.rs:73-86	2026-09-03	git object and paths verified
+S007	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/server/turn.rs:820-880; src/server/consciousness_engine.rs:247-334	2026-09-03	git object and paths verified
+S008	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/core/config.rs:293-365,547-567; src/server/consciousness_engine.rs:265-302	2026-09-03	git object and paths verified
+S009	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	README.md:39-40; src/server/consciousness_engine.rs:325-332; src/server/turn.rs:47-54; src/core/memory/mod.rs:725-750	2026-09-03	git object and paths verified
+S010	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/core/config.rs:398-436; src/server/subagent.rs:51-61,86-105,138-151	2026-09-03	git object and paths verified
+S011	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/main.rs:116-118,895-945; src/ui/tuie_app.rs:150-230; src/ui/app/mod.rs:587-617,999-1039	2026-09-03	git object and paths verified
+S012	f9122c3230740e79256ffa67e6cbd7cd65a30d18	src/core/sensorium/mod.rs:241-429; src/core/sensorium/matrix/mod.rs:9-23,142-181,301-331; src/server/mod.rs:313-321	2026-09-03	git commit and paths verified
+S013	d64a6e97945773a7793c893b80379c5e8fb4f3b4	SOUVERAINE_MASTER_SPEC.md:12-40,128-139,332-442	2026-09-03	git historical object verified
+S014	d64a6e97945773a7793c893b80379c5e8fb4f3b4	ARCHITECTURE_CLARIFICATION.md:9-46,102-198,284-end	2026-09-03	git historical object verified
+S015	d64a6e97945773a7793c893b80379c5e8fb4f3b4	ENHANCEMENT_ROADMAP.md:1-8,75-164,188-261,324-477,507-550	2026-09-03	git historical object verified
+S016	d64a6e97945773a7793c893b80379c5e8fb4f3b4	PHASES.md:26-190	2026-09-03	git historical object verified
+S017	d64a6e97945773a7793c893b80379c5e8fb4f3b4	STATUS.md:6-159,161-212	2026-09-03	git historical object verified
+S018	7da881ad8a98d98d636be406b006bf77b5ac1e92	commit diff: src/core/tools/{defs,subagent}.rs; src/server/consciousness_engine.rs; src/ui/component.rs	2026-09-03	git commit and paths verified
+S019	35534f1c7303cf49f7cded727546417cc9d65d11	commit diff: src/core/nervous/{mod,cron,event_log,handler}.rs; src/core/identity/seed.rs; src/core/subconscious/mod.rs	2026-09-03	git commit and paths verified
+S020	8f910ec8a8126b8e1da915635022eacb43f45d40	commit diff: src/core/reflection/mod.rs; src/server/consciousness_engine.rs	2026-09-03	git commit and paths verified
+S021	5c2632762a50314a90a145ee36f2ac15dc259ccb	commit diff: src/core/archivist/mod.rs; src/server/{consciousness_engine,mod}.rs	2026-09-03	git commit and paths verified
+S022	4b9c5e2031e6cce039bd75747ede8f710047f2dd	commit diff: src/server/federation/{bridge,types}.rs; src/api/{handlers,mod}.rs	2026-09-03	git commit and paths verified
+S023	055a3d7b38e67a7f8d3b3a19d7f4b774cd4bb441	commit diff: src/core/identity/summon.rs; src/server/{listener,summon_handler}.rs	2026-09-03	git commit and paths verified
+S024	3629fa8b78688afa24187c35b50f0442cf3c24d5	commit diff: src/core/config.rs; src/server/{device_registry,listener}.rs; src/server/federation/bridge.rs	2026-09-03	git commit and paths verified
+S025	bc6ee12d471011a4132e32d618014ec83689d6b8	commit diff: src/bridge/{mod,provider}.rs; src/bridge/providers/{mod,openai_oauth,responses}.rs; src/server/turn.rs	2026-09-03	git commit and paths verified
+S026	61bf34177e9731ef47505de4cfd5a002c7a1254e	commit diff: src/main.rs; src/ui/{mod,tuie_app}.rs; src/ui/screens/*; src/ui/widgets/*	2026-09-03	git commit and paths verified
+S027	832d80a1ff616603c4471c011733472ee9765399	commit diff: deletion hunks for ARCHITECTURE_CLARIFICATION.md, ENHANCEMENT_ROADMAP.md, PHASES.md, STATUS.md and 16 related root docs	2026-09-03	git commit and deletion paths verified
+S028	845a3f58a924ce837156f5a099efe6692b1f8d47	commit diff: README.md and deletion hunks for .skills/{context-doctor,feature-dev,souveraine-architecture}/SKILL.md	2026-09-03	git commit and paths verified
+S029	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/server/consciousness_engine.rs:204-474,536-974	2026-09-03	git object and path verified
