chore(release): auto-bump version to 0.331.1 — earned by # (patch: converged release (push-to-master bump))

Promotion record: (unknown)

.gitea/workflows/auto-version.yml

@@ -38,7 +38,7 @@ jobs:
         PR_TITLE: ${{ gitea.event.pull_request.title }}
         PR_BODY: ${{ gitea.event.pull_request.body }}
         PR_NUMBER: ${{ gitea.event.pull_request.number }}
-      run: "LATEST=$(git tag --sort=-v:refname | head -1 | sed 's/^v//')\nif [ -z\
+      run: "LATEST=$(python3 scripts/tag_repair.py --latest-tag)\nLATEST=\"${LATEST#v}\"\nif [ -z\
         \ \"$LATEST\" ]; then\n  echo \"No previous tags \u2014 releasing first version\
         \ $RELEASE_VERSION\"\n  exit 0\nfi\nif [ \"$LATEST\" != \"$RELEASE_VERSION\"\
         \ ]; then\n  if [ \"$(printf '%s\\n%s\\n' \"$LATEST\" \"$RELEASE_VERSION\"\
@@ -149,7 +149,7 @@ jobs:
         \ {str(commit_sha)[:7]}\")\n\nprint(f\"AUTO_BUMPED=true \u2014 version {NEW}\
         \ live on master; TUI footer will render v{NEW}\")\nwith open(os.environ[\"\
         GITHUB_ENV\"], \"a\") as env:\n    env.write(f\"RELEASE_VERSION={NEW}\\n\"\
-        )\n    env.write(\"AUTO_BUMPED=true\\n\")\nPYBUMP\n"
+        )\n    env.write(\"AUTO_BUMPED=true\\n\")\n    env.write(f\"BUMP_COMMIT_SHA={commit_sha}\\n\")\nPYBUMP\n"
     - name: Create evidence-derived release (SCAFFOLD-TRANCHE-009B)
       env:
         GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
@@ -162,11 +162,61 @@ jobs:
         \ summary of\n# what was worked on and submitted \u2014 the version-history\
         \ reader's\n# counterpart of the issue-entry template. Appended to the\n#\
         \ evidence-derived body so governed facts AND human narrative\n# both appear.\n\
-        LAST_TAG=$(git tag --sort=-v:refname | head -1)\nEXIT_NOTE=$(python3 scripts/release_exit_note.py\
+        LAST_TAG=$(python3 scripts/tag_repair.py --latest-tag)\nEXIT_NOTE=$(python3 scripts/release_exit_note.py\
         \ --since \"$LAST_TAG\" --to HEAD) || EXIT_NOTE=\"\"\npython3 scripts/release_history_cli.py\
         \ init \\\n  --version \"$RELEASE_VERSION\" \\\n  --server \"$RELEASE_SERVER_URL\"\
         \ --repo \"$RELEASE_REPO\" \\\n  --store store/scaffold/current.json \\\n\
         \  ${EXIT_NOTE:+--exit-note \"$EXIT_NOTE\"}"
+    - name: Plain-English narrative at the top of the release body
+      env:
+        GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+        RELEASE_SERVER_URL: ${{ gitea.server_url }}
+        RELEASE_REPO: ${{ gitea.repository }}
+      run: |
+        # OWNER DIRECTIVE (plain-English releases): prepend a
+        # "# What's new — plain English" section to the release body,
+        # derived from the conventional-commit range since the previous
+        # tag. Go-side (src/go/release-notes narrative.go) — zero new
+        # Python. Idempotent: a body already carrying the section is left
+        # alone. Additive and non-blocking: a missing toolchain or a failed
+        # prepend must never fail a release.
+        LAST_TAG=$(python3 scripts/tag_repair.py --latest-tag)
+        if ! command -v go >/dev/null 2>&1; then
+          echo "::warning::go toolchain unavailable — release published without the plain-English narrative"
+          exit 0
+        fi
+        (cd src/go/release-notes && go build -o /tmp/rune-release-notes .) || {
+          echo "::warning::release-notes build failed — narrative skipped"; exit 0; }
+        /tmp/rune-release-notes prepend-narrative \
+          --server "$RELEASE_SERVER_URL" --repo "$RELEASE_REPO" \
+          --tag "v${RELEASE_VERSION}" --since "$LAST_TAG" || {
+          echo "::warning::narrative prepend failed — release body left unchanged"; exit 0; }
+    - name: Push tui-v<version> tag via git so the tag-push event fires tui-release (D27)
+      env:
+        GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+        RELEASE_SERVER_URL: ${{ gitea.server_url }}
+        RELEASE_REPO: ${{ gitea.repository }}
+      run: |
+        # WHY git push instead of the Gitea API: API-created tags (POST /tags)
+        # do NOT emit a push event, so tui-release.yml's `on: push: tags: tui-v*`
+        # never fired (tui-v0.310.0 landed with no TUI release). A real
+        # `git push` of the tag is the trigger Gitea actions actually honor.
+        #
+        # ALL decision logic lives in scripts/tag_repair.py (one tested
+        # authority — wave-release-pipeline-deepdive). It:
+        #   * is SIGPIPE-free (the old `git tag | head -1` read killed this
+        #     job with exit 141 on its FIRST line with 500+ tags — runs
+        #     29929/30435/30636 — so no fallback ever ran),
+        #   * tags the bump commit, falling back to the fetched master tip
+        #     when the sha is unusable (0.312.x failure mode),
+        #   * is idempotent (tag already on the server = noop), and
+        #   * SELF-HEALS the version>tag deadlock: if master's version is
+        #     ahead of the latest tag because a bump landed without its tag,
+        #     this step creates+pushes the missing tui-v<version> tag on the
+        #     next push instead of skipping forever.
+        git fetch --no-tags origin master
+        python3 scripts/tag_repair.py --ensure "${RELEASE_VERSION}" \
+          --bump-sha "${BUMP_COMMIT_SHA:-}" --push
 concurrency:
   group: auto-version-and-release-${ github.ref }
   cancel-in-progress: true

.gitea/workflows/ci.yml

@@ -231,9 +231,9 @@ jobs:
       - name: curator-core candidate-decay parity gate (HARD — #2479 batch: ledger decay + journal render + cosine)
         run: |
           cd src/go/curator-core && go build -o /tmp/curator-core-${{ gitea.run_id }} . && /tmp/curator-core-${{ gitea.run_id }} replay truth_candidate_decay.json && go test -run TestCandidateDecayParity -v
-      - name: cron-engine parity gate (HARD — #2479 batches 1+126: parser + lifecycle)
+      - name: cron-engine parity gate (HARD — #2479 batches 1+126 + gap-close: parser + lifecycle + execution family)
         run: |
-          cd src/go/cron-engine && go build -o /tmp/cron-engine-${{ gitea.run_id }} . && /tmp/cron-engine-${{ gitea.run_id }} replay truth.json && go test -run TestLifecycleParity -v
+          cd src/go/cron-engine && go build -o /tmp/cron-engine-${{ gitea.run_id }} . && /tmp/cron-engine-${{ gitea.run_id }} replay truth.json && /tmp/cron-engine-${{ gitea.run_id }} replay-gap truth_gap.json && go test -run 'TestLifecycleParity|TestGapParity' -v
       - name: goal-engine parity gate (HARD — #2479 batches 2+129: verifier + lifecycle)
         run: |
           cd src/go/goal-engine && go build -o /tmp/goal-engine-${{ gitea.run_id }} . && /tmp/goal-engine-${{ gitea.run_id }} replay truth.json && go test -run TestLifecycleParity -v
@@ -269,7 +269,7 @@ jobs:
           /tmp/model-routing-${{ gitea.run_id }} replay truth.json
       - name: work-manager parity gate (HARD — #2479 batches 9+137+156: batching + lifecycle)
         run: |
-          cd src/go/work-manager && go build -o /tmp/work-manager-${{ gitea.run_id }} . && /tmp/work-manager-${{ gitea.run_id }} replay truth.json && go test -run TestLifecycleParity -v
+          cd src/go/work-manager && go build -o /tmp/work-manager-${{ gitea.run_id }} . && /tmp/work-manager-${{ gitea.run_id }} replay internal/workmanager/truth.json && go test -run TestLifecycleParity -v ./...
       - name: core-server parity gate (HARD — #2479 batches 10+138: envelopes + extraction/identity)
         run: |
           cd src/go/core-server && go build -o /tmp/core-server-${{ gitea.run_id }} .
@@ -373,7 +373,7 @@ jobs:
           cd src/go/scaffold && go build -o /tmp/scaffold-${{ gitea.run_id }} . && go test -run TestBuildersParity -v
       - name: tool-executor prepared-path parity gate (HARD — #2479 batch)
         run: |
-          cd src/go/tool-executor && go build -o /tmp/tool-exec-${{ gitea.run_id }} . && go test -run TestPreparedPathParity -v
+          cd src/go/tool-executor && go build -o /tmp/tool-exec-${{ gitea.run_id }} . && go test -run TestPreparedPathParity -v ./...
       - name: failure-filer parity gate (HARD — #2479 batch: classify/redact/tier/marker)
         run: |
           cd src/go/failure-filer && go build -o /tmp/failfiler-${{ gitea.run_id }} . && go test -run TestFilerParity -v
@@ -396,7 +396,7 @@ jobs:
           # multiple FuzzX targets exits 1 ("matches more than one fuzz test")
           # and pipefail turns that into a job failure. Enumerate targets and
           # fuzz each — and fail LOUD (no pipe-mask, exit 1 propagates).
-          for dir in src/go/tool-executor src/go/curator-core src/go/memory-store-deep; do
+          for dir in src/go/tool-executor/internal/toolexec src/go/curator-core src/go/memory-store-deep; do
             cd "$dir"
             for target in $(go test -list '^Fuzz' . | grep '^Fuzz'); do
               echo "fuzz: $dir/$target"

.gitea/workflows/maintenance.yml

@@ -123,7 +123,7 @@ jobs:
         run: |
           VERSION=$(python3 -c 'import re; text=open("src/rune/__init__.py").read(); print(re.search(r"__version__ = \"([0-9]+\.[0-9]+\.[0-9]+)\"", text).group(1))')
           echo "MASTER_VERSION=$VERSION" >> "$GITHUB_ENV"
-          echo "LATEST_TAG=$(git tag --sort=-v:refname | head -1)" >> "$GITHUB_ENV"
+          echo "LATEST_TAG=$(python3 scripts/tag_repair.py --latest-tag)" >> "$GITHUB_ENV"
           python3 scripts/version_convergence.py > /tmp/convergence.json
           echo "Convergence: $(cat /tmp/convergence.json)"
           python3 - <<'PYENV'
@@ -143,7 +143,11 @@ jobs:
         run: |
           python3 scripts/file_drift_issue.py
 
-      - name: Converged — no drift issue
+      - name: Converged — close any resolved drift issue
         if: env.DRIFT == 'false'
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          RELEASE_SERVER_URL: ${{ gitea.server_url }}
+          RELEASE_REPO: ${{ gitea.repository }}
         run: |
-          echo "Master and the latest release tag are converged — no drift issue."
+          python3 scripts/file_drift_issue.py --close-if-resolved

.gitea/workflows/tui-release.yml

@@ -0,0 +1,132 @@
+name: TUI Release
+on:
+  push:
+    tags:
+    - 'tui-v*'
+permissions:
+  contents: write
+jobs:
+  release:
+    runs-on: rune-ci-desktop
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Read semver from the pushed tag
+      run: |
+        # GITEA_REF_NAME resolves EMPTY on the rune-ci-desktop runner even on
+        # tag pushes (runs 30390/30456/30862: "triggered on non-tui tag " with
+        # an empty tag). Fall back to GITHUB_REF_NAME, then to the tag that
+        # checkout actually put us on (git describe --exact-match on the
+        # detached tag checkout) — wave-release-pipeline-deepdive.
+        TAG="${GITEA_REF_NAME:-${GITHUB_REF_NAME:-$(git describe --tags --exact-match HEAD 2>/dev/null || true)}}"
+        case "$TAG" in
+          tui-v*) VERSION="${TAG#tui-v}" ;;
+          *) echo "::error::triggered on non-tui tag $TAG"; exit 1 ;;
+        esac
+        echo "TUI_TAG=$TAG" >> "$GITHUB_ENV"
+        echo "TUI_VERSION=$VERSION" >> "$GITHUB_ENV"
+        echo "releasing $TAG (semver $VERSION)"
+    - name: Paired build with semver injection (vendored, GOPROXY=off)
+      env:
+        GOPROXY: "off"
+        GOFLAGS: "-mod=vendor"
+      run: |
+        [ -f tui/vendor/modules.txt ] || { echo "::error::tui/vendor missing - not a self-contained build"; exit 1; }
+        echo "vendor proof: GOPROXY=$(go env GOPROXY) flags=$(go env GOFLAGS) ($(wc -l < tui/vendor/modules.txt) vendored modules)"
+        bash scripts/build_paired.sh
+        BUILD_ID="$(./verification/build-id/rune-tui --build-id)"
+        echo "TUI_BUILD_ID=$BUILD_ID" >> "$GITHUB_ENV"
+        echo "binary stamped: build=$BUILD_ID semver=$TUI_VERSION (from $TUI_TAG on HEAD)"
+    - name: Create release with commit range since last tui tag
+      env:
+        GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+        RELEASE_SERVER_URL: ${{ gitea.server_url }}
+        RELEASE_REPO: ${{ gitea.repository }}
+      run: |
+        LAST_TUI_TAG="$(git tag --list 'tui-v*' --sort=-creatordate | grep -vx "$TUI_TAG" | head -1 || true)"
+        {
+          echo "Native TUI release $TUI_VERSION"
+          echo
+          echo "- semver: \`$TUI_VERSION\` (injected at build from tag \`$TUI_TAG\`)"
+          echo "- paired build id: \`$TUI_BUILD_ID\`"
+          echo "- binary: \`rune-tui-$TUI_VERSION\` (self-contained, vendored deps, GOPROXY=off proof)"
+          echo
+          if [ -n "$LAST_TUI_TAG" ]; then
+            echo "## Commits since $LAST_TUI_TAG"
+            echo
+            git log --oneline "$LAST_TUI_TAG..HEAD"
+          else
+            echo "## Commits (first tui-tagged release)"
+            echo
+            git log --oneline -30
+          fi
+        } > /tmp/tui-release-body.md
+        TUI_TAG="$TUI_TAG" TUI_VERSION="$TUI_VERSION" python3 - <<'PYREL'
+        import json, os, sys, urllib.request
+
+        TOKEN = os.environ["GITEA_TOKEN"]
+        BASE = os.environ["RELEASE_SERVER_URL"].rstrip("/") + "/api/v1/repos/" + os.environ["RELEASE_REPO"]
+        TAG = os.environ["TUI_TAG"]
+        VERSION = os.environ["TUI_VERSION"]
+
+        def api(path, method="GET", data=None):
+            req = urllib.request.Request(
+                BASE + path,
+                data=json.dumps(data).encode() if data is not None else None,
+                headers={"Authorization": "token " + TOKEN, "Content-Type": "application/json"},
+                method=method,
+            )
+            try:
+                with urllib.request.urlopen(req, timeout=30) as r:
+                    body, status = r.read(), r.status
+            except urllib.error.HTTPError as e:
+                body, status = e.read(), e.code
+            try:
+                return status, (json.loads(body) if body else {})
+            except json.JSONDecodeError:
+                return status, {"_raw": body.decode("utf-8", "replace")[:200]}
+
+        body = open("/tmp/tui-release-body.md").read()
+        status, existing = api(f"/releases/tags/{TAG}")
+        if status == 200:
+            release_id = existing["id"]
+            status, _ = api(f"/releases/{release_id}", "PATCH", {"body": body, "name": f"Rune TUI {VERSION}"})
+            if status not in (200, 201):
+                print(f"release patch failed ({status})"); sys.exit(1)
+            print(f"updated existing release {release_id} for {TAG}")
+        else:
+            status, rel = api("/releases", "POST", {
+                "tag_name": TAG, "name": f"Rune TUI {VERSION}",
+                "body": body, "draft": False, "prerelease": False,
+            })
+            if status != 201:
+                print(f"release create failed ({status}): {str(rel)[:300]}"); sys.exit(1)
+            release_id = rel["id"]
+            print(f"created release {release_id} for {TAG}")
+        with open(os.environ["GITHUB_ENV"], "a") as env:
+            env.write(f"TUI_RELEASE_ID={release_id}\n")
+        PYREL
+    - name: Attach the single binary to the release
+      env:
+        GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+        RELEASE_SERVER_URL: ${{ gitea.server_url }}
+        RELEASE_REPO: ${{ gitea.repository }}
+      run: |
+        ASSET="rune-tui-$TUI_VERSION"
+        # re-runs must not stack duplicate attachments (Gitea 409s on name clash)
+        curl -sf -H "Authorization: token $GITEA_TOKEN" \
+          "$RELEASE_SERVER_URL/api/v1/repos/$RELEASE_REPO/releases/$TUI_RELEASE_ID/assets" \
+          | python3 -c "import json,sys; [print(a['id']) for a in json.load(sys.stdin) if a['name'] == '$ASSET']" \
+          | while read -r AID; do
+              curl -sf -X DELETE -H "Authorization: token $GITEA_TOKEN" \
+                "$RELEASE_SERVER_URL/api/v1/repos/$RELEASE_REPO/releases/$TUI_RELEASE_ID/assets/$AID" || \
+                { echo "::error::could not clear stale asset $AID"; exit 1; }
+            done
+        curl -sf -X POST -H "Authorization: token $GITEA_TOKEN" \
+          -F "attachment=@verification/build-id/rune-tui" \
+          "$RELEASE_SERVER_URL/api/v1/repos/$RELEASE_REPO/releases/$TUI_RELEASE_ID/assets?name=$ASSET" \
+          | python3 -c "import json,sys; a=json.load(sys.stdin); print('attached:', a.get('name'), a.get('browser_download_url'))"
+concurrency:
+  group: tui-release-${{ gitea.ref }}
+  cancel-in-progress: false

.gitignore

@@ -10,17 +10,75 @@ build/
 *.log
 .env
 .venv/
-state/
-# Runtime artifacts (cwd-local event journal + capability index)
-index/
-journal/
+# Runtime artifacts (cwd-local state + event journal + capability index).
+# Root-anchored on purpose: unanchored `index/`/`journal/` swallowed the
+# tracked source dirs memory/index/ and memory/journal/, silently ignoring
+# every NEW file there — same broad-ignore trap class as the src/go rule
+# below. (dist/ + build/ reviewed: only collisions live inside
+# src/rust/*/target/, which this file already ignores, so left generic.)
+/state/
+/index/
+/journal/
 src/rust/*/target/
 
 # batch 134: Go build artifacts — binaries are CI-built per gate (go build -o /tmp/...),
 # never stored. Each module dir keeps go.mod/main.go/truth*.json + *_test.go only.
+#
+# Trap history (modegate binary fabrication, K9 sweep accident, 102MB cache
+# re-lands): the bare `src/go/*/[^.]*` artifact rule also matched the module
+# dirs themselves and every non-dot entry inside them, so sweeps pruned whole
+# new modules and every new internal/ file needed `git add -f`. Rules below
+# keep ONLY source files addable:
+#   - module dirs re-included so git traverses them (new modules stay
+#     visible to status/add sweeps);
+#   - module-level sources by extension (.go/.json/.mod/.sum);
+#   - subpackage dirs (internal/, cmd/, ...) traversable, their contents
+#     ignored by default, then re-included for sources only (.go/.json/.md).
+#     NO binary intent preserved: anything else under a subpackage dir
+#     (compiled binaries, caches) stays ignored.
 src/go/*/[^.]*
+!src/go/*/
 !src/go/*/*.go
 !src/go/*/*.json
 !src/go/*/*.mod
 !src/go/*/*.sum
+!src/go/*/*/
+src/go/*/*/**
+!src/go/*/*/**/
+!src/go/*/*/**/*.go
+!src/go/*/*/**/*.json
+!src/go/*/*/**/*.md
+# explicit re-statement of the module-root binary law (sweep-race repair,
+# 2026-10-18): the stale untracked tool-executor build artifact sat ignored
+# ONLY via the broad rule above — named here so the intent survives any
+# future loosening of that rule. Binaries are CI-built per gate
+# (go build -o /tmp/...), never stored in the module dir.
+src/go/tool-executor/tool-executor
+# committed fixture stores (frozen-truth construction rigs) — fixtures/ and
+# testdata/ are inputs, not build output: fully tracked at any depth under
+# src/go/, including non-source members (.jsonl/.txt/etc.).
+!src/go/**/fixtures/
+!src/go/**/fixtures/**
+!src/go/**/testdata/
+!src/go/**/testdata/**
+
+# phase 0C task 0.14: paired-build stamps are per-build output (one build
+# id in verification/build-id/, gitignored like the binaries it stamps).
+verification/build-id/
+tui/boundary/gen/build_id_gen.go
+
+# D30 wasm migration wave 1: wasm modules are reproducibly-built compiled
+# artifacts (build_paired.sh: cargo → tui/wasm/modules/), never committed —
+# same no-committed-binaries law as the Go/Rust binaries. Source of truth
+# is src/rust/token_counting; manifest.json carries the paired build id.
+tui/wasm/modules/
+
+# store segments are canonical; this file is the derived LOCAL cache,
+# rebuilt from segments (the 102MB re-land class) — never committable.
+# (Single entry: the pre-hygiene duplicate removed.)
 store/scaffold/current.json
+tui/rune-tui
+
+# 83MB legacy migration snapshot — purged from history 2026-10-21 (wave-ghost-purge);
+# the on-disk working copy stays, but it is never committable.
+store/scaffold/legacy-current-migration-snapshot.json

MORNING-TEST-2026-10-16.md

@@ -0,0 +1,155 @@
+# Morning test list — 2026-10-16
+
+Things you can test by hand, in order, with your own eyes and ears.
+This list gets filled in further as overnight work lands.
+
+## 1. System audio (landed yesterday afternoon)
+
+- Play anything (browser video, music).
+- Expect: sound through your monitors as normal.
+- If you reboot: log in, wait ~15 seconds, play something again.
+  Expect: sound still there (the self-healing system rebuilds the
+  System_Audio path if the startup race ever eats it).
+
+## 2. Game audio via Heroic (armed, waiting on you)
+
+- Close Mafia if it's still open (the fix applies itself on close).
+- Relaunch it through Heroic.
+- Expect: sound from the menus onward.
+- If still silent: tell Rune — the next fix (umu runtime rollback) is
+  already planned and takes minutes.
+
+## 3. The one-command whole-system check (LANDED overnight)
+
+- Run, from the repo root:
+  `make check`
+  (same thing, spelled out: `python scripts/unified_check.py`)
+- Takes several minutes — it sweeps everything: all 103 Rust crates, the
+  whole Python suite, the Go side, the boundary conversation tests, the
+  code-generation gate, and the no-binaries gate.
+- Expect the final verdict **AMBER**. Plain meaning of AMBER: "only the
+  old, known failures remain — nothing new." That is the correct, honest
+  green for this repo right now. RED means something new broke.
+- The known-old list it tolerates: ~120 old Python failures (recorded
+  baseline, being paid down over time) + one known-sick Rust crate
+  (prompt_sync — found by this very runner on its first ever sweep;
+  repair already queued overnight).
+
+## 4. The TUI first breath (foundation — LANDED overnight)
+
+- Run, from the repo root:
+  `cd tui && go run ./cmd/rune-tui`
+  (The `./cmd/rune-tui` part matters — the module root itself has no
+  main program.)
+- Expect: a small face showing **Rune**, a version placeholder
+  (0.0.0-dev), a build line, and "q to quit". Press **q** (or ctrl+c):
+  it exits cleanly (exit code 0).
+- The build line says `unset (unpaired dev build)` for `go run` — that
+  is honest: `go run` skips the paired-build stamping step. A
+  paired-stamped build (`bash scripts/build_paired.sh`, then run
+  `verification/build-id/rune-tui`) shows the real build id instead.
+- Pre-verified overnight by machine (boot, render, q, clean exit 0),
+  including through a fake terminal — your run is the human confirmation.
+- It is the seed, not the tree — it proves the whole chain works end to
+  end (module + vendored dependencies + stamping + tests).
+
+## 5. The behavior map (LANDED overnight)
+
+- What it is: the single action-model both future visual designs must
+  satisfy — 144 states, 20 actions, frozen golden paths. It is the
+  guarantee that every visual option behaves identically.
+- See it pass:
+  `cd tui && go test ./semantic/ -v`
+- You will see the mutant tests (deliberate breakages that MUST fail the
+  checker) and the key-parsing tests (the tricky alt+q case included).
+  All green = the foundation of all three future looks is solid.
+
+---
+
+## What you do NOT need to test by hand
+
+Everything below is already proven by born-failing tests before it
+landed (the five repairs, the boundary machinery, the sandbox). The
+test list above is only for things that need human eyes or ears.
+
+## Overnight judgment calls made while you slept
+
+(Filled in as they happen — each one gets a line here so you can
+overrule anything in the morning.)
+
+1. **Substrate's first sweep found a sick Rust crate** (`prompt_sync` —
+   an arithmetic overflow that crashes three of its tests; pre-existing,
+   never swept before, NOT caused by tonight's work). Left unfixed by
+   the substrate worker (correctly — separate concern), repair queued
+   overnight.
+2. **The repo's "spine" snapshot was stale** relative to yesterday's
+   landed fixes. The suite refreshes it when it runs; I left the
+   refreshed version in place because restoring the stale one would arm
+   a false alarm. Flagged for your call if you want spine handling
+   changed.
+3. **The old failure count is 120, not 116** (the research's number was
+   approximate). The runner records the honest baseline and compares
+   against it by content, not by count — the edges of the old set flicker
+   by one or two between runs, so exact counts lie.
+4. **The sick crate was repaired overnight** (prompt_sync — a Python-to-Rust
+   port where Python's forgiving negative numbers met Rust's hard floor;
+   two underflow sites fixed with exact-Python-semantics guards; all its
+   tests including the frozen oracle battery now pass). The one-command
+   check in section 3 still says AMBER — that remains correct.
+5. **One crate is order-flaky** (graph_projection): passes 12/12 when run
+   alone, occasionally trips when the whole system sweeps in one order.
+   Known flake class, tolerated in the baseline so it cannot cause false
+   alarms. Real fix (test hygiene) queued for a later wave.
+6. **Bubbles v2.2.1 is pinned through a tiny internal package, not used
+   yet** (tui/internal/toolkit/pins.go — one blank import). `go mod tidy`
+   deletes any dependency nothing imports, and the spec pins all three
+   toolkit pieces (task 5.3b), so the pin needs a real import to survive
+   tidy + vendoring. It says exactly that in its comment; components
+   arrive with later waves.
+7. **tui/go.mod grew its dependency list through the GENERATOR, not by
+   hand** — go.mod is generated territory (the codegen gate byte-diffs
+   it), so the pins went into the gen_boundary_types.py template and the
+   file must stay byte-identical to what `go mod tidy` produces. The
+   runner needed NO changes: Go spots tui/vendor/ automatically and
+   builds offline from it.
+
+6. **Wave D (lanes groundwork) is building overnight** — the two-lane
+   skeleton (Chat left, Task right, focus switching) rendered over the
+   behavior map above. Judgment entry when it lands.
+
+7. **Wave D (two-lane skeleton) LANDED overnight** — the face now shows
+   Chat left + Task right, focused pane wider, tab/1/2 to switch focus,
+   q to quit. Panes say "not yet wired" — honest placeholders; the real
+   content arrives in later waves.
+   Run it: `cd tui && go run ./cmd/rune-tui`
+8. **Judgment call: Gitea restarted itself mid-night** (03:44) — the Wave D
+   push failed once, then landed clean on retry. If the machine rebooted
+   overnight, your morning `git push` context is unaffected; all commits
+   are on the server.
+
+9. **Wave E (activity rail) LANDED overnight** — beneath the lanes now
+   sits a RAIL line (which lane is focused, status, newest event with its
+   source). Press `r` to open the full-width ACTIVITY RAIL box; `x` closes
+   it back to exactly the lanes you had. `q` quits (inside the box, keys
+   are swallowed until you close it — it is an inspection room, not a
+   door). Entries already carry source + ancestry — the thread tree (your
+   SA-D7) gets its data free.
+10. **Judgment call: Wave E needed two watchdog nudges** — the worker
+    stalled twice with nothing on disk, moved both times right after the
+    ping. Pattern of the night: long writes, not stuck workers. The rule
+    (probe the worktree, nudge, escalate to tighter re-spawn) worked
+    without ever firing the trigger.
+
+11. **Heroic: already up to date** (2.22.4-1, newest everywhere — nothing
+    was changed). Your launcher is healthy; 40 files, none missing.
+12. **Game audio, corrected picture:** the fix already applied itself
+    yesterday at 15:12 (the watcher fired on game close; registry patched
+    to Audio=pulse; backup saved). BUT two things changed the equation:
+    (a) the runtime on disk is Oct 7, not Oct 13 — so the "Oct 13 broke
+    it" theory is wrong; (b) the next game launch may auto-download a
+    newer runtime, which could change things again. So: relaunch Mafia
+    through Heroic, listen from the menus. If sound is there — done, tell
+    Rune and the umu update hold lifts. If silent — say so immediately;
+    the rollback plan pivots to whatever runtime just downloaded.
+    (Held deliberately: umu-launcher 1.4.4-1 NOT installed until your
+    audio verdict.)

Makefile

@@ -0,0 +1,18 @@
+# phase 0C task 0.13 — ONE command for the whole test world (design D26:
+# no two test worlds; partial green is impossible). This is the entry the
+# landing gate (scripts/check_landing.py) demands evidence from.
+.PHONY: check boundary-regen paired-build install-launcher
+
+check:
+	python scripts/unified_check.py
+
+boundary-regen:
+	python scripts/gen_boundary_types.py
+
+paired-build:
+	bash scripts/build_paired.sh
+
+# wave-rune-launcher: the standard `rune` command boots the Go TUI face;
+# the launcher is version-controlled and installed by this target.
+install-launcher:
+	bash scripts/install_rune_launcher.sh

README.md

@@ -1,6 +1,6 @@
 # Rune
 
-**Current release: v0.282.0**
+**Current release: v0.331.1**
 
 **Rune is a persistent personal agent designed to accumulate experience, develop reusable competence, and remain recognisably the same agent even when its underlying foundation model changes.**
 

backups/live_proof-1792234962/receipts/provider__ollama.jsonl

@@ -0,0 +1,8 @@
+{"digest": "c9419eadc0641ecaf40267e0543a5bdbfc548b377a4c2721f92662a641e32f10", "evidence": {"detail": "auth check observed: unreachable", "ended_at": 1792233218.9893527, "error_class": "UNREACHABLE", "input_digest": "dd027a0116f03542db66d808b90e5c9cd27a99ed290a046c4ea7f3a8a143d6f3", "output_digest": "c3c4c022a5a8e2e454665615a663a6984323d1c54df648ae4f49599a329a22fb", "started_at": 1792233218.9739888}, "kind": "provider", "observed_at": 1792233218.989386, "path": "provider:ollama", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233218-492cf12e", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "unmeasured"}
+{"digest": "ebd493b6544b8f215d2a714a998a7ac37add986d780fc1b809c0a270e8821e5d", "evidence": {"detail": "minimal call observed failing: Exception: Ollama connection failed: cannot import name '_clean_model_name' from 'model_connect' (/h", "ended_at": 1792233218.997182, "error_class": "UNREACHABLE", "input_digest": "a21f92f9ee3f2256bcbf27aa45981290981c6c1cf2655bfa50b0ba11ba20868c", "output_digest": "76b0ec3f3942928cb5232e64112f0fa5347f3a5193ca8a82a62d9e963e142a44", "started_at": 1792233218.9893873}, "kind": "provider", "observed_at": 1792233218.9972157, "path": "provider:ollama", "phase": "minimal_call", "prev_digest": "c9419eadc0641ecaf40267e0543a5bdbfc548b377a4c2721f92662a641e32f10", "receipt_id": "LP-1792233218-e0f20aa3", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "unmeasured"}
+{"digest": "422166d72546bf077ff51d2152acbd0e987e92d3d8b00748d5a14706e66944ac", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792233219.006819, "error_class": null, "injected_fault": "generate against a nonexistent model id", "input_digest": "6c0df4008620e6808cc874cd54c1c9b516dd5b50e4ea1bfe0ad118b00f085587", "output_digest": "71316104b00a83a2835a7d02b2b1fc42de3cf5bc50f4135785314698032e1622", "started_at": 1792233218.997217}, "kind": "provider", "observed_at": 1792233219.0068464, "path": "provider:ollama", "phase": "failure_injection", "prev_digest": "ebd493b6544b8f215d2a714a998a7ac37add986d780fc1b809c0a270e8821e5d", "receipt_id": "LP-1792233219-bb625093", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_fail"}
+{"digest": "0aecbb624f13ee7719fd6e0679655142ec39f252a134f2181579f85150793168", "evidence": {"detail": "recovery call observed failing: Exception: Ollama connection failed: cannot import name '_clean_model_name' from 'model_connect' (/h", "ended_at": 1792233219.0125165, "error_class": "UNREACHABLE", "input_digest": "da1b19503325152474269326e22e35a3541de5be0b52f6a4d15697562276ffcf", "output_digest": "39c9e709defa1679ba1d6ab7c60e3a4be6778264bef4fbe47cb1f1e3cbf8afb7", "started_at": 1792233219.0068486}, "kind": "provider", "observed_at": 1792233219.0125406, "path": "provider:ollama", "phase": "recovery", "prev_digest": "422166d72546bf077ff51d2152acbd0e987e92d3d8b00748d5a14706e66944ac", "receipt_id": "LP-1792233219-a4e0929a", "recovery_of": "LP-1792233219-bb625093", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "unmeasured"}
+{"digest": "eb332a8c25995da32fd4c4db62a5ba910f6b3469beadb2a1e3b8155c565bd1a5", "evidence": {"detail": "auth check observed: unreachable", "ended_at": 1792234272.8529687, "error_class": "UNREACHABLE", "input_digest": "dd027a0116f03542db66d808b90e5c9cd27a99ed290a046c4ea7f3a8a143d6f3", "output_digest": "c3c4c022a5a8e2e454665615a663a6984323d1c54df648ae4f49599a329a22fb", "started_at": 1792234272.8361378}, "kind": "provider", "observed_at": 1792234272.8529952, "path": "provider:ollama", "phase": "auth_check", "prev_digest": "0aecbb624f13ee7719fd6e0679655142ec39f252a134f2181579f85150793168", "receipt_id": "LP-1792234272-79069dd1", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "unmeasured"}
+{"digest": "147fed3aca1ac49ebc86d959fbf89e1bb2c7a93343a94605f7e51890f22bdc51", "evidence": {"detail": "minimal call observed failing: Exception: Ollama connection failed: cannot import name '_clean_model_name' from 'model_connect' (/h", "ended_at": 1792234272.860741, "error_class": "UNREACHABLE", "input_digest": "a21f92f9ee3f2256bcbf27aa45981290981c6c1cf2655bfa50b0ba11ba20868c", "output_digest": "76b0ec3f3942928cb5232e64112f0fa5347f3a5193ca8a82a62d9e963e142a44", "started_at": 1792234272.8529968}, "kind": "provider", "observed_at": 1792234272.8607702, "path": "provider:ollama", "phase": "minimal_call", "prev_digest": "eb332a8c25995da32fd4c4db62a5ba910f6b3469beadb2a1e3b8155c565bd1a5", "receipt_id": "LP-1792234272-9c39fdf0", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "unmeasured"}
+{"digest": "4ff45d265c98ee4dedb981ea927efc89342c3af39288f7343def206e0c6865c1", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792234272.8636794, "error_class": null, "injected_fault": "generate against a nonexistent model id", "input_digest": "6c0df4008620e6808cc874cd54c1c9b516dd5b50e4ea1bfe0ad118b00f085587", "output_digest": "71316104b00a83a2835a7d02b2b1fc42de3cf5bc50f4135785314698032e1622", "started_at": 1792234272.8607724}, "kind": "provider", "observed_at": 1792234272.8637164, "path": "provider:ollama", "phase": "failure_injection", "prev_digest": "147fed3aca1ac49ebc86d959fbf89e1bb2c7a93343a94605f7e51890f22bdc51", "receipt_id": "LP-1792234272-b76c579a", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_fail"}
+{"digest": "34793a3250f51c5b28de3405feda20e0cf6a56d456317dd85c1847966002da84", "evidence": {"detail": "recovery call observed failing: Exception: Ollama connection failed: cannot import name '_clean_model_name' from 'model_connect' (/h", "ended_at": 1792234272.8698554, "error_class": "UNREACHABLE", "input_digest": "da1b19503325152474269326e22e35a3541de5be0b52f6a4d15697562276ffcf", "output_digest": "39c9e709defa1679ba1d6ab7c60e3a4be6778264bef4fbe47cb1f1e3cbf8afb7", "started_at": 1792234272.863718}, "kind": "provider", "observed_at": 1792234272.8698883, "path": "provider:ollama", "phase": "recovery", "prev_digest": "4ff45d265c98ee4dedb981ea927efc89342c3af39288f7343def206e0c6865c1", "receipt_id": "LP-1792234272-f20f26d0", "recovery_of": "LP-1792234272-b76c579a", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "unmeasured"}

backups/live_proof-1792234962/receipts/tool__check_growth.jsonl

@@ -0,0 +1,8 @@
+{"digest": "99025712c48b1307084db77b76fcb86dbda65a0e865ca76431edac2946c66663", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792233218.9710536, "error_class": null, "input_digest": "effb3b5d5769d540ff9760238ef48bff2f7e776d98141067ecab0e89d02745fb", "output_digest": "a43dee11da21b5c47cd68d4a4fffd3f16b118377a18610880c4ddb8c437cff30", "started_at": 1792233218.9710517}, "kind": "tool", "observed_at": 1792233218.971072, "path": "tool:check_growth", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233218-fe7201f0", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_pass"}
+{"digest": "f1732dcec4346174f63e4261e58deac8811065f5ab8ceaea640b7e6fe380fd8e", "evidence": {"detail": "check growth status", "ended_at": 1792233218.971133, "error_class": null, "input_digest": "cb2cbff6f8bc71c36d0ee1d0a7959bc3ee7ff9aa933f06bfaa51c50076fc1bc9", "output_digest": "71a806b344d675b9a062b2e91bc5b3a9c8b56b64c83d7027f3b2001279de1c4f", "started_at": 1792233218.971073}, "kind": "tool", "observed_at": 1792233218.9711418, "path": "tool:check_growth", "phase": "minimal_call", "prev_digest": "99025712c48b1307084db77b76fcb86dbda65a0e865ca76431edac2946c66663", "receipt_id": "LP-1792233218-65eafd31", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_pass"}
+{"digest": "ed3856b44b6239e6446b77469a6c41527112ad465814cea2df4242a36bc283ff", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792233218.9712937, "error_class": null, "injected_fault": "check with a disabled growth gate", "input_digest": "01fa0327088c9965436c396d3f0bb4234e19811f3466d8911f5bdb5df3b5b9b5", "output_digest": "ed530432d25645b5a47a6c6c577e89a0c9202b1596c61a6cd54054ccb516e4d2", "started_at": 1792233218.9711423}, "kind": "tool", "observed_at": 1792233218.971308, "path": "tool:check_growth", "phase": "failure_injection", "prev_digest": "f1732dcec4346174f63e4261e58deac8811065f5ab8ceaea640b7e6fe380fd8e", "receipt_id": "LP-1792233218-44814065", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_fail"}
+{"digest": "32be97e9cfe91e0466147c5357cb13df1bff9ad5b66b68887d8d99c07ff0cf0a", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792233218.9713871, "error_class": null, "input_digest": "739b3f090bd90a54c54f40b518d0e5e316bda4f14ab25342445139362394e167", "output_digest": "88a7f14ac8dc1521fede6db1e4c142fba565cd1a2827424ad93e2ad6c49fe411", "started_at": 1792233218.9713087}, "kind": "tool", "observed_at": 1792233218.971402, "path": "tool:check_growth", "phase": "recovery", "prev_digest": "ed3856b44b6239e6446b77469a6c41527112ad465814cea2df4242a36bc283ff", "receipt_id": "LP-1792233218-8aec1e2c", "recovery_of": "LP-1792233218-44814065", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_pass"}
+{"digest": "e45d6ec8bc98722470b1c6bd712dc290e7cdf20cb4585ee1e11487d50ee637dc", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792234272.832866, "error_class": null, "input_digest": "effb3b5d5769d540ff9760238ef48bff2f7e776d98141067ecab0e89d02745fb", "output_digest": "a43dee11da21b5c47cd68d4a4fffd3f16b118377a18610880c4ddb8c437cff30", "started_at": 1792234272.8328648}, "kind": "tool", "observed_at": 1792234272.8328886, "path": "tool:check_growth", "phase": "auth_check", "prev_digest": "32be97e9cfe91e0466147c5357cb13df1bff9ad5b66b68887d8d99c07ff0cf0a", "receipt_id": "LP-1792234272-f2be3eb8", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "17e07c39e371aaeebfa83cb873ba65f3bed126894b4f052bf514a7f8baa1ce63", "evidence": {"detail": "check growth status", "ended_at": 1792234272.8329782, "error_class": null, "input_digest": "cb2cbff6f8bc71c36d0ee1d0a7959bc3ee7ff9aa933f06bfaa51c50076fc1bc9", "output_digest": "71a806b344d675b9a062b2e91bc5b3a9c8b56b64c83d7027f3b2001279de1c4f", "started_at": 1792234272.8328893}, "kind": "tool", "observed_at": 1792234272.8329926, "path": "tool:check_growth", "phase": "minimal_call", "prev_digest": "e45d6ec8bc98722470b1c6bd712dc290e7cdf20cb4585ee1e11487d50ee637dc", "receipt_id": "LP-1792234272-bc7a7334", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_pass"}
+{"digest": "0031728bfd365ccb090ec337a9c91953975352ba48b7d3576caef2e31c9a2417", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792234272.8330224, "error_class": null, "injected_fault": "check with a disabled growth gate", "input_digest": "01fa0327088c9965436c396d3f0bb4234e19811f3466d8911f5bdb5df3b5b9b5", "output_digest": "ed530432d25645b5a47a6c6c577e89a0c9202b1596c61a6cd54054ccb516e4d2", "started_at": 1792234272.8329933}, "kind": "tool", "observed_at": 1792234272.8330305, "path": "tool:check_growth", "phase": "failure_injection", "prev_digest": "17e07c39e371aaeebfa83cb873ba65f3bed126894b4f052bf514a7f8baa1ce63", "receipt_id": "LP-1792234272-3c00183b", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_fail"}
+{"digest": "74a1cb3f6452f59f43877f96d88b2a5243b78e3914443d8744f41d717eb6e568", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792234272.8330655, "error_class": null, "input_digest": "739b3f090bd90a54c54f40b518d0e5e316bda4f14ab25342445139362394e167", "output_digest": "88a7f14ac8dc1521fede6db1e4c142fba565cd1a2827424ad93e2ad6c49fe411", "started_at": 1792234272.833031}, "kind": "tool", "observed_at": 1792234272.8330722, "path": "tool:check_growth", "phase": "recovery", "prev_digest": "0031728bfd365ccb090ec337a9c91953975352ba48b7d3576caef2e31c9a2417", "receipt_id": "LP-1792234272-a52f85ab", "recovery_of": "LP-1792234272-3c00183b", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_pass"}

backups/live_proof-1792234962/receipts/tool__diagnose_behavior.jsonl

@@ -0,0 +1,8 @@
+{"digest": "fb033f6370e01ed82a84f32ff0a54df6b77ce3765e79333f584b699620ae1085", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792233218.972268, "error_class": null, "input_digest": "d6553a8acb42491e8735929dc6f91b553ff94c4e797554e46273f9acb9e30bd4", "output_digest": "c8cb4141c0ee8d220179c8acc4aae21aa0cff50326c88a13bdfdb2c9c5b2203f", "started_at": 1792233218.9722667}, "kind": "tool", "observed_at": 1792233218.9722826, "path": "tool:diagnose_behavior", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233218-dd7210f5", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_pass"}
+{"digest": "ab7b7039801bd75b33269958bd3d323425612b084b69024b9d98442734cf6920", "evidence": {"detail": "minimal call failed: Text is required", "ended_at": 1792233218.972331, "error_class": "TOOL_ERROR", "input_digest": "f9059e4bd866ddfc75fb5ccd9b89306e9cf4a65fdc82ab98c1a677c78c0d1685", "output_digest": "ead878aa4011839b17b4f7d7a75db98c83f4b3ed22140d36e4a16580cf81d671", "started_at": 1792233218.9722831}, "kind": "tool", "observed_at": 1792233218.9723408, "path": "tool:diagnose_behavior", "phase": "minimal_call", "prev_digest": "fb033f6370e01ed82a84f32ff0a54df6b77ce3765e79333f584b699620ae1085", "receipt_id": "LP-1792233218-134fe0fd", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_fail"}
+{"digest": "b858918d419ad179109da3c570351f8bf3f4c40bda784c8caffe2b1d379401f2", "evidence": {"detail": "injected fault observed failing and classified: Text is required", "ended_at": 1792233218.9723644, "error_class": "TOOL_ERROR", "injected_fault": "diagnose a nonexistent behavior", "input_digest": "8c4282e880c336c239d9ac91bd85a502b44ac6d404592d5aabfe17b8b834f849", "output_digest": "01973c0c768f536fed316470916982cef444dfc09453f9e52ae1b43fe997291c", "started_at": 1792233218.9723413}, "kind": "tool", "observed_at": 1792233218.9723866, "path": "tool:diagnose_behavior", "phase": "failure_injection", "prev_digest": "ab7b7039801bd75b33269958bd3d323425612b084b69024b9d98442734cf6920", "receipt_id": "LP-1792233218-7c223469", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_pass"}
+{"digest": "3b153deb3d2f4c4f3560095e4dff865f7f4c3974acee34124f5ea052a2aa717e", "evidence": {"detail": "recovery call failed: Text is required", "ended_at": 1792233218.972428, "error_class": "TOOL_ERROR", "input_digest": "d78b3459d5852c759f6ea1b0f50054bdea2fe9ba78aefc436739e01da74271ad", "output_digest": "42ed65c4c87cc759829b454747b386d6ed17fbc1d384a276f655671eb83e8c8b", "started_at": 1792233218.9723876}, "kind": "tool", "observed_at": 1792233218.9724379, "path": "tool:diagnose_behavior", "phase": "recovery", "prev_digest": "b858918d419ad179109da3c570351f8bf3f4c40bda784c8caffe2b1d379401f2", "receipt_id": "LP-1792233218-77b6723d", "recovery_of": "LP-1792233218-7c223469", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_fail"}
+{"digest": "c32d50db85d43518dda60996844776e0989cd908c5b9c5030c39ae9743a71946", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792234272.8339787, "error_class": null, "input_digest": "d6553a8acb42491e8735929dc6f91b553ff94c4e797554e46273f9acb9e30bd4", "output_digest": "c8cb4141c0ee8d220179c8acc4aae21aa0cff50326c88a13bdfdb2c9c5b2203f", "started_at": 1792234272.8339775}, "kind": "tool", "observed_at": 1792234272.8339918, "path": "tool:diagnose_behavior", "phase": "auth_check", "prev_digest": "3b153deb3d2f4c4f3560095e4dff865f7f4c3974acee34124f5ea052a2aa717e", "receipt_id": "LP-1792234272-dfac6bb4", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "8756bc92697e9f5de328db31223bf7481f698e1ad7634e7f058d36d0dc83ddec", "evidence": {"detail": "minimal call failed: Text is required", "ended_at": 1792234272.8340354, "error_class": "TOOL_ERROR", "input_digest": "f9059e4bd866ddfc75fb5ccd9b89306e9cf4a65fdc82ab98c1a677c78c0d1685", "output_digest": "ead878aa4011839b17b4f7d7a75db98c83f4b3ed22140d36e4a16580cf81d671", "started_at": 1792234272.8339922}, "kind": "tool", "observed_at": 1792234272.8340425, "path": "tool:diagnose_behavior", "phase": "minimal_call", "prev_digest": "c32d50db85d43518dda60996844776e0989cd908c5b9c5030c39ae9743a71946", "receipt_id": "LP-1792234272-836d1042", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_fail"}
+{"digest": "9297fed4e6920a3f5762cfe2fb274a29c3c1fec4802393f2ff3f004d70b7719a", "evidence": {"detail": "injected fault observed failing and classified: Text is required", "ended_at": 1792234272.8340626, "error_class": "TOOL_ERROR", "injected_fault": "diagnose a nonexistent behavior", "input_digest": "8c4282e880c336c239d9ac91bd85a502b44ac6d404592d5aabfe17b8b834f849", "output_digest": "01973c0c768f536fed316470916982cef444dfc09453f9e52ae1b43fe997291c", "started_at": 1792234272.834043}, "kind": "tool", "observed_at": 1792234272.834069, "path": "tool:diagnose_behavior", "phase": "failure_injection", "prev_digest": "8756bc92697e9f5de328db31223bf7481f698e1ad7634e7f058d36d0dc83ddec", "receipt_id": "LP-1792234272-a9bb3919", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_pass"}
+{"digest": "8ad5aee780ccd936b60fc54fbaa1eb1eb53876090e95815abb2e4b6bf6587e2d", "evidence": {"detail": "recovery call failed: Text is required", "ended_at": 1792234272.8340976, "error_class": "TOOL_ERROR", "input_digest": "d78b3459d5852c759f6ea1b0f50054bdea2fe9ba78aefc436739e01da74271ad", "output_digest": "42ed65c4c87cc759829b454747b386d6ed17fbc1d384a276f655671eb83e8c8b", "started_at": 1792234272.8340695}, "kind": "tool", "observed_at": 1792234272.8341036, "path": "tool:diagnose_behavior", "phase": "recovery", "prev_digest": "9297fed4e6920a3f5762cfe2fb274a29c3c1fec4802393f2ff3f004d70b7719a", "receipt_id": "LP-1792234272-20e5a3a8", "recovery_of": "LP-1792234272-a9bb3919", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_fail"}