+S030	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/core/prompt.rs:295-495,508-790	2026-09-03	git object and path verified
+S031	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/core/archivist/mod.rs:148-295,301-510	2026-09-03	git object and path verified
+S032	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/server/subagent.rs:29-221	2026-09-03	git object and path verified
+S033	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/core/nervous/cron.rs:17-170,173-293	2026-09-03	git object and path verified
+S034	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/backend/local/mod.rs:1-123; src/core/tools/schedule.rs:30-268	2026-09-03	git object and paths verified
+S035	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/bridge/mod.rs:22-139; src/bridge/model_router.rs:77-271	2026-09-03	git object and paths verified
+S036	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/core/nervous/mod.rs:11-114; src/core/nervous/event_log.rs:10-163	2026-09-03	git object and paths verified
+S037	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/core/sensorium/matrix/mod.rs:1-333; src/core/sensorium/matrix/client.rs:1-183	2026-09-03	git object and paths verified
+S038	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/server/federation/bridge.rs:15-180; src/server/federation/types.rs:8-49	2026-09-03	git object and paths verified
+S039	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/backend/remote.rs:14-214,239-277; src/api/handlers.rs:146-261	2026-09-03	git object and paths verified
+S040	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/backend/local/mod.rs:1-154,174-440; src/backend/local/consciousness.rs:16-161	2026-09-03	git object and paths verified
+S041	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/ui/app/voice.rs:7-301; src/core/voice/client.rs:133-245	2026-09-03	git object and paths verified
+S042	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	src/ui/tuie_app.rs:419-574,631-709,733-862; src/ui/screens/presence.rs:242-383	2026-09-03	git object and paths verified
+S043	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	souveraine.example.toml:44-115; src/core/config.rs:170-425,523-611	2026-09-03	git object and paths verified
+S044	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	docs/tasks/remote-conversation-loading.md:7-47	2026-09-03	git object and range verified
+S045	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	docs/tasks/settings-error-display.md:7-35	2026-09-03	git object and range verified
+S046	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	docs/tasks/dead-code-cleanup.md:7-59	2026-09-03	git object and range verified
+S047	80bfb3a59935e51b4df21abbf4f9545ee9a0af56	docs/tasks/numeric-cast-safety.md:7-57	2026-09-03	git object and range verified; retained low-relevance dead end

survey/souveraine/sources.tsv

@@ -0,0 +1,48 @@
+id	url_or_id	kind	year	title	relevance	credibility	claim_ids	notes
+S001	codeberg:Fimeg/Souveraine@80bfb3a:README.md,Cargo.toml	code	2026	Public quick start and manifest dependencies	high	high	C001	Advertised standalone clone conflicts with private sibling path dependencies
+S002	codeberg:Fimeg/Souveraine@71d3418:.gitea/workflows/ci.yml	code	2026	Public CI pipeline	high	high	C001	CI checks out one repository but Cargo requires unshipped siblings
+S003	codeberg:Fimeg/Souveraine@80bfb3a:src/backend/local/mod.rs,src/api/handlers.rs,src/server/turn.rs	code	2026	Local and server conversation construction	high	high	C002	Local assembles identity memory and skills while HTTP creation does not
+S004	codeberg:Fimeg/Souveraine@80bfb3a:src/backend/remote.rs,src/api/mod.rs,docs/tasks/remote-conversation-loading.md	code	2026	Remote conversation persistence surfaces	high	high	C003	Remote list/load remains unimplemented and task paths diverge from API
+S005	codeberg:Fimeg/Souveraine@80bfb3a:src/main.rs,src/backend/remote.rs,src/ui/chat/mod.rs	code	2026	Remote authentication wiring	high	high	C004	CLI remote mode retains tokenless backend for protected message send
+S006	codeberg:Fimeg/Souveraine@80bfb3a:src/core/config.rs,src/core/memory/mod.rs,src/server/agent_inventory.rs	code	2026	Memory configuration and repository opening	high	high	C005,C012	Several editable memory settings are not consumed by runtime