backups/live_proof-1792234962/receipts/tool__edit_file.jsonl

@@ -0,0 +1,8 @@
+{"digest": "48cd2f229a78ab32c2f2070a5b47e77ef5e48db795c686649565883660ee6aa5", "evidence": {"detail": "approval gate refused to prepare (observed gate): Search string is required", "ended_at": 1792233217.9267302, "error_class": "GATE_REFUSED", "input_digest": "4eabb2182550c057b79bd5976ad49473e3084277549b998891a122dc3dc7f9db", "output_digest": "a45af98f4939d4fd8485c8d4fa7ab62a45dd55e86f998696b15442bcff3e0349", "started_at": 1792233217.9261644}, "kind": "tool", "observed_at": 1792233217.9267461, "path": "tool:edit_file", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233217-a68e62ef", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_fail"}
+{"digest": "a9953e071141252ad8c3b42486abcbb1cda5789b0d829cd982d7620faf59b56f", "evidence": {"detail": "minimal call failed: Search string is required", "ended_at": 1792233217.9273448, "error_class": "TOOL_ERROR", "input_digest": "6fb6fbf080b369dc2e686b32cddbc680267340fb9425e08afb7b9fa9e7e8b377", "output_digest": "f4a206c8cead20aeeb6bb307edb77a9f2d53db376d64bc1813ce588ad6053da8", "started_at": 1792233217.9267473}, "kind": "tool", "observed_at": 1792233217.9273586, "path": "tool:edit_file", "phase": "minimal_call", "prev_digest": "48cd2f229a78ab32c2f2070a5b47e77ef5e48db795c686649565883660ee6aa5", "receipt_id": "LP-1792233217-e0f92cc9", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_fail"}
+{"digest": "a45da58bf28d26c9ae75153acebf1a8c2cc9e26a3d513714bfa8697c8bdd9620", "evidence": {"detail": "injected fault observed failing and classified: Search string is required", "ended_at": 1792233217.9278736, "error_class": "TOOL_ERROR", "injected_fault": "edit a file with a missing anchor", "input_digest": "63ce71b463d1e77f081e233375c7c291c34c6f93853676b848ef68f96dc7feaa", "output_digest": "0237d8dd751db3440a726294e02d4fd8a84b00989c6119f0577f034870a3af5d", "started_at": 1792233217.92736}, "kind": "tool", "observed_at": 1792233217.9278855, "path": "tool:edit_file", "phase": "failure_injection", "prev_digest": "a9953e071141252ad8c3b42486abcbb1cda5789b0d829cd982d7620faf59b56f", "receipt_id": "LP-1792233217-3ad43eab", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_pass"}
+{"digest": "8e4d081578f175f2b37caedab52f719b56668ca311e7e8fb31e9842feee42a6c", "evidence": {"detail": "recovery call failed: Search string is required", "ended_at": 1792233217.928333, "error_class": "TOOL_ERROR", "input_digest": "a70358c28463e2f8e5eea5eb760f76644b1e20383fa4678ec4c318d190c60d11", "output_digest": "f89be8c3fddb6328acfd951900fb398c74c50f7f1708e527e688a18d016f9302", "started_at": 1792233217.9278872}, "kind": "tool", "observed_at": 1792233217.928343, "path": "tool:edit_file", "phase": "recovery", "prev_digest": "a45da58bf28d26c9ae75153acebf1a8c2cc9e26a3d513714bfa8697c8bdd9620", "receipt_id": "LP-1792233217-6ee28288", "recovery_of": "LP-1792233217-3ad43eab", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_fail"}
+{"digest": "dc5b600d7dfc0d4e381201f66c4f3e6dcb17a9d383f1dd0ea86d214f0150ab76", "evidence": {"detail": "approval gate observed: prepared + approved (single-use token, success=True)", "ended_at": 1792234271.5940187, "error_class": null, "input_digest": "4eabb2182550c057b79bd5976ad49473e3084277549b998891a122dc3dc7f9db", "output_digest": "3a5717ee3ccb85eafbb6c567c687594f4c39d771cf429b812c26155ae4177f65", "started_at": 1792234271.5907593}, "kind": "tool", "observed_at": 1792234271.5940323, "path": "tool:edit_file", "phase": "auth_check", "prev_digest": "8e4d081578f175f2b37caedab52f719b56668ca311e7e8fb31e9842feee42a6c", "receipt_id": "LP-1792234271-74f79322", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "2c779b57fe74d139b79ce64707d0290d1252b26f3ce158dce6eb3cd0a3c040f7", "evidence": {"detail": "minimal call failed: Search string not found in edit_file.txt", "ended_at": 1792234271.5949092, "error_class": "TOOL_ERROR", "input_digest": "6fb6fbf080b369dc2e686b32cddbc680267340fb9425e08afb7b9fa9e7e8b377", "output_digest": "20ed3750d32c8a881aea08cb33fb52bba8fd61fcf969c2022b721bbd8e9ba42a", "started_at": 1792234271.5940335}, "kind": "tool", "observed_at": 1792234271.594928, "path": "tool:edit_file", "phase": "minimal_call", "prev_digest": "dc5b600d7dfc0d4e381201f66c4f3e6dcb17a9d383f1dd0ea86d214f0150ab76", "receipt_id": "LP-1792234271-b30479ab", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_fail"}
+{"digest": "5d7fd346bcbb3adbc3f3952c5f592866541d5afe2bfdeb01ee98cff7c669085c", "evidence": {"detail": "injected fault observed failing and classified: Edit failed: [Errno 2] No such file or directory: '/mnt/workdrive/rune/store/live_proof/sandbox/__nonexistent_live_probe", "ended_at": 1792234271.5957453, "error_class": "ENOENT", "injected_fault": "edit a file with a missing anchor", "input_digest": "63ce71b463d1e77f081e233375c7c291c34c6f93853676b848ef68f96dc7feaa", "output_digest": "364eb58fdab4217299d3a7f3fd590815a1964f86b74f7c2fa0d38032a62150c0", "started_at": 1792234271.594929}, "kind": "tool", "observed_at": 1792234271.5957549, "path": "tool:edit_file", "phase": "failure_injection", "prev_digest": "2c779b57fe74d139b79ce64707d0290d1252b26f3ce158dce6eb3cd0a3c040f7", "receipt_id": "LP-1792234271-65f7fd20", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_pass"}
+{"digest": "d5a0fbc69149bae42bf8d556920c9052247db4d55d5c892c55c72fa4b3b9cae9", "evidence": {"detail": "recovery call failed: Search string not found in edit_file.txt", "ended_at": 1792234271.5965545, "error_class": "TOOL_ERROR", "input_digest": "a70358c28463e2f8e5eea5eb760f76644b1e20383fa4678ec4c318d190c60d11", "output_digest": "d9bf9f6f2c4f64727973bc0f636af218d074075cd1926e0bc501813278d63992", "started_at": 1792234271.595756}, "kind": "tool", "observed_at": 1792234271.5965624, "path": "tool:edit_file", "phase": "recovery", "prev_digest": "5d7fd346bcbb3adbc3f3952c5f592866541d5afe2bfdeb01ee98cff7c669085c", "receipt_id": "LP-1792234271-28bf8c0f", "recovery_of": "LP-1792234271-65f7fd20", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_fail"}

backups/live_proof-1792234962/receipts/tool__find_capability.jsonl

@@ -0,0 +1,8 @@
+{"digest": "de031143b88a4d31724982cb7bc0a04d1b9953b41b4e86d282ea21849ad0e500", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792233218.9731452, "error_class": null, "input_digest": "0adb83aa939f7216e7bf9ba290ca9e9a64c6e8410bbf031307b944b3fd61062f", "output_digest": "35e723bbc9593fdbb9b7b37505f216ba25bc48db956b46db0c40720f6e9c55c2", "started_at": 1792233218.973144}, "kind": "tool", "observed_at": 1792233218.9731574, "path": "tool:find_capability", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233218-ce2187d2", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_pass"}
+{"digest": "9f677dc17c92915a62e15d7f750400195b31c341555f78979c1302c88ffdfc5e", "evidence": {"detail": "minimal call failed: Query is required \u2014 describe the capability you need", "ended_at": 1792233218.9731963, "error_class": "TOOL_ERROR", "input_digest": "3b47e2eacf2a6aa514330dfcd9bee3f7cfc83bae4c0930f657f00044030ae69b", "output_digest": "62565e29fa6c5e71b931cbfd6c1684af3a471c679da69334046585eefc2fee88", "started_at": 1792233218.973158}, "kind": "tool", "observed_at": 1792233218.9732049, "path": "tool:find_capability", "phase": "minimal_call", "prev_digest": "de031143b88a4d31724982cb7bc0a04d1b9953b41b4e86d282ea21849ad0e500", "receipt_id": "LP-1792233218-3566a907", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_fail"}
+{"digest": "38176a2beaf5d78cc874cbfac22ac7845b000efdb13f2a284b053d808f0a7da6", "evidence": {"detail": "injected fault observed failing and classified: Query is required \u2014 describe the capability you need", "ended_at": 1792233218.9732258, "error_class": "TOOL_ERROR", "injected_fault": "find with an empty description", "input_digest": "0ac9aad40765fe88299b7b07e5013a81a1f2a895b8afb4dce2c3cfac64d7dd26", "output_digest": "28352af01bb36df885d64cb1b6bc26d4a61e8077629f823fb67340c0d423d174", "started_at": 1792233218.9732053}, "kind": "tool", "observed_at": 1792233218.9732332, "path": "tool:find_capability", "phase": "failure_injection", "prev_digest": "9f677dc17c92915a62e15d7f750400195b31c341555f78979c1302c88ffdfc5e", "receipt_id": "LP-1792233218-712a2227", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_pass"}
+{"digest": "50854fcc958dbce5821e72e55b730b0343f44590be10930a3b12bc727881d707", "evidence": {"detail": "recovery call failed: Query is required \u2014 describe the capability you need", "ended_at": 1792233218.9732618, "error_class": "TOOL_ERROR", "input_digest": "d151d7e8dd968e38c8d85bef653e87199364bc1414b7c97b8e1fc59a601c9a59", "output_digest": "d8491c426e55ca12008180f3da157210d2f7fb207ac428a1b90ecb4de1e924ef", "started_at": 1792233218.973234}, "kind": "tool", "observed_at": 1792233218.9732685, "path": "tool:find_capability", "phase": "recovery", "prev_digest": "38176a2beaf5d78cc874cbfac22ac7845b000efdb13f2a284b053d808f0a7da6", "receipt_id": "LP-1792233218-9a17a48f", "recovery_of": "LP-1792233218-712a2227", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_fail"}
+{"digest": "1f2cd83e04e5afda5afd551a7f84165cf4203d994ea439dcdbb2c416cdce4067", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792234272.8349164, "error_class": null, "input_digest": "0adb83aa939f7216e7bf9ba290ca9e9a64c6e8410bbf031307b944b3fd61062f", "output_digest": "35e723bbc9593fdbb9b7b37505f216ba25bc48db956b46db0c40720f6e9c55c2", "started_at": 1792234272.8349156}, "kind": "tool", "observed_at": 1792234272.83493, "path": "tool:find_capability", "phase": "auth_check", "prev_digest": "50854fcc958dbce5821e72e55b730b0343f44590be10930a3b12bc727881d707", "receipt_id": "LP-1792234272-b25ebea1", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "6f8eb8865b3b3617dbe09a42bd481b06ef93e5bedab18950082231388f66cc14", "evidence": {"detail": "minimal call failed: Query is required \u2014 describe the capability you need", "ended_at": 1792234272.8349726, "error_class": "TOOL_ERROR", "input_digest": "3b47e2eacf2a6aa514330dfcd9bee3f7cfc83bae4c0930f657f00044030ae69b", "output_digest": "62565e29fa6c5e71b931cbfd6c1684af3a471c679da69334046585eefc2fee88", "started_at": 1792234272.8349307}, "kind": "tool", "observed_at": 1792234272.834981, "path": "tool:find_capability", "phase": "minimal_call", "prev_digest": "1f2cd83e04e5afda5afd551a7f84165cf4203d994ea439dcdbb2c416cdce4067", "receipt_id": "LP-1792234272-c3442c1f", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_fail"}
+{"digest": "08b43ea4362c8d56c5a006187c8c91e7da64c39056798f338505d1501606c7b3", "evidence": {"detail": "injected fault observed failing and classified: Query is required \u2014 describe the capability you need", "ended_at": 1792234272.8350027, "error_class": "TOOL_ERROR", "injected_fault": "find with an empty description", "input_digest": "0ac9aad40765fe88299b7b07e5013a81a1f2a895b8afb4dce2c3cfac64d7dd26", "output_digest": "28352af01bb36df885d64cb1b6bc26d4a61e8077629f823fb67340c0d423d174", "started_at": 1792234272.8349812}, "kind": "tool", "observed_at": 1792234272.8350093, "path": "tool:find_capability", "phase": "failure_injection", "prev_digest": "6f8eb8865b3b3617dbe09a42bd481b06ef93e5bedab18950082231388f66cc14", "receipt_id": "LP-1792234272-79fe0ee7", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_pass"}
+{"digest": "ab14d5cddb37f55e0c9adbcf00f51faf439dd10e54c6b26d2821180dd7b6606a", "evidence": {"detail": "recovery call failed: Query is required \u2014 describe the capability you need", "ended_at": 1792234272.8350449, "error_class": "TOOL_ERROR", "input_digest": "d151d7e8dd968e38c8d85bef653e87199364bc1414b7c97b8e1fc59a601c9a59", "output_digest": "d8491c426e55ca12008180f3da157210d2f7fb207ac428a1b90ecb4de1e924ef", "started_at": 1792234272.8350098}, "kind": "tool", "observed_at": 1792234272.8350532, "path": "tool:find_capability", "phase": "recovery", "prev_digest": "08b43ea4362c8d56c5a006187c8c91e7da64c39056798f338505d1501606c7b3", "receipt_id": "LP-1792234272-6766c0b0", "recovery_of": "LP-1792234272-79fe0ee7", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_fail"}

backups/live_proof-1792234962/receipts/tool__format_code.jsonl

@@ -0,0 +1,8 @@
+{"digest": "4339eac29575b6f17356e0dcd605bef2e8ae659e072cbb81416e92b88698f85c", "evidence": {"detail": "approval gate observed: prepared + approved (single-use token, success=False)", "ended_at": 1792233217.9835057, "error_class": null, "input_digest": "d496d4e824e588322f4e103d0da9bbe37a373e9ac5bc58e90ad6a4b761882322", "output_digest": "b4dacd5dcf32609a5baf5b876f42c419899d3086436c99dca34d6810663b1e21", "started_at": 1792233217.9491942}, "kind": "tool", "observed_at": 1792233217.9835477, "path": "tool:format_code", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233217-6f043361", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_pass"}
+{"digest": "9164fb82484dba5ae0e8c497728866716a2cb8874021b1fe6d53fb7273ada121", "evidence": {"detail": "format the sandbox file", "ended_at": 1792233217.984442, "error_class": null, "input_digest": "32d0d5c5830c69cf32c0ee758005a203837ad7fd802259c1ad21b6f3954bc63b", "output_digest": "c8c2a02139b62296fee3cc277bd826d681d35f5646811f49cdbc91afed8ab1e7", "started_at": 1792233217.983549}, "kind": "tool", "observed_at": 1792233217.984453, "path": "tool:format_code", "phase": "minimal_call", "prev_digest": "4339eac29575b6f17356e0dcd605bef2e8ae659e072cbb81416e92b88698f85c", "receipt_id": "LP-1792233217-39e45da0", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_pass"}
+{"digest": "0a929f0cdf83277119d58ac3dfe50b63e646b7a8eb078e44cf3a790f4384638f", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792233217.985334, "error_class": null, "injected_fault": "format a nonexistent file", "input_digest": "699188135863c5b805a7e910e721be757d537f958ef28f1590a2f7d087732c81", "output_digest": "6ed318b6181b478b9a2bc0fff2614602fb252749895d9bd5fa8b3f03b1fe613c", "started_at": 1792233217.9844537}, "kind": "tool", "observed_at": 1792233217.9853451, "path": "tool:format_code", "phase": "failure_injection", "prev_digest": "9164fb82484dba5ae0e8c497728866716a2cb8874021b1fe6d53fb7273ada121", "receipt_id": "LP-1792233217-cdc17635", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_fail"}
+{"digest": "0c704fc95e1195ff65984ee123c847f64d714cabd312ba8b8b38ec1764d8586c", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792233217.9860196, "error_class": null, "input_digest": "cfa71b658f7e5cd0bd2c68fcc3a0387dffc2997b910f2ed78a5cfb2db2c9f715", "output_digest": "ae2604e827746341571cc34b70a5fd25cfd8983942c871a97640d1012d562630", "started_at": 1792233217.9853458}, "kind": "tool", "observed_at": 1792233217.9860277, "path": "tool:format_code", "phase": "recovery", "prev_digest": "0a929f0cdf83277119d58ac3dfe50b63e646b7a8eb078e44cf3a790f4384638f", "receipt_id": "LP-1792233217-096d666c", "recovery_of": "LP-1792233217-cdc17635", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_pass"}
+{"digest": "dd1250bf123cb79d2fbf1072359e671d38772f14ca36e547320286829a3d722a", "evidence": {"detail": "approval gate observed: prepared + approved (single-use token, success=False)", "ended_at": 1792234271.6412644, "error_class": null, "input_digest": "d496d4e824e588322f4e103d0da9bbe37a373e9ac5bc58e90ad6a4b761882322", "output_digest": "b4dacd5dcf32609a5baf5b876f42c419899d3086436c99dca34d6810663b1e21", "started_at": 1792234271.6176572}, "kind": "tool", "observed_at": 1792234271.6412973, "path": "tool:format_code", "phase": "auth_check", "prev_digest": "0c704fc95e1195ff65984ee123c847f64d714cabd312ba8b8b38ec1764d8586c", "receipt_id": "LP-1792234271-bad0a4a4", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "9ec4ca7e02f555fefb59a8d9ee2e582c6b54f8b047cfeb23c6053cbeccc9f214", "evidence": {"detail": "format the sandbox file", "ended_at": 1792234271.6419256, "error_class": null, "input_digest": "32d0d5c5830c69cf32c0ee758005a203837ad7fd802259c1ad21b6f3954bc63b", "output_digest": "c8c2a02139b62296fee3cc277bd826d681d35f5646811f49cdbc91afed8ab1e7", "started_at": 1792234271.6412988}, "kind": "tool", "observed_at": 1792234271.641933, "path": "tool:format_code", "phase": "minimal_call", "prev_digest": "dd1250bf123cb79d2fbf1072359e671d38772f14ca36e547320286829a3d722a", "receipt_id": "LP-1792234271-7eee87ea", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_pass"}
+{"digest": "e45f1684037afb1cf03448b01053d8170b613851e9484de8010ef46621ad6e04", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792234271.6423914, "error_class": null, "injected_fault": "format a nonexistent file", "input_digest": "699188135863c5b805a7e910e721be757d537f958ef28f1590a2f7d087732c81", "output_digest": "6ed318b6181b478b9a2bc0fff2614602fb252749895d9bd5fa8b3f03b1fe613c", "started_at": 1792234271.6419346}, "kind": "tool", "observed_at": 1792234271.6424007, "path": "tool:format_code", "phase": "failure_injection", "prev_digest": "9ec4ca7e02f555fefb59a8d9ee2e582c6b54f8b047cfeb23c6053cbeccc9f214", "receipt_id": "LP-1792234271-fdfacc31", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_fail"}
+{"digest": "60ce32130f5c17019ac7b70717e0f420fa54c8ed56a68fd674621e94275be7b2", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792234271.6428502, "error_class": null, "input_digest": "cfa71b658f7e5cd0bd2c68fcc3a0387dffc2997b910f2ed78a5cfb2db2c9f715", "output_digest": "ae2604e827746341571cc34b70a5fd25cfd8983942c871a97640d1012d562630", "started_at": 1792234271.6424017}, "kind": "tool", "observed_at": 1792234271.6428561, "path": "tool:format_code", "phase": "recovery", "prev_digest": "e45f1684037afb1cf03448b01053d8170b613851e9484de8010ef46621ad6e04", "receipt_id": "LP-1792234271-a43376a0", "recovery_of": "LP-1792234271-fdfacc31", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_pass"}

backups/live_proof-1792234962/receipts/tool__git_commit.jsonl

@@ -0,0 +1,8 @@
+{"digest": "916622b0692180079be0fa14dc9868f280ae325a0ccb735aba7df355edbc013b", "evidence": {"detail": "approval gate observed: prepared + approved (single-use token, success=True)", "ended_at": 1792233218.126073, "error_class": null, "input_digest": "ed159930321ec7053a54a9f1e7a82daeadcf1554c84fc707791bfe3fed89ae36", "output_digest": "577080931c4764d94a2b67815cba86356206569ca9fc76ae2bb9f6ae150bfc06", "started_at": 1792233218.0524125}, "kind": "tool", "observed_at": 1792233218.1261241, "path": "tool:git_commit", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233218-178540f6", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_pass"}
+{"digest": "38f228c1f4e5b222b197325149efd41779a62aface45517b0a54873a0c960b27", "evidence": {"detail": "commit the sandbox repo", "ended_at": 1792233218.1262887, "error_class": null, "input_digest": "54ceaa1b4eccbee19db6a3dc8c24f692d029804bd0ae7c9f685c1c7860a3f2d0", "output_digest": "7b06fbc1d8ade52285636daec396c0d8ca75964b514e1077139302b18963279c", "started_at": 1792233218.1261256}, "kind": "tool", "observed_at": 1792233218.1262999, "path": "tool:git_commit", "phase": "minimal_call", "prev_digest": "916622b0692180079be0fa14dc9868f280ae325a0ccb735aba7df355edbc013b", "receipt_id": "LP-1792233218-b761dbbe", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_pass"}
+{"digest": "8e1595f6593a9291f038589c9e34b4d14a173b34764cb2e7644ffbd4c047ffb0", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792233218.1263576, "error_class": null, "injected_fault": "commit in a nonexistent repo", "input_digest": "9bddc4cfb693552c656dc9e47584d9068b3be99daae94438e0530121cb97fc8e", "output_digest": "7f907c177d743bae750c07e27658d6879a89845424b140bed34862aacda401b7", "started_at": 1792233218.1263006}, "kind": "tool", "observed_at": 1792233218.1263666, "path": "tool:git_commit", "phase": "failure_injection", "prev_digest": "38f228c1f4e5b222b197325149efd41779a62aface45517b0a54873a0c960b27", "receipt_id": "LP-1792233218-8677fcf9", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_fail"}
+{"digest": "83fb0e9120ac471c8424758037a68d54722fc570a42b735e661daabe12631fe8", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792233218.1264496, "error_class": null, "input_digest": "bc75d76baf987fe949e4bb458bfc3b5746e59531bce0b74ddc3e54054a7c6b9d", "output_digest": "026076a4884e63ffc7e67997e014186d6211e01bc0e63d77c19b6392c1836f9c", "started_at": 1792233218.1263678}, "kind": "tool", "observed_at": 1792233218.1264575, "path": "tool:git_commit", "phase": "recovery", "prev_digest": "8e1595f6593a9291f038589c9e34b4d14a173b34764cb2e7644ffbd4c047ffb0", "receipt_id": "LP-1792233218-ccff3ae0", "recovery_of": "LP-1792233218-8677fcf9", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_pass"}
+{"digest": "073f9815684222ff103e6a3e30db658ec97162fe202cd2d5c05c4ba111d88e88", "evidence": {"detail": "approval gate observed: prepared + approved (single-use token, success=True)", "ended_at": 1792234271.914318, "error_class": null, "input_digest": "ed159930321ec7053a54a9f1e7a82daeadcf1554c84fc707791bfe3fed89ae36", "output_digest": "577080931c4764d94a2b67815cba86356206569ca9fc76ae2bb9f6ae150bfc06", "started_at": 1792234271.71573}, "kind": "tool", "observed_at": 1792234271.9143634, "path": "tool:git_commit", "phase": "auth_check", "prev_digest": "83fb0e9120ac471c8424758037a68d54722fc570a42b735e661daabe12631fe8", "receipt_id": "LP-1792234271-81ad40b9", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "1a1a64773f8dfe4b3618f26d6d8c60b8c17ec71a1acc6436fbd1babf7ddd5388", "evidence": {"detail": "commit the sandbox repo", "ended_at": 1792234271.9145355, "error_class": null, "input_digest": "54ceaa1b4eccbee19db6a3dc8c24f692d029804bd0ae7c9f685c1c7860a3f2d0", "output_digest": "7b06fbc1d8ade52285636daec396c0d8ca75964b514e1077139302b18963279c", "started_at": 1792234271.9143646}, "kind": "tool", "observed_at": 1792234271.9145465, "path": "tool:git_commit", "phase": "minimal_call", "prev_digest": "073f9815684222ff103e6a3e30db658ec97162fe202cd2d5c05c4ba111d88e88", "receipt_id": "LP-1792234271-fe21eb5b", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_pass"}
+{"digest": "4ecfc38df097fa56163ae6b8501207c50ca58100ea634511978be196a1e628a8", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792234271.9145935, "error_class": null, "injected_fault": "commit in a nonexistent repo", "input_digest": "9bddc4cfb693552c656dc9e47584d9068b3be99daae94438e0530121cb97fc8e", "output_digest": "7f907c177d743bae750c07e27658d6879a89845424b140bed34862aacda401b7", "started_at": 1792234271.9145477}, "kind": "tool", "observed_at": 1792234271.914602, "path": "tool:git_commit", "phase": "failure_injection", "prev_digest": "1a1a64773f8dfe4b3618f26d6d8c60b8c17ec71a1acc6436fbd1babf7ddd5388", "receipt_id": "LP-1792234271-bc6f3907", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_fail"}
+{"digest": "994380b2322699aaef85b0b64f07828650b6f06cc25a3a0c5d70c84b5fb7a610", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792234271.9146597, "error_class": null, "input_digest": "bc75d76baf987fe949e4bb458bfc3b5746e59531bce0b74ddc3e54054a7c6b9d", "output_digest": "026076a4884e63ffc7e67997e014186d6211e01bc0e63d77c19b6392c1836f9c", "started_at": 1792234271.9146032}, "kind": "tool", "observed_at": 1792234271.9146674, "path": "tool:git_commit", "phase": "recovery", "prev_digest": "4ecfc38df097fa56163ae6b8501207c50ca58100ea634511978be196a1e628a8", "receipt_id": "LP-1792234271-a1df6340", "recovery_of": "LP-1792234271-bc6f3907", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_pass"}

backups/live_proof-1792234962/receipts/tool__git_diff.jsonl

@@ -0,0 +1,8 @@
+{"digest": "b8a6d2fdafc5e73d9a7ede9bd9ad93a09718d7c5aecec56f3b59828ff74093f4", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792233217.9869187, "error_class": null, "input_digest": "dd109683f9eb4df87b83f1537860edf044f18fe29fb5bf9de5b570e4d42351d1", "output_digest": "600f50fcd096a6e7f256b1cb1e984795b95d9a2bca2271c14b1e555df34b0535", "started_at": 1792233217.9869177}, "kind": "tool", "observed_at": 1792233217.9869332, "path": "tool:git_diff", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233217-f020249f", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_pass"}
+{"digest": "4e3eed0978e2137df3ac4b4145d80dc8fe36872dbc7608de219977f684586323", "evidence": {"detail": "git diff over the sandbox repo", "ended_at": 1792233217.9911351, "error_class": null, "input_digest": "5dc9c8c0e0c1ef6aefe7169679869a6840c7df389307272714b882247d263083", "output_digest": "6ac3a850c53e3379dd847a6954b7c10317b0e655863a0c1fa67ac996102b4a9d", "started_at": 1792233217.9869337}, "kind": "tool", "observed_at": 1792233217.9911575, "path": "tool:git_diff", "phase": "minimal_call", "prev_digest": "b8a6d2fdafc5e73d9a7ede9bd9ad93a09718d7c5aecec56f3b59828ff74093f4", "receipt_id": "LP-1792233217-b056453e", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_pass"}
+{"digest": "1399ec2a6747f3bafa601cf469768b969520548b21c2104d379854cf570ed075", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792233217.9927576, "error_class": null, "injected_fault": "diff a denied (blocked) repo path", "input_digest": "56cb25dd83425ae7f3d26a189d872c5fbde6dae02b7a982a013494f55e135edf", "output_digest": "48648c794f0ada1a506476a80fd26a95e9ed255acab9015aa01963b483fae14f", "started_at": 1792233217.9911582}, "kind": "tool", "observed_at": 1792233217.9927845, "path": "tool:git_diff", "phase": "failure_injection", "prev_digest": "4e3eed0978e2137df3ac4b4145d80dc8fe36872dbc7608de219977f684586323", "receipt_id": "LP-1792233217-fe7a0fc9", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_fail"}
+{"digest": "6ff4c8d31c5acdb1ee3abf1e74e9f14d308f2b493d6ce25896109a5df4447b8b", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792233217.9959311, "error_class": null, "input_digest": "6133a0f98e6ba29061d08e6c51faae4dbf25538ccb39d04b85a8dee63616f948", "output_digest": "3e4609baeb5a414e794e4616e9bfc60632540142450492360ace994cce0b0777", "started_at": 1792233217.9927852}, "kind": "tool", "observed_at": 1792233217.9959495, "path": "tool:git_diff", "phase": "recovery", "prev_digest": "1399ec2a6747f3bafa601cf469768b969520548b21c2104d379854cf570ed075", "receipt_id": "LP-1792233217-b2af2209", "recovery_of": "LP-1792233217-fe7a0fc9", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_pass"}
+{"digest": "70fdd79ac35608e5c15786e35e57f54b16991f8969413bef7bd20ad1840c8ce9", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792234271.6440454, "error_class": null, "input_digest": "dd109683f9eb4df87b83f1537860edf044f18fe29fb5bf9de5b570e4d42351d1", "output_digest": "600f50fcd096a6e7f256b1cb1e984795b95d9a2bca2271c14b1e555df34b0535", "started_at": 1792234271.6440432}, "kind": "tool", "observed_at": 1792234271.6440785, "path": "tool:git_diff", "phase": "auth_check", "prev_digest": "6ff4c8d31c5acdb1ee3abf1e74e9f14d308f2b493d6ce25896109a5df4447b8b", "receipt_id": "LP-1792234271-df5ab7a3", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "a82ddab09ba040046b1c766ee624456ce04eb9c483c498567b9f6262bdf05445", "evidence": {"detail": "git diff over the sandbox repo", "ended_at": 1792234271.6542373, "error_class": null, "input_digest": "5dc9c8c0e0c1ef6aefe7169679869a6840c7df389307272714b882247d263083", "output_digest": "6ac3a850c53e3379dd847a6954b7c10317b0e655863a0c1fa67ac996102b4a9d", "started_at": 1792234271.6440797}, "kind": "tool", "observed_at": 1792234271.6542816, "path": "tool:git_diff", "phase": "minimal_call", "prev_digest": "70fdd79ac35608e5c15786e35e57f54b16991f8969413bef7bd20ad1840c8ce9", "receipt_id": "LP-1792234271-932fb030", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_pass"}
+{"digest": "289c44ecd57249e81f024825bfc778c46b26b8e4a7073547222773a2cee293f1", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792234271.6567209, "error_class": null, "injected_fault": "diff a denied (blocked) repo path", "input_digest": "56cb25dd83425ae7f3d26a189d872c5fbde6dae02b7a982a013494f55e135edf", "output_digest": "48648c794f0ada1a506476a80fd26a95e9ed255acab9015aa01963b483fae14f", "started_at": 1792234271.6542833}, "kind": "tool", "observed_at": 1792234271.6567662, "path": "tool:git_diff", "phase": "failure_injection", "prev_digest": "a82ddab09ba040046b1c766ee624456ce04eb9c483c498567b9f6262bdf05445", "receipt_id": "LP-1792234271-e5bd14bc", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_fail"}
+{"digest": "ca6edf5380c18685a683509c5919f4c89391a5c058ac32601c5d3d91a20fbaec", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792234271.6615918, "error_class": null, "input_digest": "6133a0f98e6ba29061d08e6c51faae4dbf25538ccb39d04b85a8dee63616f948", "output_digest": "3e4609baeb5a414e794e4616e9bfc60632540142450492360ace994cce0b0777", "started_at": 1792234271.656769}, "kind": "tool", "observed_at": 1792234271.661634, "path": "tool:git_diff", "phase": "recovery", "prev_digest": "289c44ecd57249e81f024825bfc778c46b26b8e4a7073547222773a2cee293f1", "receipt_id": "LP-1792234271-7aab4e64", "recovery_of": "LP-1792234271-e5bd14bc", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_pass"}

backups/live_proof-1792234962/receipts/tool__git_log.jsonl

@@ -0,0 +1,8 @@
+{"digest": "d37a399bd2e98a508d665ae770cd0fd13b392be7377ffd8a83a2cfc948df4dcf", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792233217.9971395, "error_class": null, "input_digest": "649063c0ce4caeb01410f1d801f5473ca5a915b93b584979ed58df4c7d174e56", "output_digest": "474dbdd4b646a9d07ca2953c3344cfc3e70a4eaf5424262e68a8cf5bff6a2c3d", "started_at": 1792233217.997138}, "kind": "tool", "observed_at": 1792233217.9971535, "path": "tool:git_log", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233217-c706c568", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_pass"}
+{"digest": "dbc6f52f31665718ef4535042dce6d2117a13c928387e608b7dfb3b8c87604d2", "evidence": {"detail": "git log over the sandbox repo", "ended_at": 1792233218.026486, "error_class": null, "input_digest": "3b421cec4cca1fb5c1c61278a90d780af62162d18945951c736240001ecd785c", "output_digest": "0909012aa545ff66ddfd9e7f1a0effe86d275452a13dec63a99590b908bffdd4", "started_at": 1792233217.997154}, "kind": "tool", "observed_at": 1792233218.0265276, "path": "tool:git_log", "phase": "minimal_call", "prev_digest": "d37a399bd2e98a508d665ae770cd0fd13b392be7377ffd8a83a2cfc948df4dcf", "receipt_id": "LP-1792233218-a9755c01", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_pass"}
+{"digest": "7314b1c165f9147d420611dd332bb5acb2d7f35515033e212a6638557f92c060", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792233218.0281873, "error_class": null, "injected_fault": "log a denied (blocked) repo path", "input_digest": "6975cd174ebb61d6ef0f859f9c4dc4e282b3d2190531ac3195577f10652bdaf1", "output_digest": "1e710f2b8c9eb63962f2bc36711fbc0f55f993f6f6e3f0450e95fddb0c982a02", "started_at": 1792233218.0265288}, "kind": "tool", "observed_at": 1792233218.028207, "path": "tool:git_log", "phase": "failure_injection", "prev_digest": "dbc6f52f31665718ef4535042dce6d2117a13c928387e608b7dfb3b8c87604d2", "receipt_id": "LP-1792233218-21a25935", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_fail"}
+{"digest": "8c5bdf961689cdf93e47cab74adf6189a70250d3906db4058725b7545efd3d86", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792233218.0514162, "error_class": null, "input_digest": "40c3054fe56e3e132c4996bcce0ddaa321ff089a2a3cea1a86fbfd313bb3dcbd", "output_digest": "1737bb3c248263253e525f3891c664753ee30c1038127d2d9e5e806b415ad8a5", "started_at": 1792233218.0282078}, "kind": "tool", "observed_at": 1792233218.0514512, "path": "tool:git_log", "phase": "recovery", "prev_digest": "7314b1c165f9147d420611dd332bb5acb2d7f35515033e212a6638557f92c060", "receipt_id": "LP-1792233218-876244c2", "recovery_of": "LP-1792233218-21a25935", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_pass"}
+{"digest": "2602a1f6fcea47d4c440e6d577a7264c45ad834f7e9119ae8a908c96796b7824", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792234271.6629384, "error_class": null, "input_digest": "649063c0ce4caeb01410f1d801f5473ca5a915b93b584979ed58df4c7d174e56", "output_digest": "474dbdd4b646a9d07ca2953c3344cfc3e70a4eaf5424262e68a8cf5bff6a2c3d", "started_at": 1792234271.662937}, "kind": "tool", "observed_at": 1792234271.6629672, "path": "tool:git_log", "phase": "auth_check", "prev_digest": "8c5bdf961689cdf93e47cab74adf6189a70250d3906db4058725b7545efd3d86", "receipt_id": "LP-1792234271-37ca6466", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "5ed130156aa2ab7ca5374d4f96839bfc74606f52c39c34561109ab2f48fb86c6", "evidence": {"detail": "git log over the sandbox repo", "ended_at": 1792234271.6929662, "error_class": null, "input_digest": "3b421cec4cca1fb5c1c61278a90d780af62162d18945951c736240001ecd785c", "output_digest": "0909012aa545ff66ddfd9e7f1a0effe86d275452a13dec63a99590b908bffdd4", "started_at": 1792234271.6629682}, "kind": "tool", "observed_at": 1792234271.6930032, "path": "tool:git_log", "phase": "minimal_call", "prev_digest": "2602a1f6fcea47d4c440e6d577a7264c45ad834f7e9119ae8a908c96796b7824", "receipt_id": "LP-1792234271-d90ab32f", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_pass"}
+{"digest": "5f3052d9436dd547a5b25d8ea05cbce96601d1d8746e90a54c26812f8f964e02", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792234271.6946573, "error_class": null, "injected_fault": "log a denied (blocked) repo path", "input_digest": "6975cd174ebb61d6ef0f859f9c4dc4e282b3d2190531ac3195577f10652bdaf1", "output_digest": "1e710f2b8c9eb63962f2bc36711fbc0f55f993f6f6e3f0450e95fddb0c982a02", "started_at": 1792234271.6930046}, "kind": "tool", "observed_at": 1792234271.6946838, "path": "tool:git_log", "phase": "failure_injection", "prev_digest": "5ed130156aa2ab7ca5374d4f96839bfc74606f52c39c34561109ab2f48fb86c6", "receipt_id": "LP-1792234271-4e1f029c", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_fail"}
+{"digest": "c314d226a8f46b7e3ac7b071c274d7c7e6c3ca590d7806b5f14eca3cdc2c6cd3", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792234271.714346, "error_class": null, "input_digest": "40c3054fe56e3e132c4996bcce0ddaa321ff089a2a3cea1a86fbfd313bb3dcbd", "output_digest": "1737bb3c248263253e525f3891c664753ee30c1038127d2d9e5e806b415ad8a5", "started_at": 1792234271.6946852}, "kind": "tool", "observed_at": 1792234271.7143848, "path": "tool:git_log", "phase": "recovery", "prev_digest": "5f3052d9436dd547a5b25d8ea05cbce96601d1d8746e90a54c26812f8f964e02", "receipt_id": "LP-1792234271-b05f6066", "recovery_of": "LP-1792234271-4e1f029c", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_pass"}

backups/live_proof-1792234962/receipts/tool__glob_files.jsonl

@@ -0,0 +1,8 @@
+{"digest": "fbd396f3b474173ddee9fa101702586dcdc0d40c54a13859febefb50cedd8278", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792233217.9339151, "error_class": null, "input_digest": "4f843121fb703d9b35dfc4d14dfa2853921cda7260dbcccf319fe2a34a530748", "output_digest": "4eb22f7ea0eddae4e334f9327b3bd1b401a7e6bca7e6514cb36519196079f333", "started_at": 1792233217.933913}, "kind": "tool", "observed_at": 1792233217.933931, "path": "tool:glob_files", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233217-d0ea8c91", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_pass"}
+{"digest": "5a44ebf5c7aed90e1c87242450efe28bab9e915a0b56be7868c30cff5b1c3f03", "evidence": {"detail": "minimal call failed: Glob failed: Non-relative patterns are unsupported", "ended_at": 1792233217.934225, "error_class": "TOOL_ERROR", "input_digest": "6d29ab4801e6dcf7ac519cb0317756465a052e717cca11a43c6475eb2756ab13", "output_digest": "18ca7c617ecabdb08c57e16078a646adc71ecd3c7dbb989432958beaf46f5bf4", "started_at": 1792233217.9339318}, "kind": "tool", "observed_at": 1792233217.9342358, "path": "tool:glob_files", "phase": "minimal_call", "prev_digest": "fbd396f3b474173ddee9fa101702586dcdc0d40c54a13859febefb50cedd8278", "receipt_id": "LP-1792233217-e24f8da8", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_fail"}
+{"digest": "cf3da74f77b687063e6a522ba59369a6a0f0d88b982187cf2f3e6ebdc7f4936d", "evidence": {"detail": "injected fault observed failing and classified: Glob failed: Non-relative patterns are unsupported", "ended_at": 1792233217.9344637, "error_class": "TOOL_ERROR", "injected_fault": "glob a denied (blocked) directory", "input_digest": "18ecd842ba95f399ce55dad78bc94a4b2e81f2aab234b74e78a065dbd09fc8a9", "output_digest": "fc71fec9e8df2268216fa60097e52336b6a820b3912777259e4c30e2a363e3af", "started_at": 1792233217.9342365}, "kind": "tool", "observed_at": 1792233217.9344726, "path": "tool:glob_files", "phase": "failure_injection", "prev_digest": "5a44ebf5c7aed90e1c87242450efe28bab9e915a0b56be7868c30cff5b1c3f03", "receipt_id": "LP-1792233217-2e142c3a", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_pass"}
+{"digest": "e19f188c25fa4ecf7b5eb61060dbe9bd6da5e382de88b98cbb45321e0b3fe458", "evidence": {"detail": "recovery call failed: Glob failed: Non-relative patterns are unsupported", "ended_at": 1792233217.9346797, "error_class": "TOOL_ERROR", "input_digest": "c888737009165e2beefd3b8a85d12410caa374e096bc767e81c8f72504262fe5", "output_digest": "548f772b66899f037391d4b5a9bc3f78eb7db2b3ca8636b1e2803f31cdcc9fb4", "started_at": 1792233217.9344733}, "kind": "tool", "observed_at": 1792233217.9346871, "path": "tool:glob_files", "phase": "recovery", "prev_digest": "cf3da74f77b687063e6a522ba59369a6a0f0d88b982187cf2f3e6ebdc7f4936d", "receipt_id": "LP-1792233217-66d6763a", "recovery_of": "LP-1792233217-2e142c3a", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_fail"}
+{"digest": "c6e7d44d8db50d0c011d05262ace8a57f1f3249e42fd6557d8f8ed20799d54d4", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792234271.6009638, "error_class": null, "input_digest": "4f843121fb703d9b35dfc4d14dfa2853921cda7260dbcccf319fe2a34a530748", "output_digest": "4eb22f7ea0eddae4e334f9327b3bd1b401a7e6bca7e6514cb36519196079f333", "started_at": 1792234271.6009629}, "kind": "tool", "observed_at": 1792234271.6009784, "path": "tool:glob_files", "phase": "auth_check", "prev_digest": "e19f188c25fa4ecf7b5eb61060dbe9bd6da5e382de88b98cbb45321e0b3fe458", "receipt_id": "LP-1792234271-28ce602a", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "cd592f9f5311b2b7e5ff65312869c8f18ea71869acde9bfcc5188a2e67ff5692", "evidence": {"detail": "minimal call failed: Glob failed: Non-relative patterns are unsupported", "ended_at": 1792234271.6012032, "error_class": "TOOL_ERROR", "input_digest": "6d29ab4801e6dcf7ac519cb0317756465a052e717cca11a43c6475eb2756ab13", "output_digest": "18ca7c617ecabdb08c57e16078a646adc71ecd3c7dbb989432958beaf46f5bf4", "started_at": 1792234271.600979}, "kind": "tool", "observed_at": 1792234271.6012113, "path": "tool:glob_files", "phase": "minimal_call", "prev_digest": "c6e7d44d8db50d0c011d05262ace8a57f1f3249e42fd6557d8f8ed20799d54d4", "receipt_id": "LP-1792234271-166ef69b", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_fail"}
+{"digest": "e8f61c426974e4fe988c9da8d186b85f2beab79d92b33b184df5ddd3a5a071f3", "evidence": {"detail": "injected fault observed failing and classified: Glob failed: Non-relative patterns are unsupported", "ended_at": 1792234271.6014142, "error_class": "TOOL_ERROR", "injected_fault": "glob a denied (blocked) directory", "input_digest": "18ecd842ba95f399ce55dad78bc94a4b2e81f2aab234b74e78a065dbd09fc8a9", "output_digest": "fc71fec9e8df2268216fa60097e52336b6a820b3912777259e4c30e2a363e3af", "started_at": 1792234271.6012118}, "kind": "tool", "observed_at": 1792234271.6014228, "path": "tool:glob_files", "phase": "failure_injection", "prev_digest": "cd592f9f5311b2b7e5ff65312869c8f18ea71869acde9bfcc5188a2e67ff5692", "receipt_id": "LP-1792234271-4a6974f3", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_pass"}
+{"digest": "b3ce4f9583b5fabaf26f4a125d5b71614687f2d4919249829ac39c749d3feda1", "evidence": {"detail": "recovery call failed: Glob failed: Non-relative patterns are unsupported", "ended_at": 1792234271.6016119, "error_class": "TOOL_ERROR", "input_digest": "c888737009165e2beefd3b8a85d12410caa374e096bc767e81c8f72504262fe5", "output_digest": "548f772b66899f037391d4b5a9bc3f78eb7db2b3ca8636b1e2803f31cdcc9fb4", "started_at": 1792234271.6014235}, "kind": "tool", "observed_at": 1792234271.6016188, "path": "tool:glob_files", "phase": "recovery", "prev_digest": "e8f61c426974e4fe988c9da8d186b85f2beab79d92b33b184df5ddd3a5a071f3", "receipt_id": "LP-1792234271-aace9b93", "recovery_of": "LP-1792234271-4a6974f3", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_fail"}