+S007	codeberg:Fimeg/Souveraine@80bfb3a:src/server/turn.rs,src/server/consciousness_engine.rs	code	2026	Post-turn consciousness lifecycle	high	high	C006,C027	Reflection and Archivist are nested behind the N+1 gate
+S008	codeberg:Fimeg/Souveraine@80bfb3a:src/core/config.rs,src/server/consciousness_engine.rs	code	2026	N+1 and reflection controls	high	high	C007,C012	Trigger and interval controls diverge from hard-coded live cadence
+S009	codeberg:Fimeg/Souveraine@80bfb3a:README.md,src/server/consciousness_engine.rs,src/core/memory/mod.rs	code	2026	Memory compaction behavior	high	high	C006,C008,C027	Warnings are N+1-bound and compaction requires a model tool call
+S010	codeberg:Fimeg/Souveraine@80bfb3a:src/core/config.rs,src/server/subagent.rs	code	2026	Subagent controls and provider selection	high	high	C009	Concurrency timeout depth and provider isolation are partly ignored
+S011	codeberg:Fimeg/Souveraine@80bfb3a:src/main.rs,src/ui/tuie_app.rs,src/ui/app/mod.rs	code	2026	Terminal UI engine migration	high	high	C010	tuie is experimental while ratatui remains the wired chat engine
+S012	codeberg:Fimeg/Souveraine@f9122c3:src/core/sensorium/mod.rs,src/core/sensorium/matrix/mod.rs,src/server/mod.rs	code	2026	Sensorium and hardening claim	high	high	C011,C012	Matrix is unregistered and stubs remain despite broad commit wording
+S013	codeberg:Fimeg/Souveraine@d64a6e9:SOUVERAINE_MASTER_SPEC.md	doc	2026	Souveraine Master Specification v2.0	high	high	C013,C014	Early server-authoritative temporal-consciousness design; later superseded
+S014	codeberg:Fimeg/Souveraine@d64a6e9:ARCHITECTURE_CLARIFICATION.md	doc	2026	Architecture clarification	high	high	C013	Reconciles local harness and server as one binary with local and remote viewports
+S015	codeberg:Fimeg/Souveraine@d64a6e9:ENHANCEMENT_ROADMAP.md	doc	2026	Enhancement roadmap	high	high	C014,C015	Names Letta-Code jcode and Claw-Open as development influences
+S016	codeberg:Fimeg/Souveraine@d64a6e9:PHASES.md	doc	2026	Phased build plan	medium	high	C014,C015	Orders memory subconscious reflection Archivist sensorium chains UI and integration
+S017	codeberg:Fimeg/Souveraine@d64a6e9:STATUS.md	doc	2026	Current state and handoff	medium	high	C015,C016	Separates early scaffold implementation from stubs
+S018	codeberg:Fimeg/Souveraine@7da881a	commit	2026	Sensorium architecture and subagent runner	high	high	C017	Introduces tool-sensor framing memory boundaries subagents and component TUI
+S019	codeberg:Fimeg/Souveraine@35534f1	commit	2026	Nervous system seed identity credentials and subconscious ledger	high	high	C018,C019	Introduces event bus cron signed identity and six-file ledger
+S020	codeberg:Fimeg/Souveraine@8f910ec	commit	2026	N+25 reflection engine	high	high	C020	Turns reflection from placeholder into bounded tool-using pass
+S021	codeberg:Fimeg/Souveraine@5c26327	commit	2026	N+100 Archivist synthesis	high	high	C021	Implements interval-or-pressure journal synthesis
+S022	codeberg:Fimeg/Souveraine@4b9c5e2	commit	2026	Signed federation event transport	high	high	C022	Adds Ed25519-signed event streaming between instances
+S023	codeberg:Fimeg/Souveraine@055a3d7	commit	2026	Agent identity versus device identity	high	high	C022	Separates portable being identity from transport identity
+S024	codeberg:Fimeg/Souveraine@3629fa8	commit	2026	Hearth and limb roles	high	high	C023	Adds home/remote semantics and split-brain guard intent
+S025	codeberg:Fimeg/Souveraine@bc6ee12	commit	2026	LlmProvider abstraction and OAuth provider	high	high	C024	Provider seam landed; complete successful SSE response remained unverified
+S026	codeberg:Fimeg/Souveraine@61bf341	commit	2026	Experimental tuie engine	high	high	C025	Parallel UI migration retained ratatui compatibility
+S027	codeberg:Fimeg/Souveraine@832d80a	commit	2026	Documentation consolidation	medium	high	C016,C026	Claims archived superseded plans but public tree records deletions without archive