backups/live_proof-1792234962/receipts/tool__grep_files.jsonl

@@ -0,0 +1,8 @@
+{"digest": "ca6b2d197b0f4044a4208800b15e8990a18af4aa4e3c7e165c884f725b439706", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792233217.935326, "error_class": null, "input_digest": "cdd89c699a648d21d577bcfeb2b87a987f64944e82350846d139f4f1eec4d418", "output_digest": "d4766f9548002e4602da5da4f827f61294cc8b08a234cc7880f8ae42147ab278", "started_at": 1792233217.9353254}, "kind": "tool", "observed_at": 1792233217.9353373, "path": "tool:grep_files", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233217-17701868", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_pass"}
+{"digest": "ce86db21dd675cfb1f8e5f9f4af6bc822f65d2064ff62f12629216de55e7e112", "evidence": {"detail": "grep a sandbox file", "ended_at": 1792233217.9409065, "error_class": null, "input_digest": "38ce20c1d4bc02969671edfe6f3464b78a54a6ba9b089ddad424c5583748a6e8", "output_digest": "1955a17bb45ecc94b754b450cee352c2fe72595a1b05b703f93fd2d8acde73ba", "started_at": 1792233217.9353378}, "kind": "tool", "observed_at": 1792233217.9409366, "path": "tool:grep_files", "phase": "minimal_call", "prev_digest": "ca6b2d197b0f4044a4208800b15e8990a18af4aa4e3c7e165c884f725b439706", "receipt_id": "LP-1792233217-a7192254", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_pass"}
+{"digest": "3e3047bd15e478e012e1aedd3dbfd41e33ebf414f0a9a3b571f88d4710a07a96", "evidence": {"detail": "injected fault observed failing and classified: Access denied: /etc/__live_proof_probe__", "ended_at": 1792233217.9411662, "error_class": "PERMISSION", "injected_fault": "grep a denied (blocked) directory", "input_digest": "c65c78d2d1158e068826d995cf869a01093c6595829ef41bd2b4802ade1c0ef2", "output_digest": "e2c0b1072fac866e0ec2ea1177d20dee5a2a89439b2307e06cae94d31ea6c59b", "started_at": 1792233217.9409375}, "kind": "tool", "observed_at": 1792233217.941184, "path": "tool:grep_files", "phase": "failure_injection", "prev_digest": "ce86db21dd675cfb1f8e5f9f4af6bc822f65d2064ff62f12629216de55e7e112", "receipt_id": "LP-1792233217-f7b02ecf", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_pass"}
+{"digest": "54090879f2f24ba8696656076e14b9d392673b13205a318d696404e416581769", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792233217.9442227, "error_class": null, "input_digest": "364577c4d7e3583ff668e6ab3d5c7c327ccdad96e32b554b6701e3ff16665bb4", "output_digest": "492c4575f234f3b56c2e0b3271eb87dfccf7fae373e64af1c20753f9bd40ce11", "started_at": 1792233217.9411852}, "kind": "tool", "observed_at": 1792233217.9442453, "path": "tool:grep_files", "phase": "recovery", "prev_digest": "3e3047bd15e478e012e1aedd3dbfd41e33ebf414f0a9a3b571f88d4710a07a96", "receipt_id": "LP-1792233217-120e6b01", "recovery_of": "LP-1792233217-f7b02ecf", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_pass"}
+{"digest": "725a232bd125611cfcbab7e6c0702359bedfeef5cf4215cbd4b9cab5befcbb7a", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792234271.6025229, "error_class": null, "input_digest": "cdd89c699a648d21d577bcfeb2b87a987f64944e82350846d139f4f1eec4d418", "output_digest": "d4766f9548002e4602da5da4f827f61294cc8b08a234cc7880f8ae42147ab278", "started_at": 1792234271.6025221}, "kind": "tool", "observed_at": 1792234271.6025395, "path": "tool:grep_files", "phase": "auth_check", "prev_digest": "54090879f2f24ba8696656076e14b9d392673b13205a318d696404e416581769", "receipt_id": "LP-1792234271-37ebbcdd", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "d4579a36a0043c200661f235d2f5562ce9c1142d091d4fef7e708948f3e39e75", "evidence": {"detail": "grep a sandbox file", "ended_at": 1792234271.6092792, "error_class": null, "input_digest": "38ce20c1d4bc02969671edfe6f3464b78a54a6ba9b089ddad424c5583748a6e8", "output_digest": "1955a17bb45ecc94b754b450cee352c2fe72595a1b05b703f93fd2d8acde73ba", "started_at": 1792234271.6025403}, "kind": "tool", "observed_at": 1792234271.6093132, "path": "tool:grep_files", "phase": "minimal_call", "prev_digest": "725a232bd125611cfcbab7e6c0702359bedfeef5cf4215cbd4b9cab5befcbb7a", "receipt_id": "LP-1792234271-aadffe6a", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_pass"}
+{"digest": "4e7426470340a5eaacc4f26bdec0799758778fb2c69e7830aff9c423220565fa", "evidence": {"detail": "injected fault observed failing and classified: Access denied: /etc/__live_proof_probe__", "ended_at": 1792234271.6094868, "error_class": "PERMISSION", "injected_fault": "grep a denied (blocked) directory", "input_digest": "c65c78d2d1158e068826d995cf869a01093c6595829ef41bd2b4802ade1c0ef2", "output_digest": "e2c0b1072fac866e0ec2ea1177d20dee5a2a89439b2307e06cae94d31ea6c59b", "started_at": 1792234271.609315}, "kind": "tool", "observed_at": 1792234271.6095002, "path": "tool:grep_files", "phase": "failure_injection", "prev_digest": "d4579a36a0043c200661f235d2f5562ce9c1142d091d4fef7e708948f3e39e75", "receipt_id": "LP-1792234271-b3ea1b58", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_pass"}
+{"digest": "e043fb2c4fe25f6f1be293c3af0cc419fc09ff0823a93fe3b4bb0c2b3ea29a14", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792234271.6120403, "error_class": null, "input_digest": "364577c4d7e3583ff668e6ab3d5c7c327ccdad96e32b554b6701e3ff16665bb4", "output_digest": "492c4575f234f3b56c2e0b3271eb87dfccf7fae373e64af1c20753f9bd40ce11", "started_at": 1792234271.6095011}, "kind": "tool", "observed_at": 1792234271.6121018, "path": "tool:grep_files", "phase": "recovery", "prev_digest": "4e7426470340a5eaacc4f26bdec0799758778fb2c69e7830aff9c423220565fa", "receipt_id": "LP-1792234271-14b06674", "recovery_of": "LP-1792234271-b3ea1b58", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_pass"}

backups/live_proof-1792234962/receipts/tool__lint_file.jsonl

@@ -0,0 +1,8 @@
+{"digest": "2afa23cbd5394f3b1d8a5da9bef664f881009a39743f3b79d69e79aafa39194b", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792233217.9476285, "error_class": null, "input_digest": "2a7a6a240931ee72ca2019216925dacd7aba19b13999a3fb7ceb236d7a0288a7", "output_digest": "9ac538a32cfeadb31fccf607fac77e1f8a64b2053a6083c94cabc4a7c835c8f0", "started_at": 1792233217.9476275}, "kind": "tool", "observed_at": 1792233217.9476404, "path": "tool:lint_file", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233217-4dd5966b", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_pass"}
+{"digest": "4802525f3c9276621b2a362eb5264cb28c5d48b966dd085534e992f4d4dc5730", "evidence": {"detail": "minimal call succeeded", "ended_at": 1792233217.9476998, "error_class": null, "input_digest": "cd2bb73a5642aadf8695d8127b90b452514ce85166ab6b49b18d904eedc678cb", "output_digest": "be244c27ed1fc6de75e4aff5cc21ec8e59617b9bfabc778bf55d1d5834c94a22", "started_at": 1792233217.947641}, "kind": "tool", "observed_at": 1792233217.9477074, "path": "tool:lint_file", "phase": "minimal_call", "prev_digest": "2afa23cbd5394f3b1d8a5da9bef664f881009a39743f3b79d69e79aafa39194b", "receipt_id": "LP-1792233217-925281b0", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_pass"}
+{"digest": "8be94b51c2df782f24645930b8dfbb35585560a2da00bdd175900456a7842581", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792233217.947737, "error_class": null, "injected_fault": "nonexistent path", "input_digest": "25ba8e3e86e54b7b999f22e50ae9aff41264c8bacefdf7c76132c9e3f5961233", "output_digest": "12ce9c293d4b3616c57584df85827ffacb72e660f76329c9ca01b4fa1367ac13", "started_at": 1792233217.947708}, "kind": "tool", "observed_at": 1792233217.9477437, "path": "tool:lint_file", "phase": "failure_injection", "prev_digest": "4802525f3c9276621b2a362eb5264cb28c5d48b966dd085534e992f4d4dc5730", "receipt_id": "LP-1792233217-9a26297d", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_fail"}
+{"digest": "08c9558952fc2be0ab5cd37939d31b3b0d90370ed2d184c0f0891715d29925a5", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792233217.947783, "error_class": null, "input_digest": "bbb6def7000c7b95ae376d280dee9b494d20d8454507e06fe1ee032a0a4b043c", "output_digest": "0759c6c15d35bd61e08ac0a7d39b1b6ec3a73f97833c9df5a3719b77d99e2724", "started_at": 1792233217.9477446}, "kind": "tool", "observed_at": 1792233217.9477885, "path": "tool:lint_file", "phase": "recovery", "prev_digest": "8be94b51c2df782f24645930b8dfbb35585560a2da00bdd175900456a7842581", "receipt_id": "LP-1792233217-c32a6139", "recovery_of": "LP-1792233217-9a26297d", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_pass"}
+{"digest": "dc06417da9ea0c3d55014d9989deaf698a6bec8a4907db23ee7fae781137d38f", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792234271.6153092, "error_class": null, "input_digest": "2a7a6a240931ee72ca2019216925dacd7aba19b13999a3fb7ceb236d7a0288a7", "output_digest": "9ac538a32cfeadb31fccf607fac77e1f8a64b2053a6083c94cabc4a7c835c8f0", "started_at": 1792234271.6153085}, "kind": "tool", "observed_at": 1792234271.6153266, "path": "tool:lint_file", "phase": "auth_check", "prev_digest": "08c9558952fc2be0ab5cd37939d31b3b0d90370ed2d184c0f0891715d29925a5", "receipt_id": "LP-1792234271-e0ababcd", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "6ffed698068fa5738f6c1139fc8f6cd34853783d0b540791a40d1af4ae34c128", "evidence": {"detail": "minimal call succeeded", "ended_at": 1792234271.6154006, "error_class": null, "input_digest": "cd2bb73a5642aadf8695d8127b90b452514ce85166ab6b49b18d904eedc678cb", "output_digest": "be244c27ed1fc6de75e4aff5cc21ec8e59617b9bfabc778bf55d1d5834c94a22", "started_at": 1792234271.6153276}, "kind": "tool", "observed_at": 1792234271.615408, "path": "tool:lint_file", "phase": "minimal_call", "prev_digest": "dc06417da9ea0c3d55014d9989deaf698a6bec8a4907db23ee7fae781137d38f", "receipt_id": "LP-1792234271-e366c8c1", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_pass"}
+{"digest": "4a1669efd3d9eaf14c8b2f6d4646348e9324f86b620eb3c319b2c72fecba0680", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792234271.6154346, "error_class": null, "injected_fault": "nonexistent path", "input_digest": "25ba8e3e86e54b7b999f22e50ae9aff41264c8bacefdf7c76132c9e3f5961233", "output_digest": "12ce9c293d4b3616c57584df85827ffacb72e660f76329c9ca01b4fa1367ac13", "started_at": 1792234271.6154084}, "kind": "tool", "observed_at": 1792234271.6154406, "path": "tool:lint_file", "phase": "failure_injection", "prev_digest": "6ffed698068fa5738f6c1139fc8f6cd34853783d0b540791a40d1af4ae34c128", "receipt_id": "LP-1792234271-af2ad360", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_fail"}
+{"digest": "eaf5b688c55ab6d59f12cc00815172119c26cbd5ea6718908c94c36a6361aa5d", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792234271.6154745, "error_class": null, "input_digest": "bbb6def7000c7b95ae376d280dee9b494d20d8454507e06fe1ee032a0a4b043c", "output_digest": "0759c6c15d35bd61e08ac0a7d39b1b6ec3a73f97833c9df5a3719b77d99e2724", "started_at": 1792234271.6154413}, "kind": "tool", "observed_at": 1792234271.6154797, "path": "tool:lint_file", "phase": "recovery", "prev_digest": "4a1669efd3d9eaf14c8b2f6d4646348e9324f86b620eb3c319b2c72fecba0680", "receipt_id": "LP-1792234271-81f9c76e", "recovery_of": "LP-1792234271-af2ad360", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_pass"}

backups/live_proof-1792234962/receipts/tool__list_directory.jsonl

@@ -0,0 +1,8 @@
+{"digest": "d9497847d182ef807a08f07cb77f9d42a944078a6508ba17c31bf5b5d02325fd", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792233217.945382, "error_class": null, "input_digest": "6b43b15af0cf7752e9d7b09cdfda13394b3924e0de444c974d41f231c5f87949", "output_digest": "5d0063be61f65f0be8a3c826ceac4e098df8ec4073548014daf44f35f51db240", "started_at": 1792233217.9453716}, "kind": "tool", "observed_at": 1792233217.9453971, "path": "tool:list_directory", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233217-526a0323", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_pass"}
+{"digest": "814476b9aa9484cb454b0462759e3562d39b249d3dfa3e94f72ec1f83c40a637", "evidence": {"detail": "list the sandbox dir", "ended_at": 1792233217.9459317, "error_class": null, "input_digest": "069c96bebeda6a94a8450734520baed25f361ac03be840a618c92cdccbf98fb1", "output_digest": "37723842890f20e43139e729d4cb590dc9ab669def037f0b6a47ff5be6cf91d7", "started_at": 1792233217.945398}, "kind": "tool", "observed_at": 1792233217.9459438, "path": "tool:list_directory", "phase": "minimal_call", "prev_digest": "d9497847d182ef807a08f07cb77f9d42a944078a6508ba17c31bf5b5d02325fd", "receipt_id": "LP-1792233217-f2cd7745", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_pass"}
+{"digest": "287c86755f51c12031f996764833c910751be53d4aaf5c0891431ed5b44bef59", "evidence": {"detail": "injected fault observed failing and classified: Not a directory: /mnt/workdrive/rune/src/rune/../../store/live_proof/sandbox/__nonexistent_live_probe__", "ended_at": 1792233217.946346, "error_class": "TOOL_ERROR", "injected_fault": "list a nonexistent directory", "input_digest": "d2acd6694e44cd5249e24056e61bff8f34e21df7da36ba9e5db167a0ef30a738", "output_digest": "9a6c6b202fbe01d68c18c6337da46b208027b22685a18f0cc19bba9955346459", "started_at": 1792233217.9459445}, "kind": "tool", "observed_at": 1792233217.9463575, "path": "tool:list_directory", "phase": "failure_injection", "prev_digest": "814476b9aa9484cb454b0462759e3562d39b249d3dfa3e94f72ec1f83c40a637", "receipt_id": "LP-1792233217-19ef3a90", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_pass"}
+{"digest": "42ca5d5d7c1c3b39a43a2d09446974c20b9ab270fbacb2afdf89baed672c8979", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792233217.946841, "error_class": null, "input_digest": "510530798b535e832107ea806313e310d006b2cf4cd15a6a1dd8b9a867f429b5", "output_digest": "fda58a44dfacac350af8b90e4aba3762ab2762b218e12d6c674fa918841b89f9", "started_at": 1792233217.9463582}, "kind": "tool", "observed_at": 1792233217.9468517, "path": "tool:list_directory", "phase": "recovery", "prev_digest": "287c86755f51c12031f996764833c910751be53d4aaf5c0891431ed5b44bef59", "receipt_id": "LP-1792233217-ad76728f", "recovery_of": "LP-1792233217-19ef3a90", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_pass"}
+{"digest": "178061e34dbc7a820ba66b79872cc326388c9a9fc2ac117cf212705111a6dde1", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792234271.6131546, "error_class": null, "input_digest": "6b43b15af0cf7752e9d7b09cdfda13394b3924e0de444c974d41f231c5f87949", "output_digest": "5d0063be61f65f0be8a3c826ceac4e098df8ec4073548014daf44f35f51db240", "started_at": 1792234271.6131535}, "kind": "tool", "observed_at": 1792234271.6131732, "path": "tool:list_directory", "phase": "auth_check", "prev_digest": "42ca5d5d7c1c3b39a43a2d09446974c20b9ab270fbacb2afdf89baed672c8979", "receipt_id": "LP-1792234271-8361335e", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "acf1b8110dd09b77a0d9a26acf42aaa6f5bc741f91bb74c727d5d8aec3591571", "evidence": {"detail": "list the sandbox dir", "ended_at": 1792234271.6137004, "error_class": null, "input_digest": "069c96bebeda6a94a8450734520baed25f361ac03be840a618c92cdccbf98fb1", "output_digest": "37723842890f20e43139e729d4cb590dc9ab669def037f0b6a47ff5be6cf91d7", "started_at": 1792234271.613174}, "kind": "tool", "observed_at": 1792234271.613712, "path": "tool:list_directory", "phase": "minimal_call", "prev_digest": "178061e34dbc7a820ba66b79872cc326388c9a9fc2ac117cf212705111a6dde1", "receipt_id": "LP-1792234271-88b46077", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_pass"}
+{"digest": "54eb3e43620219f316cf9fb4c0c90215bfb1a094822fcc65bc722c8cab1d7a03", "evidence": {"detail": "injected fault observed failing and classified: Not a directory: /mnt/workdrive/rune/src/rune/../../store/live_proof/sandbox/__nonexistent_live_probe__", "ended_at": 1792234271.613998, "error_class": "TOOL_ERROR", "injected_fault": "list a nonexistent directory", "input_digest": "d2acd6694e44cd5249e24056e61bff8f34e21df7da36ba9e5db167a0ef30a738", "output_digest": "9a6c6b202fbe01d68c18c6337da46b208027b22685a18f0cc19bba9955346459", "started_at": 1792234271.6137133}, "kind": "tool", "observed_at": 1792234271.6140075, "path": "tool:list_directory", "phase": "failure_injection", "prev_digest": "acf1b8110dd09b77a0d9a26acf42aaa6f5bc741f91bb74c727d5d8aec3591571", "receipt_id": "LP-1792234271-1eda394f", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_pass"}
+{"digest": "6b0642dd345c7c6ca3b0a50537e2cc384ea935caed9a2894539bd52bcf02cc66", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792234271.614471, "error_class": null, "input_digest": "510530798b535e832107ea806313e310d006b2cf4cd15a6a1dd8b9a867f429b5", "output_digest": "fda58a44dfacac350af8b90e4aba3762ab2762b218e12d6c674fa918841b89f9", "started_at": 1792234271.6140084}, "kind": "tool", "observed_at": 1792234271.6144807, "path": "tool:list_directory", "phase": "recovery", "prev_digest": "54eb3e43620219f316cf9fb4c0c90215bfb1a094822fcc65bc722c8cab1d7a03", "receipt_id": "LP-1792234271-f869ded9", "recovery_of": "LP-1792234271-1eda394f", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_pass"}

backups/live_proof-1792234962/receipts/tool__query_memory.jsonl

@@ -0,0 +1,8 @@
+{"digest": "e1546212062113737150a2d8e8852511045035c7bb990765d00b11cbb29ba661", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792233218.1561284, "error_class": null, "input_digest": "7184223d0e85584065aa1e316ae04503b7227a78a56625b0de7ceacb33513640", "output_digest": "8e81da77c496577d7ed96e801feae19296d1c383fa83001c1bbef0215b174bfa", "started_at": 1792233218.1561275}, "kind": "tool", "observed_at": 1792233218.1561394, "path": "tool:query_memory", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233218-5ec1cdcd", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_pass"}
+{"digest": "3058f116ebf9f8d0d03af4d0307463879b8d551dd61906c1d54201a294d948ed", "evidence": {"detail": "query memory with a one-word probe", "ended_at": 1792233218.1939867, "error_class": null, "input_digest": "dba8f2f072b60651103cddc3c6b9b13ce984d482fc5f91f2b6016878ccd76ca2", "output_digest": "433f4446dd6c9b8f3acba08497aa2ae5ed77e13c75a7e27b075f011f88cd49fe", "started_at": 1792233218.1561399}, "kind": "tool", "observed_at": 1792233218.1940286, "path": "tool:query_memory", "phase": "minimal_call", "prev_digest": "e1546212062113737150a2d8e8852511045035c7bb990765d00b11cbb29ba661", "receipt_id": "LP-1792233218-2cf0bbce", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_pass"}
+{"digest": "7bc2aea79d09ccac5ba9164352a83da6d2e3552a6216333bbaec291af0cd3a87", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792233218.9414935, "error_class": null, "injected_fault": "query with a malformed memory id", "input_digest": "0abab62acdd7e5a1fa6ed4ee65f14d4dab244cd03b4b785e4bc37beea2b4e1f8", "output_digest": "1ab58f149ee2d6fc8db4383bf560006c78a079e87f6f4cbd1b9b7bac23349eba", "started_at": 1792233218.1940296}, "kind": "tool", "observed_at": 1792233218.9415393, "path": "tool:query_memory", "phase": "failure_injection", "prev_digest": "3058f116ebf9f8d0d03af4d0307463879b8d551dd61906c1d54201a294d948ed", "receipt_id": "LP-1792233218-39063f62", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_fail"}
+{"digest": "024de5cc2f0059119d414e1b3de95f4c5c3d06ed25fdc49471dbb455d2296ccd", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792233218.9697337, "error_class": null, "input_digest": "f5bb307b8741b29f2a147f7687528e86b5c8b1c68b4ab90edcb89f8c93791378", "output_digest": "89cc3d6753f1bafe5a328c418b68a09234124112404eda5b7038f26585e5c918", "started_at": 1792233218.9415414}, "kind": "tool", "observed_at": 1792233218.96978, "path": "tool:query_memory", "phase": "recovery", "prev_digest": "7bc2aea79d09ccac5ba9164352a83da6d2e3552a6216333bbaec291af0cd3a87", "receipt_id": "LP-1792233218-8c887c60", "recovery_of": "LP-1792233218-39063f62", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_pass"}
+{"digest": "09074137a383f23c11060a8319275f3741008f656dd1ec7728577da4298aa8a2", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792234271.9486344, "error_class": null, "input_digest": "7184223d0e85584065aa1e316ae04503b7227a78a56625b0de7ceacb33513640", "output_digest": "8e81da77c496577d7ed96e801feae19296d1c383fa83001c1bbef0215b174bfa", "started_at": 1792234271.9486327}, "kind": "tool", "observed_at": 1792234271.948659, "path": "tool:query_memory", "phase": "auth_check", "prev_digest": "024de5cc2f0059119d414e1b3de95f4c5c3d06ed25fdc49471dbb455d2296ccd", "receipt_id": "LP-1792234271-45f51270", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "f231135825e9b7d26511b6fa42fe4f87b9389cc7cfe88bb1cf3082530633b692", "evidence": {"detail": "query memory with a one-word probe", "ended_at": 1792234271.9836683, "error_class": null, "input_digest": "dba8f2f072b60651103cddc3c6b9b13ce984d482fc5f91f2b6016878ccd76ca2", "output_digest": "433f4446dd6c9b8f3acba08497aa2ae5ed77e13c75a7e27b075f011f88cd49fe", "started_at": 1792234271.94866}, "kind": "tool", "observed_at": 1792234271.9837193, "path": "tool:query_memory", "phase": "minimal_call", "prev_digest": "09074137a383f23c11060a8319275f3741008f656dd1ec7728577da4298aa8a2", "receipt_id": "LP-1792234271-aea4fa54", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_pass"}
+{"digest": "e88035d996ccc7f505c5e973081d87bc9029775a338758b57f4ec8bf0e55f470", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792234272.8042405, "error_class": null, "injected_fault": "query with a malformed memory id", "input_digest": "0abab62acdd7e5a1fa6ed4ee65f14d4dab244cd03b4b785e4bc37beea2b4e1f8", "output_digest": "1ab58f149ee2d6fc8db4383bf560006c78a079e87f6f4cbd1b9b7bac23349eba", "started_at": 1792234271.983721}, "kind": "tool", "observed_at": 1792234272.804284, "path": "tool:query_memory", "phase": "failure_injection", "prev_digest": "f231135825e9b7d26511b6fa42fe4f87b9389cc7cfe88bb1cf3082530633b692", "receipt_id": "LP-1792234272-dbe5cc7e", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_fail"}
+{"digest": "a5186c7bb3d92bc00eef5defc97e0c15a532a417f2867383ad2079c05c302c7a", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792234272.8316886, "error_class": null, "input_digest": "f5bb307b8741b29f2a147f7687528e86b5c8b1c68b4ab90edcb89f8c93791378", "output_digest": "89cc3d6753f1bafe5a328c418b68a09234124112404eda5b7038f26585e5c918", "started_at": 1792234272.8042862}, "kind": "tool", "observed_at": 1792234272.831737, "path": "tool:query_memory", "phase": "recovery", "prev_digest": "e88035d996ccc7f505c5e973081d87bc9029775a338758b57f4ec8bf0e55f470", "receipt_id": "LP-1792234272-4c6c08a4", "recovery_of": "LP-1792234272-dbe5cc7e", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_pass"}