+S028	codeberg:Fimeg/Souveraine@845a3f5	commit	2026	Public source-only branch	high	high	C016,C026	Explains removal of private architecture memory SAF ledger and identity context
+S029	codeberg:Fimeg/Souveraine@80bfb3a:src/server/consciousness_engine.rs	code	2026	Consciousness engine	high	high	C019,C020,C021,C027	Current N+1 reflection Archivist and pressure-warning orchestration
+S030	codeberg:Fimeg/Souveraine@80bfb3a:src/core/prompt.rs	code	2026	Prompt and identity assembly	high	high	C019,C028,C029	Pins all system markdown and injects only newest synthesis
+S031	codeberg:Fimeg/Souveraine@80bfb3a:src/core/archivist/mod.rs	code	2026	Archivist cursor and synthesis implementation	high	high	C021,C029,C030	Date cursor and bounded character input create possible continuity loss
+S032	codeberg:Fimeg/Souveraine@80bfb3a:src/server/subagent.rs	code	2026	Subagent runtime	high	high	C024,C031	Uses global default provider and leaves advertised governance controls unenforced
+S033	codeberg:Fimeg/Souveraine@80bfb3a:src/core/nervous/cron.rs	code	2026	Cron sensor	high	high	C032	Parses schedules and emits schedule_due but does not consume trigger markers
+S034	codeberg:Fimeg/Souveraine@80bfb3a:src/backend/local/mod.rs,src/core/tools/schedule.rs	code	2026	Schedule wiring and storage	high	high	C032,C033	Writer and sensor paths disagree; sensors start only for initial agents
+S035	codeberg:Fimeg/Souveraine@80bfb3a:src/bridge/mod.rs,src/bridge/model_router.rs	code	2026	Provider registry and model router	high	high	C024,C034	Rich model router is disconnected from provider selection in run_turn
+S036	codeberg:Fimeg/Souveraine@80bfb3a:src/core/nervous/mod.rs,src/core/nervous/event_log.rs	code	2026	EventBus and event log	high	high	C018,C035	Bounded broadcast is live; durable event log starts only in LocalBackend
+S037	codeberg:Fimeg/Souveraine@80bfb3a:src/core/sensorium/matrix/mod.rs,src/core/sensorium/matrix/client.rs	code	2026	Matrix surface	high	high	C036	Unregistered output stubs plaintext session and in-memory crypto store
+S038	codeberg:Fimeg/Souveraine@80bfb3a:src/server/federation/bridge.rs,src/server/federation/types.rs	code	2026	Federation bridge and signed events	high	high	C022,C023,C035,C037	Configured peer key is unused and disconnected events cannot replay
+S039	codeberg:Fimeg/Souveraine@80bfb3a:src/backend/remote.rs,src/api/handlers.rs	code	2026	Remote event transport	high	high	C038,C039	Server and client projections discard capabilities and can hide turn failures
+S040	codeberg:Fimeg/Souveraine@80bfb3a:src/backend/local/mod.rs,src/backend/local/consciousness.rs	code	2026	Local backend autonomous services	high	high	C033,C039	Adds event log cron injectors persistence and richer semantics absent from standalone server
+S041	codeberg:Fimeg/Souveraine@80bfb3a:src/ui/app/voice.rs,src/core/voice/client.rs	code	2026	Ratatui conversational voice	medium	high	C040	Implements end-to-end microphone STT chat TTS playback path
+S042	codeberg:Fimeg/Souveraine@80bfb3a:src/ui/tuie_app.rs,src/ui/screens/presence.rs	code	2026	Tuie presence and voice surfaces	medium	high	C025,C040	Captures samples but does not transcribe inject chat or play synthesized replies
+S043	codeberg:Fimeg/Souveraine@80bfb3a:souveraine.example.toml,src/core/config.rs	code	2026	Configuration claims and schema	high	high	C020,C027,C032,C041	Several controls are persisted or documented without runtime consumers
+S044	codeberg:Fimeg/Souveraine@80bfb3a:docs/tasks/remote-conversation-loading.md	doc	2026	Remote conversation loading task	high	high		Current backlog confirms remote listing/loading stubs
+S045	codeberg:Fimeg/Souveraine@80bfb3a:docs/tasks/settings-error-display.md	doc	2026	Settings error display task	medium	high	C041	Current backlog confirms swallowed validation errors
+S046	codeberg:Fimeg/Souveraine@80bfb3a:docs/tasks/dead-code-cleanup.md	doc	2026	Dead code and legacy cleanup task	medium	high	C025,C026	Records dual-engine and migration residue
+S047	codeberg:Fimeg/Souveraine@80bfb3a:docs/tasks/numeric-cast-safety.md	doc	2026	Numeric cast safety task	low	high		Dead-end for subconscious design but retained as hardening-state evidence