backups/live_proof-1792234962/receipts/tool__read_file.jsonl

@@ -0,0 +1,8 @@
+{"digest": "5d2a31a0fdc40a369767cd241ac85b65562a894ae19f58d473b815674a595186", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792233217.9234314, "error_class": null, "input_digest": "3188fbe61785a2f896568b7efe73f3444a8db2041772fae33cc9be5b613b212d", "output_digest": "4696f13fd53c94d5147e2ecfd127d3b747a4f66d832c465e97eb1daa55b5ade2", "started_at": 1792233217.9234238}, "kind": "tool", "observed_at": 1792233217.9235158, "path": "tool:read_file", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233217-ddcfbfa3", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_pass"}
+{"digest": "043140ce10309c928e2d2454c4edf1bc2a26ce1effa7803e582a84c672590348", "evidence": {"detail": "read a one-line sandbox file", "ended_at": 1792233217.9241977, "error_class": null, "input_digest": "4db66f81ba9f66805811353291d68eb7e9b49ac52080ee4f2911da97e34ff822", "output_digest": "38a33175fcad1ad10820c264fdcd398795173a1d8ca9bce7cdf5d6ac42bc19fc", "started_at": 1792233217.923518}, "kind": "tool", "observed_at": 1792233217.9242291, "path": "tool:read_file", "phase": "minimal_call", "prev_digest": "5d2a31a0fdc40a369767cd241ac85b65562a894ae19f58d473b815674a595186", "receipt_id": "LP-1792233217-1e5aa0c2", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_pass"}
+{"digest": "fa601aac0481024ccc835c20be366c3d880edee5220c70e0c627ba4bb0bfe2b2", "evidence": {"detail": "injected fault observed failing and classified: Not found: /mnt/workdrive/rune/src/rune/../../store/live_proof/sandbox/__nonexistent_live_probe__", "ended_at": 1792233217.924617, "error_class": "ENOENT", "injected_fault": "read a nonexistent path", "input_digest": "f57b736271e86fa2ba87134bc3d1fe285bdc4e8c9ea3433b7b5d66aca532190b", "output_digest": "dac1b171dad67eefb479bcaae54c15be34484711044bafb645d4e6d735de94fd", "started_at": 1792233217.924231}, "kind": "tool", "observed_at": 1792233217.924639, "path": "tool:read_file", "phase": "failure_injection", "prev_digest": "043140ce10309c928e2d2454c4edf1bc2a26ce1effa7803e582a84c672590348", "receipt_id": "LP-1792233217-1122adad", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_pass"}
+{"digest": "fa3c1d0ad516651d8bf87326d0ac899b3dd5273ea0629d7347f2a785fc03b72b", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792233217.9250536, "error_class": null, "input_digest": "a846ca5a3235abce5db143b6194fe7f4e3516ff944913e3baff2d3cb4afe0c0c", "output_digest": "226cee6011cf22d0539ef2898e20d0996473d0286e743a2261f69421241086e0", "started_at": 1792233217.9246402}, "kind": "tool", "observed_at": 1792233217.9250731, "path": "tool:read_file", "phase": "recovery", "prev_digest": "fa601aac0481024ccc835c20be366c3d880edee5220c70e0c627ba4bb0bfe2b2", "receipt_id": "LP-1792233217-0472d94c", "recovery_of": "LP-1792233217-1122adad", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_pass"}
+{"digest": "34dd25b559e0f7bf4d15d00890732fb82c21accad42fc1cfd7f70f8e547405ee", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792234271.5884204, "error_class": null, "input_digest": "3188fbe61785a2f896568b7efe73f3444a8db2041772fae33cc9be5b613b212d", "output_digest": "4696f13fd53c94d5147e2ecfd127d3b747a4f66d832c465e97eb1daa55b5ade2", "started_at": 1792234271.5884168}, "kind": "tool", "observed_at": 1792234271.5884645, "path": "tool:read_file", "phase": "auth_check", "prev_digest": "fa3c1d0ad516651d8bf87326d0ac899b3dd5273ea0629d7347f2a785fc03b72b", "receipt_id": "LP-1792234271-d18c0c2e", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "ec7e32b8f1f24f37dd50358f36afc4008505cd7ae3e5e730807ca5e77f6ad114", "evidence": {"detail": "read a one-line sandbox file", "ended_at": 1792234271.5888975, "error_class": null, "input_digest": "4db66f81ba9f66805811353291d68eb7e9b49ac52080ee4f2911da97e34ff822", "output_digest": "38a33175fcad1ad10820c264fdcd398795173a1d8ca9bce7cdf5d6ac42bc19fc", "started_at": 1792234271.5884662}, "kind": "tool", "observed_at": 1792234271.5889146, "path": "tool:read_file", "phase": "minimal_call", "prev_digest": "34dd25b559e0f7bf4d15d00890732fb82c21accad42fc1cfd7f70f8e547405ee", "receipt_id": "LP-1792234271-6b614f33", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_pass"}
+{"digest": "469b342f48685df796c4137983287765d353f08e396e86eb66cd7ea15cc1fd91", "evidence": {"detail": "injected fault observed failing and classified: Not found: /mnt/workdrive/rune/src/rune/../../store/live_proof/sandbox/__nonexistent_live_probe__", "ended_at": 1792234271.5892375, "error_class": "ENOENT", "injected_fault": "read a nonexistent path", "input_digest": "f57b736271e86fa2ba87134bc3d1fe285bdc4e8c9ea3433b7b5d66aca532190b", "output_digest": "dac1b171dad67eefb479bcaae54c15be34484711044bafb645d4e6d735de94fd", "started_at": 1792234271.5889158}, "kind": "tool", "observed_at": 1792234271.589255, "path": "tool:read_file", "phase": "failure_injection", "prev_digest": "ec7e32b8f1f24f37dd50358f36afc4008505cd7ae3e5e730807ca5e77f6ad114", "receipt_id": "LP-1792234271-4f8611af", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_pass"}
+{"digest": "934fcf6d1aec1798e1a6056c732f12532f713e80065ff9fb03ec65a675fa7fbd", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792234271.5896084, "error_class": null, "input_digest": "a846ca5a3235abce5db143b6194fe7f4e3516ff944913e3baff2d3cb4afe0c0c", "output_digest": "226cee6011cf22d0539ef2898e20d0996473d0286e743a2261f69421241086e0", "started_at": 1792234271.589257}, "kind": "tool", "observed_at": 1792234271.589622, "path": "tool:read_file", "phase": "recovery", "prev_digest": "469b342f48685df796c4137983287765d353f08e396e86eb66cd7ea15cc1fd91", "receipt_id": "LP-1792234271-5d313ee4", "recovery_of": "LP-1792234271-4f8611af", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_pass"}

backups/live_proof-1792234962/receipts/tool__read_persona.jsonl

@@ -0,0 +1,8 @@
+{"digest": "af62001cbd78dbdead0c45c494dc4b41abbdd25f58269840eff9f461cdbfeb92", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792233218.1550496, "error_class": null, "input_digest": "063e2e0777ec5122374f5a665a0eb89601044d75481bf080c15528f2a03d31ff", "output_digest": "cb23a951feb41b1f5f7b2a4ee5787515cff14225aebada207840410b28b9d89a", "started_at": 1792233218.1550484}, "kind": "tool", "observed_at": 1792233218.155064, "path": "tool:read_persona", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233218-e7251b1d", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_pass"}
+{"digest": "791b65eb10cfa1715e35f207d647c7bd5b3b26f5aa5c65ab2106855da75b277f", "evidence": {"detail": "minimal call failed: Persona block not found in MEMORY.md", "ended_at": 1792233218.1552446, "error_class": "TOOL_ERROR", "input_digest": "29b57b3ba9cb4bc9534b16e7502e076401070bcf5f46d4f2996f1a3f58544a22", "output_digest": "bfc3d287e7db7de512d16e29c879ee3c06336db47b387d214906bff469deb3a7", "started_at": 1792233218.1550646}, "kind": "tool", "observed_at": 1792233218.1552546, "path": "tool:read_persona", "phase": "minimal_call", "prev_digest": "af62001cbd78dbdead0c45c494dc4b41abbdd25f58269840eff9f461cdbfeb92", "receipt_id": "LP-1792233218-2fb88146", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_fail"}
+{"digest": "c3270bb06ff00054a0638e722bff10e7d0146aa07d29ad6b47c54ce433b529a1", "evidence": {"detail": "injected fault observed failing and classified: Persona block not found in MEMORY.md", "ended_at": 1792233218.1553478, "error_class": "ENOENT", "injected_fault": "read with a poisoned persona id", "input_digest": "320c851fa76bd033c2762d99997e960c473d847102861b0607fe20dcedb4a4cf", "output_digest": "04a15611da0c41d536ad2f60cec590b47cefde420c57ef5a0b1320b456259f07", "started_at": 1792233218.155255}, "kind": "tool", "observed_at": 1792233218.1553597, "path": "tool:read_persona", "phase": "failure_injection", "prev_digest": "791b65eb10cfa1715e35f207d647c7bd5b3b26f5aa5c65ab2106855da75b277f", "receipt_id": "LP-1792233218-58d29ebd", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_pass"}
+{"digest": "b7c3d02a1aafe144b876fa713529b540dc06399f44fa60fdedefb3f38336f656", "evidence": {"detail": "recovery call failed: Persona block not found in MEMORY.md", "ended_at": 1792233218.1554778, "error_class": "TOOL_ERROR", "input_digest": "b32802c62eebca15317113d7e4455508c074d6b39ca1220681f186cc85ba0e92", "output_digest": "5af50857ea4c4a151574c3f98294fcf212543c665505234ad639ee6db240e0e5", "started_at": 1792233218.1553605}, "kind": "tool", "observed_at": 1792233218.1554883, "path": "tool:read_persona", "phase": "recovery", "prev_digest": "c3270bb06ff00054a0638e722bff10e7d0146aa07d29ad6b47c54ce433b529a1", "receipt_id": "LP-1792233218-2cbaff76", "recovery_of": "LP-1792233218-58d29ebd", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_fail"}
+{"digest": "52676b47b7b64b7eafeb1ab21acd7b786675b8ee3f0466d27c30bdb9c1216676", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792234271.947291, "error_class": null, "input_digest": "063e2e0777ec5122374f5a665a0eb89601044d75481bf080c15528f2a03d31ff", "output_digest": "cb23a951feb41b1f5f7b2a4ee5787515cff14225aebada207840410b28b9d89a", "started_at": 1792234271.9472888}, "kind": "tool", "observed_at": 1792234271.9473097, "path": "tool:read_persona", "phase": "auth_check", "prev_digest": "b7c3d02a1aafe144b876fa713529b540dc06399f44fa60fdedefb3f38336f656", "receipt_id": "LP-1792234271-92ff456d", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "ec59b876a8744730382f969091ac6476b352c6ca13f3f3b4fb61d948dc049a48", "evidence": {"detail": "minimal call failed: Persona block not found in MEMORY.md", "ended_at": 1792234271.947483, "error_class": "TOOL_ERROR", "input_digest": "29b57b3ba9cb4bc9534b16e7502e076401070bcf5f46d4f2996f1a3f58544a22", "output_digest": "bfc3d287e7db7de512d16e29c879ee3c06336db47b387d214906bff469deb3a7", "started_at": 1792234271.9473107}, "kind": "tool", "observed_at": 1792234271.9474926, "path": "tool:read_persona", "phase": "minimal_call", "prev_digest": "52676b47b7b64b7eafeb1ab21acd7b786675b8ee3f0466d27c30bdb9c1216676", "receipt_id": "LP-1792234271-5f7c6e26", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_fail"}
+{"digest": "789e81a4b786da6e8796540641546c89f4d4d5e0749816e02a9856a3c8de11cd", "evidence": {"detail": "injected fault observed failing and classified: Persona block not found in MEMORY.md", "ended_at": 1792234271.9475667, "error_class": "ENOENT", "injected_fault": "read with a poisoned persona id", "input_digest": "320c851fa76bd033c2762d99997e960c473d847102861b0607fe20dcedb4a4cf", "output_digest": "04a15611da0c41d536ad2f60cec590b47cefde420c57ef5a0b1320b456259f07", "started_at": 1792234271.9474933}, "kind": "tool", "observed_at": 1792234271.947576, "path": "tool:read_persona", "phase": "failure_injection", "prev_digest": "ec59b876a8744730382f969091ac6476b352c6ca13f3f3b4fb61d948dc049a48", "receipt_id": "LP-1792234271-0c70b7f4", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_pass"}
+{"digest": "d30dd719ff7ebec8e501b97b1b92e3ef4561ec6b5b0d1da1ad1d9c8600129816", "evidence": {"detail": "recovery call failed: Persona block not found in MEMORY.md", "ended_at": 1792234271.9476554, "error_class": "TOOL_ERROR", "input_digest": "b32802c62eebca15317113d7e4455508c074d6b39ca1220681f186cc85ba0e92", "output_digest": "5af50857ea4c4a151574c3f98294fcf212543c665505234ad639ee6db240e0e5", "started_at": 1792234271.9475768}, "kind": "tool", "observed_at": 1792234271.9476628, "path": "tool:read_persona", "phase": "recovery", "prev_digest": "789e81a4b786da6e8796540641546c89f4d4d5e0749816e02a9856a3c8de11cd", "receipt_id": "LP-1792234271-f4722ff8", "recovery_of": "LP-1792234271-0c70b7f4", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_fail"}

backups/live_proof-1792234962/receipts/tool__repo_map.jsonl

@@ -0,0 +1,8 @@
+{"digest": "26d6082067f78673af235c477e165e7428c1abaed6c724aa9acb75dcf56bfdf1", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792233218.1275475, "error_class": null, "input_digest": "0790f22dd0ebca93ab4c0630d71f709a8b96b8983cf46dcf2c756f261ad78766", "output_digest": "a956aeb43b63c3181cab7b355029b25504be21b35790393d1254b3a22211aaec", "started_at": 1792233218.1275463}, "kind": "tool", "observed_at": 1792233218.1275628, "path": "tool:repo_map", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233218-35ab6f26", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_pass"}
+{"digest": "57cb11cfbbc2c006dcaef2f5f2f1fdb568bb455058350053a805a1b5b7decc82", "evidence": {"detail": "repo map over the sandbox dir", "ended_at": 1792233218.1394017, "error_class": null, "input_digest": "9782f79dae45c6429d29752ae557543830346f589ab017d7268f2e2137784fba", "output_digest": "4b122ae6968f0a5738b15bd60c0e528f68507c08f94bdc9936c67cc25f3d9be6", "started_at": 1792233218.1275637}, "kind": "tool", "observed_at": 1792233218.13945, "path": "tool:repo_map", "phase": "minimal_call", "prev_digest": "26d6082067f78673af235c477e165e7428c1abaed6c724aa9acb75dcf56bfdf1", "receipt_id": "LP-1792233218-e1dd9f1d", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_pass"}
+{"digest": "0a65dce068fc4d401e8da2d188e78527e630f8528f5d9214732a1586b44569ce", "evidence": {"detail": "injected fault observed failing and classified: Access denied: /etc/__live_proof_probe__", "ended_at": 1792233218.1397295, "error_class": "PERMISSION", "injected_fault": "map a denied (blocked) path", "input_digest": "da7f98628de3675f20fa30e701640d560b051636b779ab363ec14b605d9eaa2d", "output_digest": "2a693e44c88ccbf8c06d8ae95445f3b47e76165a8880d77fc29c817ba88ad4e0", "started_at": 1792233218.1394515}, "kind": "tool", "observed_at": 1792233218.139758, "path": "tool:repo_map", "phase": "failure_injection", "prev_digest": "57cb11cfbbc2c006dcaef2f5f2f1fdb568bb455058350053a805a1b5b7decc82", "receipt_id": "LP-1792233218-1ef149da", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_pass"}
+{"digest": "0adbb9e06ad052a740f8c9c888590f7627f5e9500c67d2570f0ddee5d5e81af5", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792233218.1519997, "error_class": null, "input_digest": "643bf7bee5ea37f7913c9e00b0586dad9b347b11bda8ae5fc956d8352a2d66d9", "output_digest": "0d608c628fa58c58d9ffafe6fdb3563d852191b07d0d7f8549747bfdc8328cf2", "started_at": 1792233218.139759}, "kind": "tool", "observed_at": 1792233218.152042, "path": "tool:repo_map", "phase": "recovery", "prev_digest": "0a65dce068fc4d401e8da2d188e78527e630f8528f5d9214732a1586b44569ce", "receipt_id": "LP-1792233218-8d68fd76", "recovery_of": "LP-1792233218-1ef149da", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_pass"}
+{"digest": "f988d74fddfc00914cb1cd0aa4baaffe6b4dbb00f1f259f2a3556ed43ecd38d0", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792234271.916472, "error_class": null, "input_digest": "0790f22dd0ebca93ab4c0630d71f709a8b96b8983cf46dcf2c756f261ad78766", "output_digest": "a956aeb43b63c3181cab7b355029b25504be21b35790393d1254b3a22211aaec", "started_at": 1792234271.9164703}, "kind": "tool", "observed_at": 1792234271.916494, "path": "tool:repo_map", "phase": "auth_check", "prev_digest": "0adbb9e06ad052a740f8c9c888590f7627f5e9500c67d2570f0ddee5d5e81af5", "receipt_id": "LP-1792234271-0ed6a366", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "a967246c3250c7c21a2fa132d0c2302d18900e91efe62f48cdae0b7e22703276", "evidence": {"detail": "repo map over the sandbox dir", "ended_at": 1792234271.9286356, "error_class": null, "input_digest": "9782f79dae45c6429d29752ae557543830346f589ab017d7268f2e2137784fba", "output_digest": "4b122ae6968f0a5738b15bd60c0e528f68507c08f94bdc9936c67cc25f3d9be6", "started_at": 1792234271.9164946}, "kind": "tool", "observed_at": 1792234271.9286685, "path": "tool:repo_map", "phase": "minimal_call", "prev_digest": "f988d74fddfc00914cb1cd0aa4baaffe6b4dbb00f1f259f2a3556ed43ecd38d0", "receipt_id": "LP-1792234271-871ed83d", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_pass"}
+{"digest": "04115700625c1803b008dbdc516e880b09bbea0f8dab97991c45861269b9d59d", "evidence": {"detail": "injected fault observed failing and classified: Access denied: /etc/__live_proof_probe__", "ended_at": 1792234271.9288743, "error_class": "PERMISSION", "injected_fault": "map a denied (blocked) path", "input_digest": "da7f98628de3675f20fa30e701640d560b051636b779ab363ec14b605d9eaa2d", "output_digest": "2a693e44c88ccbf8c06d8ae95445f3b47e76165a8880d77fc29c817ba88ad4e0", "started_at": 1792234271.9286697}, "kind": "tool", "observed_at": 1792234271.9288864, "path": "tool:repo_map", "phase": "failure_injection", "prev_digest": "a967246c3250c7c21a2fa132d0c2302d18900e91efe62f48cdae0b7e22703276", "receipt_id": "LP-1792234271-f4ec6daf", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_pass"}
+{"digest": "07334b7a23e20759ee483d72d463e9ecc115f3d78b6df2b9b2750fbff2061e2a", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792234271.9392335, "error_class": null, "input_digest": "643bf7bee5ea37f7913c9e00b0586dad9b347b11bda8ae5fc956d8352a2d66d9", "output_digest": "0d608c628fa58c58d9ffafe6fdb3563d852191b07d0d7f8549747bfdc8328cf2", "started_at": 1792234271.9288874}, "kind": "tool", "observed_at": 1792234271.939266, "path": "tool:repo_map", "phase": "recovery", "prev_digest": "04115700625c1803b008dbdc516e880b09bbea0f8dab97991c45861269b9d59d", "receipt_id": "LP-1792234271-04134317", "recovery_of": "LP-1792234271-f4ec6daf", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_pass"}

backups/live_proof-1792234962/receipts/tool__run_command.jsonl

@@ -0,0 +1,8 @@
+{"digest": "366b191bbb9012a3f75e61df158542e74fa9857a447760140a9cbeba5ae65d50", "evidence": {"detail": "approval gate observed: prepared + approved (single-use token, success=True)", "ended_at": 1792233218.1540852, "error_class": null, "input_digest": "49d90e0983e294ccd1ea057bbb893b23182a927655f52fddb4f5e77f588a253b", "output_digest": "4b3d8628e3c7bc148cc79bf39a99261673d100d8db6da6e863503cb31a21174c", "started_at": 1792233218.1531603}, "kind": "tool", "observed_at": 1792233218.154104, "path": "tool:run_command", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233218-f072dc9f", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_pass"}
+{"digest": "2debd2be91de4fb8f60ccf35d198ac04d5bcfeb8c4996cedde46b2e82031537c", "evidence": {"detail": "run 'true' in the sandbox", "ended_at": 1792233218.154187, "error_class": null, "input_digest": "1ffa77546d1f6a6536cf4c4522f467457980bfc5715ab515b3700ec46a5371b1", "output_digest": "465a4ff846b0a5e119a24b345ddb2e4ff2252074fbeea6c90980f38d54f24999", "started_at": 1792233218.154105}, "kind": "tool", "observed_at": 1792233218.1541965, "path": "tool:run_command", "phase": "minimal_call", "prev_digest": "366b191bbb9012a3f75e61df158542e74fa9857a447760140a9cbeba5ae65d50", "receipt_id": "LP-1792233218-124349ac", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_pass"}
+{"digest": "7b07c348481bab6e2dd288025f9c82c130b0f7ff01e4a96a3a99e4ae22c08c02", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792233218.1542382, "error_class": null, "injected_fault": "run a command that cannot exist", "input_digest": "2544c53dc35795034c22bd7a85354d66811e4f13d114754a6bf289298af409e2", "output_digest": "cfe82ec11b5df99c24a72c1052f35e87c2dd8e22f62c3c4786a4044c1b6ee543", "started_at": 1792233218.154197}, "kind": "tool", "observed_at": 1792233218.1542466, "path": "tool:run_command", "phase": "failure_injection", "prev_digest": "2debd2be91de4fb8f60ccf35d198ac04d5bcfeb8c4996cedde46b2e82031537c", "receipt_id": "LP-1792233218-1e5d0fb0", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_fail"}
+{"digest": "a6e36897d6b34bf7b2a30bc89343bd874dc2f3a023031508f888aab7bf792113", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792233218.1543016, "error_class": null, "input_digest": "83da34ae1e57418c63bf0e7576ce050d3545379af9e8abad5edc16d4d2ec9584", "output_digest": "7a7a73ad197502e120fc0797ad7a08c64d93cca2f4ab7b14873f1f48dcd8ead5", "started_at": 1792233218.1542478}, "kind": "tool", "observed_at": 1792233218.1543105, "path": "tool:run_command", "phase": "recovery", "prev_digest": "7b07c348481bab6e2dd288025f9c82c130b0f7ff01e4a96a3a99e4ae22c08c02", "receipt_id": "LP-1792233218-65a22f4e", "recovery_of": "LP-1792233218-1e5d0fb0", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_pass"}
+{"digest": "911f94ba9b0df859d07b341d1b78b76d8abe5845a879fa9b3b12daf796153c17", "evidence": {"detail": "approval gate observed: prepared + approved (single-use token, success=True)", "ended_at": 1792234271.9458697, "error_class": null, "input_digest": "49d90e0983e294ccd1ea057bbb893b23182a927655f52fddb4f5e77f588a253b", "output_digest": "4b3d8628e3c7bc148cc79bf39a99261673d100d8db6da6e863503cb31a21174c", "started_at": 1792234271.9405448}, "kind": "tool", "observed_at": 1792234271.9459004, "path": "tool:run_command", "phase": "auth_check", "prev_digest": "a6e36897d6b34bf7b2a30bc89343bd874dc2f3a023031508f888aab7bf792113", "receipt_id": "LP-1792234271-0db8e7cf", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "2c4769303e2aa75ebcf61e35596cfe1b9513233bdd27ee88760816f76f231b0e", "evidence": {"detail": "run 'true' in the sandbox", "ended_at": 1792234271.9460104, "error_class": null, "input_digest": "1ffa77546d1f6a6536cf4c4522f467457980bfc5715ab515b3700ec46a5371b1", "output_digest": "465a4ff846b0a5e119a24b345ddb2e4ff2252074fbeea6c90980f38d54f24999", "started_at": 1792234271.9459016}, "kind": "tool", "observed_at": 1792234271.9460177, "path": "tool:run_command", "phase": "minimal_call", "prev_digest": "911f94ba9b0df859d07b341d1b78b76d8abe5845a879fa9b3b12daf796153c17", "receipt_id": "LP-1792234271-8d1b2ed4", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_pass"}
+{"digest": "88e30f19ca966294831068c6db9b1beb51aa1046769cfe9b3224af3fb12c4cc5", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792234271.9460506, "error_class": null, "injected_fault": "run a command that cannot exist", "input_digest": "2544c53dc35795034c22bd7a85354d66811e4f13d114754a6bf289298af409e2", "output_digest": "cfe82ec11b5df99c24a72c1052f35e87c2dd8e22f62c3c4786a4044c1b6ee543", "started_at": 1792234271.9460185}, "kind": "tool", "observed_at": 1792234271.9460568, "path": "tool:run_command", "phase": "failure_injection", "prev_digest": "2c4769303e2aa75ebcf61e35596cfe1b9513233bdd27ee88760816f76f231b0e", "receipt_id": "LP-1792234271-b8c8b641", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_fail"}
+{"digest": "ba1743459fe7b789db766c67e4403827e0246c8ca70979a3867cfa6313b6363b", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792234271.9460995, "error_class": null, "input_digest": "83da34ae1e57418c63bf0e7576ce050d3545379af9e8abad5edc16d4d2ec9584", "output_digest": "7a7a73ad197502e120fc0797ad7a08c64d93cca2f4ab7b14873f1f48dcd8ead5", "started_at": 1792234271.9460578}, "kind": "tool", "observed_at": 1792234271.9461045, "path": "tool:run_command", "phase": "recovery", "prev_digest": "88e30f19ca966294831068c6db9b1beb51aa1046769cfe9b3224af3fb12c4cc5", "receipt_id": "LP-1792234271-6a73bbc5", "recovery_of": "LP-1792234271-b8c8b641", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_pass"}

backups/live_proof-1792234962/receipts/tool__run_tests.jsonl

@@ -0,0 +1,8 @@
+{"digest": "df588d3421befe71b5ac886f2824da33ca7d7426c9ee43b15a7afbcaa0af1bbe", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792233217.9484146, "error_class": null, "input_digest": "19d015afba2cbf1f7a51eaf490735460bd6a6c3ded7341b12ad3b94ede67c780", "output_digest": "303abb215d3f40512244dbd0c3b665e28c750c46816b1c650ec262abae82e78b", "started_at": 1792233217.9484136}, "kind": "tool", "observed_at": 1792233217.9484262, "path": "tool:run_tests", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233217-80631460", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_pass"}
+{"digest": "f846d6d1ef4d93782c8cc1ba181a24cb03885bc997e617f392f811657cbc1bb7", "evidence": {"detail": "minimal call succeeded", "ended_at": 1792233217.9484851, "error_class": null, "input_digest": "e323635b365eced17b9a4fcbe537afd4d3daaa7a4158a1af5e3284b7c61d917d", "output_digest": "17823a8d57195139f2cfa31e9d510b53580dec9541dd92ecf428d80b955a1147", "started_at": 1792233217.9484267}, "kind": "tool", "observed_at": 1792233217.9484928, "path": "tool:run_tests", "phase": "minimal_call", "prev_digest": "df588d3421befe71b5ac886f2824da33ca7d7426c9ee43b15a7afbcaa0af1bbe", "receipt_id": "LP-1792233217-9798c01c", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_pass"}
+{"digest": "f8d9478a060c37aafcab156ca9f2824cfae46fae79fad0292dd04a9dcaf3b8ff", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792233217.9485211, "error_class": null, "injected_fault": "nonexistent path", "input_digest": "ca6d6db9e9d29c7e583c2af686990d7fc2c80be0cceea54eb58f92fca48f0ff5", "output_digest": "0763ca1de8fe2e9a3935ad5ae0178c877390d8da684d25b0cedb3505ebdb0763", "started_at": 1792233217.9484932}, "kind": "tool", "observed_at": 1792233217.9485283, "path": "tool:run_tests", "phase": "failure_injection", "prev_digest": "f846d6d1ef4d93782c8cc1ba181a24cb03885bc997e617f392f811657cbc1bb7", "receipt_id": "LP-1792233217-dfeb507d", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_fail"}
+{"digest": "a352e274dd321ccc2be4221b12a2bbcf451d3df7f77612afc889be24cb6dfdf7", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792233217.948574, "error_class": null, "input_digest": "d7a369763d2def0be6bad748cb9522203f4886d454f04700e3d59044c00db31d", "output_digest": "c27aabb83792dee21c4f793c1fe885585000e813011582daec5e1a9c2a0ecd68", "started_at": 1792233217.9485292}, "kind": "tool", "observed_at": 1792233217.9485805, "path": "tool:run_tests", "phase": "recovery", "prev_digest": "f8d9478a060c37aafcab156ca9f2824cfae46fae79fad0292dd04a9dcaf3b8ff", "receipt_id": "LP-1792233217-6cf9cab8", "recovery_of": "LP-1792233217-dfeb507d", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_pass"}
+{"digest": "65d34ffc4ecff6aee19297c6f5598a7ea8efc7540c72dd0c904bcd44c79049dc", "evidence": {"detail": "read-only boundary observed: no approval required", "ended_at": 1792234271.6162615, "error_class": null, "input_digest": "19d015afba2cbf1f7a51eaf490735460bd6a6c3ded7341b12ad3b94ede67c780", "output_digest": "303abb215d3f40512244dbd0c3b665e28c750c46816b1c650ec262abae82e78b", "started_at": 1792234271.6162608}, "kind": "tool", "observed_at": 1792234271.616277, "path": "tool:run_tests", "phase": "auth_check", "prev_digest": "a352e274dd321ccc2be4221b12a2bbcf451d3df7f77612afc889be24cb6dfdf7", "receipt_id": "LP-1792234271-ded1602f", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "deb3e7cffc023331014a749817ef38a05cbdc7fbb5d136b7fb8a0c52ae9ff883", "evidence": {"detail": "minimal call succeeded", "ended_at": 1792234271.6163225, "error_class": null, "input_digest": "e323635b365eced17b9a4fcbe537afd4d3daaa7a4158a1af5e3284b7c61d917d", "output_digest": "17823a8d57195139f2cfa31e9d510b53580dec9541dd92ecf428d80b955a1147", "started_at": 1792234271.6162777}, "kind": "tool", "observed_at": 1792234271.6163285, "path": "tool:run_tests", "phase": "minimal_call", "prev_digest": "65d34ffc4ecff6aee19297c6f5598a7ea8efc7540c72dd0c904bcd44c79049dc", "receipt_id": "LP-1792234271-a7c02791", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_pass"}
+{"digest": "9cbf71ec9044f26587cef983b2bce9046e29d236107d371bd1b9ebf5d0bf255a", "evidence": {"detail": "injected fault did NOT produce a failure", "ended_at": 1792234271.616351, "error_class": null, "injected_fault": "nonexistent path", "input_digest": "ca6d6db9e9d29c7e583c2af686990d7fc2c80be0cceea54eb58f92fca48f0ff5", "output_digest": "0763ca1de8fe2e9a3935ad5ae0178c877390d8da684d25b0cedb3505ebdb0763", "started_at": 1792234271.616329}, "kind": "tool", "observed_at": 1792234271.6163566, "path": "tool:run_tests", "phase": "failure_injection", "prev_digest": "deb3e7cffc023331014a749817ef38a05cbdc7fbb5d136b7fb8a0c52ae9ff883", "receipt_id": "LP-1792234271-0a3c79e1", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_fail"}
+{"digest": "c891475f3a3446708ac467751b10776983efda4705106efc8c695666aeea0713", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792234271.6164002, "error_class": null, "input_digest": "d7a369763d2def0be6bad748cb9522203f4886d454f04700e3d59044c00db31d", "output_digest": "c27aabb83792dee21c4f793c1fe885585000e813011582daec5e1a9c2a0ecd68", "started_at": 1792234271.616357}, "kind": "tool", "observed_at": 1792234271.616405, "path": "tool:run_tests", "phase": "recovery", "prev_digest": "9cbf71ec9044f26587cef983b2bce9046e29d236107d371bd1b9ebf5d0bf255a", "receipt_id": "LP-1792234271-87133897", "recovery_of": "LP-1792234271-0a3c79e1", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_pass"}

backups/live_proof-1792234962/receipts/tool__write_file.jsonl

@@ -0,0 +1,8 @@
+{"digest": "5141998f46b6c0b0d25952d180c431b9c50c9a2dc36deb0e30b09cf9dbffe86c", "evidence": {"detail": "approval gate observed: executed without confirmation boundary", "ended_at": 1792233217.9307585, "error_class": null, "input_digest": "3f768c19ec87d469161bbf767efec77c98005056ab25f77e2560c0597f784f95", "output_digest": "6c1b4cc94145a09709cc16ed11b1f904fc56b41882afc9db2a4e12de68f0fb79", "started_at": 1792233217.9291263}, "kind": "tool", "observed_at": 1792233217.9307735, "path": "tool:write_file", "phase": "auth_check", "prev_digest": null, "receipt_id": "LP-1792233217-0d73d2b3", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 0, "verdict": "observed_pass"}
+{"digest": "8c48b38dd602a7a303efde8b86ea3df4f39467abaefff13daaa893d16071cb4a", "evidence": {"detail": "write a one-line sandbox file", "ended_at": 1792233217.9319632, "error_class": null, "input_digest": "4dfc60346c1e233cf78d9a367091a1465624511f661a1462636cb3d8094ca7ba", "output_digest": "ed8f668534dd0c78f43c2045d6fa734f92af7db5fd0eac48a8fd75969311185b", "started_at": 1792233217.9307745}, "kind": "tool", "observed_at": 1792233217.9319773, "path": "tool:write_file", "phase": "minimal_call", "prev_digest": "5141998f46b6c0b0d25952d180c431b9c50c9a2dc36deb0e30b09cf9dbffe86c", "receipt_id": "LP-1792233217-502c81ab", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 1, "verdict": "observed_pass"}
+{"digest": "eba68d31e4b92828a6ec98ad2d99f5a1c3491fcc6af342a2b8f513d346fe82a5", "evidence": {"detail": "injected fault observed failing and classified: Access denied: /proc/__live_proof_write_probe__ is in a protected directory (/proc). This directory is always blocked, e", "ended_at": 1792233217.9321306, "error_class": "PATH_DENIED", "injected_fault": "write outside allowed write dirs", "input_digest": "0b46e0702bc032687655f69c97ec430d70c83fc66940c56f100c1aa48c41a68d", "output_digest": "326b4c20883bd51e34f78ad642c79b75055aeac2dd87c105889c076d4cccf9a4", "started_at": 1792233217.931978}, "kind": "tool", "observed_at": 1792233217.932141, "path": "tool:write_file", "phase": "failure_injection", "prev_digest": "8c48b38dd602a7a303efde8b86ea3df4f39467abaefff13daaa893d16071cb4a", "receipt_id": "LP-1792233217-380fa392", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 2, "verdict": "observed_pass"}
+{"digest": "77745eff94f25e9dcaa6dde6d7659c9584b19034b47a3c3adde28a069a705165", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792233217.9330544, "error_class": null, "input_digest": "33b285bd6f9455702eb5f03029fd24a882ffe2bb51c76bb0959510fe00efd537", "output_digest": "11096cc3886527e4a8c05d487c644125e02389b4f00a6313a24f1571ff16ce71", "started_at": 1792233217.9321415}, "kind": "tool", "observed_at": 1792233217.9330647, "path": "tool:write_file", "phase": "recovery", "prev_digest": "eba68d31e4b92828a6ec98ad2d99f5a1c3491fcc6af342a2b8f513d346fe82a5", "receipt_id": "LP-1792233217-977b2aeb", "recovery_of": "LP-1792233217-380fa392", "run_id": "RUN-1792233217-0033a4", "schema": 1, "seq": 3, "verdict": "observed_pass"}
+{"digest": "6466d4e589d526d86328500254d7f701620a8dca8c71d5facfa01a6291eb00a2", "evidence": {"detail": "approval gate observed: executed without confirmation boundary", "ended_at": 1792234271.5982952, "error_class": null, "input_digest": "3f768c19ec87d469161bbf767efec77c98005056ab25f77e2560c0597f784f95", "output_digest": "6c1b4cc94145a09709cc16ed11b1f904fc56b41882afc9db2a4e12de68f0fb79", "started_at": 1792234271.5974405}, "kind": "tool", "observed_at": 1792234271.598307, "path": "tool:write_file", "phase": "auth_check", "prev_digest": "77745eff94f25e9dcaa6dde6d7659c9584b19034b47a3c3adde28a069a705165", "receipt_id": "LP-1792234271-af5a8bcd", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 4, "verdict": "observed_pass"}
+{"digest": "21eeb19cda896df990b42900bcc37e0334cae248d52094d417764e8596e773b3", "evidence": {"detail": "write a one-line sandbox file", "ended_at": 1792234271.5991473, "error_class": null, "input_digest": "4dfc60346c1e233cf78d9a367091a1465624511f661a1462636cb3d8094ca7ba", "output_digest": "ed8f668534dd0c78f43c2045d6fa734f92af7db5fd0eac48a8fd75969311185b", "started_at": 1792234271.5983076}, "kind": "tool", "observed_at": 1792234271.5991564, "path": "tool:write_file", "phase": "minimal_call", "prev_digest": "6466d4e589d526d86328500254d7f701620a8dca8c71d5facfa01a6291eb00a2", "receipt_id": "LP-1792234271-f7ece735", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 5, "verdict": "observed_pass"}
+{"digest": "a2292e905a01e4aa8fe60f10806d6235bf36aa0cdba1a804f461129e33839ebe", "evidence": {"detail": "injected fault observed failing and classified: Access denied: /proc/__live_proof_write_probe__ is in a protected directory (/proc). This directory is always blocked, e", "ended_at": 1792234271.5992904, "error_class": "PATH_DENIED", "injected_fault": "write outside allowed write dirs", "input_digest": "0b46e0702bc032687655f69c97ec430d70c83fc66940c56f100c1aa48c41a68d", "output_digest": "326b4c20883bd51e34f78ad642c79b75055aeac2dd87c105889c076d4cccf9a4", "started_at": 1792234271.5991573}, "kind": "tool", "observed_at": 1792234271.5993023, "path": "tool:write_file", "phase": "failure_injection", "prev_digest": "21eeb19cda896df990b42900bcc37e0334cae248d52094d417764e8596e773b3", "receipt_id": "LP-1792234271-942365c4", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 6, "verdict": "observed_pass"}
+{"digest": "1d7332a71682b576a51ae75ff24ca857736ad596e4ad4323908b93a8f35ed439", "evidence": {"detail": "minimal call succeeded after injected fault", "ended_at": 1792234271.600123, "error_class": null, "input_digest": "33b285bd6f9455702eb5f03029fd24a882ffe2bb51c76bb0959510fe00efd537", "output_digest": "11096cc3886527e4a8c05d487c644125e02389b4f00a6313a24f1571ff16ce71", "started_at": 1792234271.599303}, "kind": "tool", "observed_at": 1792234271.6001318, "path": "tool:write_file", "phase": "recovery", "prev_digest": "a2292e905a01e4aa8fe60f10806d6235bf36aa0cdba1a804f461129e33839ebe", "receipt_id": "LP-1792234271-cdf23f1f", "recovery_of": "LP-1792234271-942365c4", "run_id": "RUN-1792234271-c44554", "schema": 1, "seq": 7, "verdict": "observed_pass"}

backups/live_proof-1792234962/sandbox/check_growth.txt

@@ -0,0 +1 @@
+live-proof probe line

backups/live_proof-1792234962/sandbox/diagnose_behavior.txt

@@ -0,0 +1 @@
+live-proof probe line

backups/live_proof-1792234962/sandbox/edit_file.txt

@@ -0,0 +1 @@
+live-proof edited line

backups/live_proof-1792234962/sandbox/find_capability.txt

@@ -0,0 +1 @@
+live-proof probe line

backups/live_proof-1792234962/sandbox/format_code.txt

@@ -0,0 +1 @@
+live-proof probe line

backups/live_proof-1792234962/sandbox/git_commit.txt

@@ -0,0 +1 @@
+live-proof probe line

backups/live_proof-1792234962/sandbox/git_diff.txt

@@ -0,0 +1 @@
+live-proof probe line

backups/live_proof-1792234962/sandbox/git_log.txt

@@ -0,0 +1 @@
+live-proof probe line

backups/live_proof-1792234962/sandbox/glob_files.txt

@@ -0,0 +1 @@
+live-proof probe line

backups/live_proof-1792234962/sandbox/grep_files.txt

@@ -0,0 +1 @@
+live-proof probe line

backups/live_proof-1792234962/sandbox/lint_file.txt

@@ -0,0 +1 @@
+live-proof probe line

backups/live_proof-1792234962/sandbox/list_directory.txt

@@ -0,0 +1 @@
+live-proof probe line

backups/live_proof-1792234962/sandbox/query_memory.txt

@@ -0,0 +1 @@
+live-proof probe line

backups/live_proof-1792234962/sandbox/read_file.txt

@@ -0,0 +1 @@
+live-proof probe line

backups/live_proof-1792234962/sandbox/read_persona.txt

@@ -0,0 +1 @@
+live-proof probe line

backups/live_proof-1792234962/sandbox/repo_map.txt

@@ -0,0 +1 @@
+live-proof probe line

backups/live_proof-1792234962/sandbox/run_command.txt

@@ -0,0 +1 @@
+live-proof probe line

backups/live_proof-1792234962/sandbox/run_tests.txt

@@ -0,0 +1 @@
+live-proof probe line

backups/live_proof-1792234962/sandbox/write_file.txt

@@ -0,0 +1 @@
+live-proof probe line

config/mimo-hooks/builder-bridge.ts

@@ -24,7 +24,7 @@ import { existsSync, appendFileSync } from "node:fs"
 // Injection policy: only append when the capsule is non-empty. A plain
 // "hello" gets nothing (§5: if nothing relevant exists, inject nothing).
 
-const BRIDGE = "/mnt/workdrive/issue161-harness/src/rune/builder_bridge_cli.py"
+const BRIDGE = "/mnt/workdrive/rune/src/rune/builder_bridge_cli.py"
 const MARKER_PREFIX = "/tmp/rune-bridge-"
 
 // Interpreter resolution (T22 repair): the previous hardcoded
@@ -35,7 +35,8 @@ const MARKER_PREFIX = "/tmp/rune-bridge-"
 // all of them. If nothing exists the hook degrades as before.
 const PY_CANDIDATES = [
   process.env.MIMO_BRIDGE_PY,
-  "/mnt/workdrive/issue161-harness/.test-venv/bin/python",
+  "/mnt/workdrive/rune/.test-venv/bin/python",
+  "/mnt/workdrive/rune/.venv/bin/python",
   "/home/nick/.venvs/memory/bin/python3",
   "/usr/bin/python3",
 ].filter((p) => typeof p === "string" && p.length > 0)

config/mimo-hooks/scaffolding-guard.ts

@@ -0,0 +1,367 @@
+import { execFile } from "node:child_process"
+import { existsSync, appendFileSync, readFileSync } from "node:fs"
+
+// scaffolding-guard — the MiMo-surface construction enforcement edge (T23).
+//
+// WHY THIS EXISTS
+// T22 proved the accepted Scaffolding V1 authority was reachable from the
+// TUI/operator path but NOT from the agent's own mutation surface, and
+// recorded the honest boundary: "no byte-level enforcement point exists …
+// Establishing MiMo-surface enforcement is NEW architecture (a
+// tool.execute.before governance hook) and was NOT built here — it is
+// recorded as the exact remaining blocker." This file IS that seam.
+//
+// It is the harness half ONLY. Every decision is delegated to
+// `src/rune/construction_authority_cli.py` → `rune.construction_authority`,
+// which derives from the canonical construction store. There is no
+// construction logic here: if you find yourself adding policy to this file,
+// it belongs in Python instead (T23 §36 — no parallel construction system).
+//
+// TWO EVENTS, TWO JOBS
+//   experimental.chat.messages.transform — the TURN BOUNDARY. Classify the
+//     user's intent once and create/resume the canonical contract
+//     (tranche §83: classify at the task boundary, never per tool call).
+//   tool.execute.before — the ENFORCEMENT BOUNDARY. Per mutating tool call,
+//     ask whether the mutation is inside the active contract's approved
+//     scope; block it if not.
+//
+// BLOCKING CONTRACT (verified against @mimo-ai/plugin index.d.ts and the
+// decompiled harness): mutate `output` — `output.cancel = true` plus
+// `output.cancelReason`. The tool's execute is then never called and the
+// model receives `cancelReason` as the tool result. There is no
+// thrown-error convention. `output.args` is mutable but unused here.
+//
+// DEGRADATION (tranche §61/§62): a bridge failure must not silently become
+// either a denial or a bypass. We cache the last known authority; if the
+// bridge fails while a governed contract was active, we FAIL CLOSED
+// (conversational mutation on an active governed build stops with an
+// explicit reason). If no contract was active, we allow — ordinary
+// non-construction work must never become unusable.
+//
+// CANONICAL SOURCE: config/mimo-hooks/scaffolding-guard.ts
+// Installed to ~/.mimocode/hooks/scaffolding-guard.ts by
+// `scripts/install_mimo_hook.py` (hash-verified, drift-detected).
+
+const REPO = "/mnt/workdrive/rune"
+const CLI = `${REPO}/src/rune/construction_authority_cli.py`
+const LOG = "/tmp/rune-scaffolding-guard.log"
+
+// The DURABLE authority lock, written by the canonical authority
+// (`construction_authority.write_authority_lock`) on every successful check.
+// The hook reads it ONLY during bridge failure and ONLY to become MORE
+// conservative (§62: degradation must never silently become a bypass).
+//
+// Why the hook needs it at all: `lastAuthority` below is in-process state, so a
+// FRESH hook process — a new session, a reinstall, a restarted harness — starts
+// with no memory that a governed build was active, and a bridge failure would
+// then be allowed. That was the measured gap: fail-closed worked, but it did
+// not survive a fresh process. The lock is the durable half of that decision.
+//
+// It can never GRANT authority: there is no code path here that turns a lock
+// into permission. ACTIVE or unreadable → stop; absent → no durable evidence.
+const LOCK = `${REPO}/store/authority-lock.json`
+
+// Same durable interpreter resolution as builder-bridge.ts (T22 repair:
+// never hardcode an ephemeral interpreter path).
+const PY_CANDIDATES = [
+  process.env.MIMO_BRIDGE_PY,
+  `${REPO}/.test-venv/bin/python`,
+  "/home/nick/.venvs/memory/bin/python3",
+  "/usr/bin/python3",
+].filter((p) => typeof p === "string" && p.length > 0)
+
+function resolvePy() {
+  for (const p of PY_CANDIDATES) {
+    try {
+      if (existsSync(p)) return p
+    } catch {}
+  }
+  return null
+}
+
+// Tools that can change project state. Reads/search/list are deliberately
+// absent — they cannot mutate and must never be gated (tranche §12:
+// governance is universal for construction, ceremony is not).
+const MUTATING = new Set([
+  "write", "edit", "patch", "multiedit", "multi_edit", "apply_patch",
+  "notebook_edit", "write_file", "edit_file", "str_replace",
+  "bash", "shell", "run_command", "execute", "terminal",
+])
+
+function log(line) {
+  try {
+    appendFileSync(LOG, `${new Date().toISOString()} ${line}\n`)
+  } catch {}
+}
+
+// Three states, and the distinction is load-bearing:
+//   ACTIVE     — a governed construction was live; bridge failure fails CLOSED
+//   UNREADABLE — present but corrupt/unparseable; ALSO fails closed (a broken
+//                lock is not evidence of absence — absence of evidence is not
+//                evidence of absence)
+//   ABSENT     — no durable evidence of an active construction; ordinary work
+//                must keep working (§62)
+function readDurableLock() {
+  try {
+    if (!existsSync(LOCK)) return { state: "ABSENT", contract_id: null }
+    const doc = JSON.parse(readFileSync(LOCK, "utf8"))
+    if (!doc || typeof doc !== "object" || !doc.active) {
+      return { state: "UNREADABLE", contract_id: null }
+    }
+    return { state: "ACTIVE", contract_id: doc.contract_id ?? null }
+  } catch (e) {
+    return { state: "UNREADABLE", contract_id: null }
+  }
+}
+
+// Deterministic, secret-free diagnostic from a failed bridge call. The
+// previous guard logged only `err.message` ("Command failed: …"), which hid
+// the actual CLI error and made a FAIL-CLOSED record undiagnosable after the
+// fact. We surface the interpreter's own stderr tail and the payload op —
+// never the payload body (it can carry user working context).
+function summariseFailure(op, err, stderr) {
+  const parts = [`op=${op}`]
+  if (err) {
+    parts.push(`kind=${err.killed ? "timeout" : err.code != null ? `exit=${err.code}` : "spawn"}`)
+    if (err.message) parts.push(`msg=${String(err.message).slice(0, 200)}`)
+  }
+  const tail = String(stderr ?? "").trim().split("\n").slice(-3).join(" | ")
+  if (tail) parts.push(`stderr=${tail.slice(0, 400)}`)
+  return parts.join(" ")
+}
+
+function runCli(payload) {
+  return new Promise((resolve) => {
+    const op = String(payload?.op ?? "?")
+    const py = resolvePy()
+    if (!py) {
+      log(`bridge: NO INTERPRETER RESOLVED ${summariseFailure(op, null, "")}`)
+      return resolve(null)
+    }
+    let done = false
+    const finish = (v) => {
+      if (!done) {
+        done = true
+        resolve(v)
+      }
+    }
+    try {
+      const child = execFile(
+        py,
+        [CLI],
+        { timeout: 8000, maxBuffer: 1 << 20 },
+        (err, stdout, stderr) => {
+          if (err) {
+            log(`bridge: error ${summariseFailure(op, err, stderr)}`)
+            return finish(null)
+          }
+          try {
+            finish(JSON.parse(String(stdout)))
+          } catch (e) {
+            log(
+              `bridge: bad JSON op=${op} stdout=${String(stdout).slice(0, 200)} ` +
+                summariseFailure(op, null, stderr),
+            )
+            finish(null)
+          }
+        },
+      )
+      // MEASURED DEFECT (T24 §9A4, found while forcing a bridge failure): when
+      // the interpreter dies before reading stdin — a wrong binary, a crashed
+      // Python, a killed process — this stream raises EPIPE *asynchronously*
+      // and, unhandled, takes the whole HOOK process down. A crash is not
+      // fail-closed; the harness receives no cancellation decision at all, so
+      // the mutation proceeds. Swallowing it lets the execFile callback below
+      // report the failure as the ordinary `null` result, which the enforcement
+      // boundary then decides on.
+      child.stdin?.on("error", () => {})
+      child.stdin?.end(JSON.stringify(payload))
+    } catch (e) {
+      log(`bridge: spawn failed ${summariseFailure(op, e, "")}`)
+      finish(null)
+    }
+  })
+}
+
+// Last known authority, so a transient bridge failure can fail CLOSED
+// without breaking non-construction work.
+let lastAuthority = null // { active: boolean, contract_id?: string, at: number }
+let lastTurnText = ""
+
+// The working tree as of the previous shell call. The lazy postcondition
+// diffs against this so it reports only what changed SINCE then — a governed
+// build normally starts in a dirty tree, and treating existing residue as
+// this command's writes would fail every build closed.
+let lastSnapshot = null
+
+// Harness-internal traffic is NOT user construction intent. Measured defect
+// (T23, live): without this guard the turn boundary minted bogus
+// construction contracts from `<actor-notification>` envelopes — subagent
+// completion reports arriving as user-role messages — and then correctly
+// blocked the operator's own legitimate work against them. Same class of
+// guard builder-bridge.ts uses for `<system-reminder>` / checkpoint steps.
+// A genuine operator turn does not begin with an envelope tag.
+const INTERNAL_ENVELOPE =
+  /^\s*(?:<[A-Za-z][A-Za-z0-9-]*|EXTRACTION REQUIRED|\[Never-Ask\]|\[inbox)/
+
+function isInternal(text) {
+  return INTERNAL_ENVELOPE.test(text)
+}
+
+// Interpreters that can execute a script which mutates the repo — the
+// generated-script route (tranche §21). Only these trigger postcondition
+// verification, which is the one place we pay a git call.
+const SCRIPT_EXEC =
+  /(?:^|\s)(?:python3?|node|bun|deno|sh|bash|zsh|perl|ruby|php|make|npm|pnpm|yarn|cargo|go)(?:\s|$)/
+
+function extractUserText(messages) {
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const m = messages[i]
+    if (m?.info?.role !== "user") continue
+    const texts = []
+    for (const p of m.parts ?? []) {
+      if (p?.type === "text" && typeof p.text === "string") texts.push(p.text)
+    }
+    if (texts.length) return texts.join("\n").slice(0, 4000)
+  }
+  return ""
+}
+
+export const ScaffoldingGuard = {
+  // ---- TURN BOUNDARY: classify once, create/resume the contract --------
+  "experimental.chat.messages.transform": async (_input, output) => {
+    try {
+      if (!Array.isArray(output?.messages) || output.messages.length === 0) return
+      const text = extractUserText(output.messages)
+      if (!text || text.length < 12) return
+      // Harness-internal envelopes are never construction intent.
+      if (isInternal(text)) return
+      if (text === lastTurnText) return // dedupe: one classification per turn
+      lastTurnText = text
+
+      const res = await runCli({
+        op: "begin",
+        text,
+        cwd: REPO,
+        origin: "mimo",
+      })
+      if (!res || res.ok !== true) {
+        log(`begin: no result (${JSON.stringify(res)})`)
+        return
+      }
+      log(
+        `begin: mode=${res.mode} activated=${res.activated} ` +
+          `contract=${res.contract_id} intent=${res.intent_layer} ` +
+          `scope=${JSON.stringify(res.scope ?? [])}`,
+      )
+      if (res.activated && res.contract_id) {
+        lastAuthority = { active: true, contract_id: res.contract_id, at: Date.now() }
+      } else {
+        lastAuthority = { active: false, at: Date.now() }
+      }
+    } catch (e) {
+      log(`begin: threw ${e}`)
+    }
+  },
+
+  // ---- ENFORCEMENT BOUNDARY: per mutating tool call --------------------
+  "tool.execute.before": async (input, output) => {
+    try {
+      const tool = String(input?.tool ?? "")
+      if (!MUTATING.has(tool.toLowerCase())) return
+
+      // LAZY POSTCONDITION (runs in the wired `before` event).
+      // `tool.execute.after` is declared in the hook API but is NOT triggered
+      // at runtime in this harness build — measured: 485 `before` events and
+      // zero harness `after` events, so a postcondition wired to `after`
+      // would silently never run. Detection therefore happens here instead,
+      // comparing the tree against the previous call's snapshot, which also
+      // means the delta is known BEFORE the next mutation is authorised.
+      //
+      // Runs for EVERY consequential mutation, not just shell calls. Measured
+      // temporal gap: with the checkpoint gated to shell tools, an escaping
+      // script followed by a native write/edit was authorised without the
+      // pending delta ever being reconciled.
+      {
+        const snap = await runCli({
+          op: "checkpoint",
+          cwd: REPO,
+          before: lastSnapshot,
+        })
+        if (snap && snap.ok === true) {
+          lastSnapshot = snap.entries ?? {}
+          if ((snap.violations ?? []).length > 0) {
+            log(`checkpoint: VIOLATION out_of_scope=${JSON.stringify(snap.violations)}`)
+          } else if ((snap.changed ?? []).length > 0) {
+            log(`checkpoint: changed=${JSON.stringify(snap.changed)} (in scope)`)
+          }
+        } else {
+          log(`checkpoint: no result (${JSON.stringify(snap)})`)
+        }
+      }
+
+      const res = await runCli({
+        op: "check",
+        tool,
+        args: output?.args ?? {},
+        cwd: REPO,
+        // G6: the turn's own words are what a promotion would mint the
+        // contract from. Passed only as evidence for a promotion the
+        // authority decides on — the hook does not decide.
+        promote_text: lastTurnText || undefined,
+      })
+
+      if (!res || res.ok !== true) {
+        // Bridge failure. Fail CLOSED only when a governed build was known
+        // active; otherwise let ordinary work continue (§61/§62).
+        //
+        // "Known active" now has TWO sources, and either one is sufficient:
+        //   * `lastAuthority` — what this process saw before the bridge broke;
+        //   * the DURABLE LOCK — what the canonical authority last recorded,
+        //     which is the only source available to a FRESH process.
+        // The lock is consulted strictly to escalate. An ABSENT lock cannot
+        // turn a known-active in-process contract into an allow.
+        const durable = readDurableLock()
+        const inProcess = !!lastAuthority?.active
+        const durableStops = durable.state === "ACTIVE" || durable.state === "UNREADABLE"
+        if (inProcess || durableStops) {
+          const source = inProcess
+            ? `in-process contract=${lastAuthority.contract_id}`
+            : `durable lock state=${durable.state} contract=${durable.contract_id}`
+          output.cancel = true
+          output.cancelReason =
+            "Scaffolding guard unavailable while a governed construction " +
+            "contract is active. Consequential mutation stopped (fail-closed). " +
+            "Re-run once the Rune construction authority is reachable. " +
+            `[evidence: ${source}]`
+          log(`check: FAIL-CLOSED on bridge failure (${source})`)
+        } else {
+          log("check: bridge failure, no active contract (in-process or durable) — allowed")
+        }
+        return
+      }
+
+      lastAuthority = {
+        active: !!res.contract_id && res.mode !== "NO_CONTRACT",
+        contract_id: res.contract_id ?? undefined,
+        at: Date.now(),
+      }
+
+      log(
+        `check: tool=${tool} allow=${res.allow} mode=${res.mode} ` +
+          `contract=${res.contract_id} scope=${JSON.stringify(res.scope ?? [])} ` +
+          `checked=${JSON.stringify(res.checked ?? [])}`,
+      )
+
+      if (res.allow === false) {
+        output.cancel = true
+        output.cancelReason = String(res.reason || "Blocked by construction scope")
+      }
+    } catch (e) {
+      log(`check: threw ${e}`)
+    }
+  },
+
+}
+
+export default ScaffoldingGuard

config/umbrellas.json

@@ -283,6 +283,7 @@
     "capability_ledger",
     "cognitive_budgeter",
     "construction_activation",
+    "construction_admission",
     "construction_commands",
     "construction_decision",
     "construction_depth",

docs/.agents/skills/.openspec-target

@@ -0,0 +1 @@
+agents

docs/.agents/skills/openspec-apply-change/SKILL.md

@@ -0,0 +1,206 @@
+---
+name: openspec-apply-change
+description: Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks. Also use when the user says "openspec apply", "opsx apply", or "openspec implement".
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.14.1"
+---
+
+Implement tasks from an OpenSpec change.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Project check:** These steps expect a project that already uses OpenSpec. Before the first step that writes anything (`new change`, `archive`, `sync specs`, or authoring an artifact file), confirm the project has a root: run `openspec list --json` (with `--store <id>` when a store is selected, since the store is then the root) and read `root`. A root object means the project is set up. `"root": null` means it is not - there is no `openspec/` directory here, and a write such as `openspec new change` would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.
+
+One `"root": null` is not about setup: when a `status` error message starts with `Declared in` or `Invalid store declaration in` and names this project's `openspec/config.yaml` (or `config.yml`), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the `store:` line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's `message` and `fix`.
+
+Otherwise, with no root, what happens next depends on how this workflow was reached:
+
+- **Auto-selected**: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
+- **Explicit OpenSpec request**: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (`openspec init`), target a store they already have (`--store <id>`), or continue without OpenSpec for this request. Wait for their answer.
+
+In both branches, never create the root as a side effect: do not run `openspec init` until the user asks for it, do not hand-create `openspec/` files, and do not let a command create it.
+
+**Input**: Optionally specify a change name (e.g., `/openspec-apply-change add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/openspec-apply-change <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, and `actionContext`: planning scope and edit constraints
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
+   - Progress (total, complete, remaining)
+   - Task list with status, source path, and source line
+   - Dynamic instruction based on current state
+   - Optional `context`: current required project instruction input from the selected root
+   - Optional `operationGuidance`: current advisory guidance for apply
+   - `missingArtifacts` (when present): required artifact ids with no output
+
+   **Handle states:**
+   - If `state: "blocked"`: show the message and pause implementation.
+     - If `missingArtifacts` is non-empty: suggest completing the missing artifacts. Run `openspec status --change "<name>" --json`, select the next `ready` artifact (not `skipped` or `blocked`), and use `openspec instructions "<artifact-id>" --change "<name>" --json` for its rules and template. Keep the selected `--store <id>` on both commands.
+     - Otherwise, follow the CLI instruction to create or repair the schema-configured tracking file from existing planning artifacts. Do not assume another artifact is ready or start implementation while blocked.
+   - If `state: "all_done"`: report that all tracked tasks are complete and suggest review or verification as appropriate before archiving
+   - Otherwise: proceed to implementation
+
+   Treat `context` as a required prompt-level input. Read and consider it, and
+   apply relevant project facts, conventions, and constraints while implementing.
+   Treat `operationGuidance` as optional additive advice. Read and consider every
+   entry, and follow entries that are applicable and compatible with the built-in
+   workflow.
+
+   Keep both fields separate from CLI-returned state, missing artifacts, tasks,
+   progress, `contextFiles`, and the built-in `instruction`. They are not
+   evidence of task completion, do not replace the built-in instruction, and do
+   not permit bypassing a blocked state. If context conflicts with the built-in
+   instruction, an explicit user choice, or a CLI-controlled value, report the
+   conflict and preserve the controlling value. If guidance is inapplicable or
+   conflicts with those controlling inputs, do not follow it and explain why.
+   These are prompt-level behavior contracts, not enforceable checks.
+
+4. **Read context files**
+
+   Read every file path listed under `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+   Do not copy `context` or `operationGuidance` verbatim into implementation
+   files or planning artifacts unless the user separately asks for that content.
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Before editing, confirm the checkbox at the returned `sourcePath` and `line` still matches the task description; if it does not, rerun the apply instructions and use the refreshed location
+   - Mark the task complete at its returned `sourcePath` and `line`: `- [ ]` → `- [x]`
+   - Rerun the apply instructions and confirm that task is now done and progress changed
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - A task needs work beyond what the spec and tasks describe, or you are tempted to drop, narrow, defer, or accept exceptions to specified behavior to make it fit → surface the added scope and ask; do not absorb it silently
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: report that tracked tasks are complete and suggest review or verification as appropriate before archiving
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tracked tasks are complete. Review or verify the change as appropriate
+before archiving. You can archive this change with `/openspec-archive-change`.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- When a task needs work beyond what the spec describes, surface the added scope and pause - never silently narrow, defer, or simplify away specified behavior
+- Only mark a task `- [x]` when its specified behavior is fully implemented, not when it is partially done or deferred
+- Use contextFiles from CLI output, don't assume specific file names
+- Use each task's sourcePath and line to update its exact checkbox
+- Do not use context or operation guidance as proof that a task is complete
+- Apply relevant project context; report conflicts with controlling workflow inputs
+- Consider every guidance entry; explain any inapplicable or conflicting advice
+- Do not copy runtime context or operation guidance into implementation files or planning artifacts
+- Preserve CLI-controlled blocked/ready/all-done behavior and completion criteria
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly

docs/.agents/skills/openspec-archive-change/SKILL.md

@@ -0,0 +1,221 @@
+---
+name: openspec-archive-change
+description: Archive a completed OpenSpec change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete. Also use when the user says "openspec archive" or "opsx archive".
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.14.1"
+---
+
+Archive a completed change in the experimental workflow.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Project check:** These steps expect a project that already uses OpenSpec. Before the first step that writes anything (`new change`, `archive`, `sync specs`, or authoring an artifact file), confirm the project has a root: run `openspec list --json` (with `--store <id>` when a store is selected, since the store is then the root) and read `root`. A root object means the project is set up. `"root": null` means it is not - there is no `openspec/` directory here, and a write such as `openspec new change` would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.
+
+One `"root": null` is not about setup: when a `status` error message starts with `Declared in` or `Invalid store declaration in` and names this project's `openspec/config.yaml` (or `config.yml`), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the `store:` line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's `message` and `fix`.
+
+Otherwise, with no root, what happens next depends on how this workflow was reached:
+
+- **Auto-selected**: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
+- **Explicit OpenSpec request**: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (`openspec init`), target a store they already have (`--store <id>`), or continue without OpenSpec for this request. Wait for their answer.
+
+In both branches, never create the root as a side effect: do not run `openspec init` until the user asks for it, do not hand-create `openspec/` files, and do not let a command create it.
+
+`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
+
+   When prompting, show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/openspec-archive-change <other>`).
+
+   **Load current archive inputs before the existing archive checks:**
+
+   After resolving the selected change and planning root, run:
+   ```bash
+   openspec instructions archive --change "<name>" --json
+   ```
+   Keep the same selected-root flags on this command. This lookup is advisory and
+   optional: it only supplies extra prompt inputs, so it must never block archiving.
+   If it exits non-zero or returns invalid JSON — for example on an older CLI that
+   does not support this command yet — continue the archive workflow with no
+   context and no operation guidance. Do not report an error and do not stop.
+
+   A successful response may omit both optional fields. Treat `context` as a
+   required prompt-level input: read and consider it, and apply relevant project
+   facts, conventions, and constraints. Treat `operationGuidance` as optional
+   additive advice: read and consider every entry, and follow entries that are
+   applicable and compatible with the built-in archive workflow.
+
+   Keep both fields separate from built-in steps, explicit user choices, resolved
+   paths, CLI checks, and command contracts. If context conflicts with one of those
+   controlling inputs, report the conflict and preserve the controlling value. If
+   guidance is inapplicable or conflicts with a controlling input, do not follow it
+   and explain why. Do not infer replacement paths, skipped prompts, or flags from
+   either field, and do not copy their text verbatim into specs, change artifacts,
+   or archive summaries unless the user separately asks for it. These are
+   prompt-level behavior contracts, not enforceable checks.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - `artifacts`: List of artifacts with their status (`done`, `skipped`, or other)
+
+   **If any artifacts are neither `done` nor `skipped`** (skipped artifacts satisfy the requirement - the change declares skip_specs):
+   - Display warning listing incomplete artifacts
+   - Ask the user to confirm they want to proceed
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Run `openspec list --json` with the same selected-root flags and find the
+   entry in `changes` whose `name` exactly matches the selected change.
+   Require exactly one match and nonnegative integer `totalTasks` and
+   `completedTasks`, with `completedTasks <= totalTasks`. The CLI resolves
+   the schema's tracked task files, including custom artifact names, output
+   paths, and globs.
+   Incomplete tasks = `totalTasks - completedTasks`.
+
+   Do not infer task completion from artifact status or the absence of a
+   top-level `tasks.md`. If the lookup fails, returns invalid JSON, omits or
+   duplicates the selected change, or returns invalid counts, report the problem
+   and stop before syncing or archiving.
+   The CLI counts only `x`/`X` checkbox markers as complete;
+   other markers, including unfamiliar ones, remain incomplete.
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Ask the user to confirm they want to proceed
+   - Proceed if user confirms
+
+   **If `totalTasks` is zero:** Proceed without a task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON as the only
+   delta-spec source. If the `specs` entry is missing or
+   `existingOutputPaths` is empty, proceed without a sync prompt and do not infer
+   delta specs from other artifacts.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (use the store-aware `planningHome.root` from step 2, not a hardcoded repo path)
+   - A missing main spec is **not automatically** "already synced". For a new capability, the main spec is an *output* of the sync, not an input:
+     - If the delta has MODIFIED or RENAMED requirements, report that only ADDED requirements can create a new main spec and mark that capability as sync-blocked. Never invent a requirement that has no current version.
+     - Otherwise, if the delta has only REMOVED requirements and the change's `.openspec.yaml` declares `retire_capabilities: true`, the capability is already retired: count it as already synced, warn that there is nothing left to remove, and do not recreate the main spec. Apply this rule both now and when verifying a completed sync.
+     - Otherwise, if the delta has no ADDED requirements, report that no sync is possible and mark that capability as sync-blocked. For a REMOVED-only delta, warn that there is no main spec to remove from and leave the main-spec tree unchanged. `openspec archive` refuses the unmarked REMOVED-only case with `Spec must have at least one requirement`.
+     - Otherwise, count the capability as needing sync and name it in the summary (`<capability-path>: new main spec will be created`). If the delta also has REMOVED requirements, warn that they will be ignored because there is no main spec to remove from. The sync creates the main spec from only the delta's ADDED requirements, exactly as `openspec archive` does.
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Continue assessing the remaining capabilities even when one is sync-blocked. Show a combined summary before prompting.
+
+   **Prompt options:**
+   - If any capability is sync-blocked: explain why and offer only "Archive without syncing", "Cancel"
+   - Otherwise, if changes needed: "Sync now (recommended)", "Archive without syncing"
+   - Otherwise, if already synced: "Archive now", "Sync anyway", "Cancel"
+
+   Route on the answer:
+   - "Cancel" — stop, do not archive
+   - "Archive without syncing" or "Archive now" — proceed to archive
+   - "Sync now" or "Sync anyway" — sync, then verify (below). Do not start any sync while a capability is sync-blocked; explain the blocker and repeat the available choices.
+   - Anything else — ask again rather than archiving
+
+   Before a selected sync writes any main spec, run
+   `openspec instructions specs --change "<name>" --json` once with the same
+   selected-root flags. Require a zero exit status and valid artifact-instruction
+   JSON. If the lookup fails or returns invalid JSON, report the error and stop
+   before writing any main spec or moving the change. A valid response with omitted
+   `rules` is the no-rules case. Apply returned `rules` only to the content and
+   form of main specs produced by this merge; do not use them as archive guidance,
+   change CLI behavior, or copy the rule text into any output file.
+
+   Then run the `openspec-sync-specs` workflow inline (agent-driven intelligent merge) for change '<name>', passing the delta spec analysis and the fetched specs-rule snapshot from above, and wait for it to finish. The inline sync must reuse that snapshot without fetching `specs` instructions again. Do not delegate it to a background task — step 5 would move `changeRoot` out from under a sync that is still reading it, leaving the change archived and the main specs never updated. If your agent can only run it by delegation, delegate synchronously and wait for the result.
+
+   If the sync reports any stop or blocking condition, treat the sync as failed.
+   Stop the archive immediately. Do not perform the post-sync content comparison and do not move its `changeRoot`.
+   Nothing has moved, so the user can fix the blocking condition or re-run the sync.
+
+   After the sync writes each main spec, verify its structure against the canonical sync contract:
+   - A new main spec starts with a `# <capability> Specification` title. An existing main spec keeps its title exactly as it is.
+   - Preserve existing `## Purpose` sections completely untouched for established main specs.
+   - For a new main spec, copy the delta `## Purpose` verbatim. Warn only if the purpose text is shorter than standard validation expects. Do not regenerate or rewrite existing authored purpose. If no usable `## Purpose` is provided, use the existing TBD Purpose behavior and warning.
+   - Verify that no delta-style section headers (`## ADDED Requirements`, `## MODIFIED Requirements`, `## REMOVED Requirements`, `## RENAMED Requirements`) remain in the main spec, adhering strictly to the sync workflow formatting rules.
+   - Requirement blocks the sync wrote or changed use `### Requirement:` headings, and their scenarios use `#### Scenario:` headings, under the spec's `## Requirements` section. Leave content the delta does not mention exactly as it is.
+
+   Then re-run the comparison from the top of this step, including the explicitly retired, missing-spec case, against every capability that has a delta spec in `artifactPaths.specs.existingOutputPaths` — not only the ones the sync reports it touched. A successful sync leaves nothing left to apply, so each capability must now read as already synced:
+   - ADDED requirements present
+   - MODIFIED requirements carrying the scenario and description changes named in the delta, with their other scenarios intact
+   - REMOVED requirements gone — and where this sync retired a capability (removed its last requirement, leaving `## Requirements` empty), its main spec deleted rather than left empty.
+   - RENAMED requirements present under the new name and absent under the old one
+
+   If the sync failed, or any capability does not match, report what differs and stop — do not archive. Nothing has moved and `changeRoot` is intact, so the user can fix the mismatch or re-run the sync and start the archive again.
+
+5. **Perform the archive**
+
+   Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
+   ```bash
+   mkdir -p "<planningHome.changesDir>/archive"
+   ```
+
+   Generate the target name: use the change name as-is when it already starts with a `YYYY-MM-DD-` prefix; otherwise prepend the current date as `YYYY-MM-DD-<change-name>`. Never stack a second date (same rule as `openspec archive`).
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move `changeRoot` to the archive directory
+
+   ```bash
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/<target-name>"
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Whether specs were synced (if applicable)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```markdown
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/<target-name>/
+**Specs:** <"✓ Synced to main specs" only if the step 4 verification passed; otherwise "No delta specs" or "Sync skipped">
+
+<"All artifacts complete. All tasks complete." — or, if archived with warnings, list them instead (e.g. "Archived with 2 incomplete tasks")>
+```
+
+**Guardrails**
+- Announce the selected change; prompt for selection when it is ambiguous
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, run the `openspec-sync-specs` workflow inline (agent-driven)
+- Never archive while a spec sync is still in flight — run the sync inline and verify the main specs before moving `changeRoot`
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
+- Apply relevant runtime context and report conflicts; operation guidance remains advisory
+- Consider every guidance entry and explain any inapplicable or conflicting advice
+- Existing CLI checks, resolved paths, prompts, and command contracts are unchanged
+- Artifact rules constrain only the specs being written and are never operation guidance
+- Never copy runtime context, operation guidance, or artifact-rule text verbatim into output files

docs/.agents/skills/openspec-explore/SKILL.md

@@ -0,0 +1,354 @@
+---
+name: openspec-explore
+description: Enter OpenSpec explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements in a project that uses OpenSpec. Use when the user wants to think through something before or during an OpenSpec change. Also use when the user says "openspec explore" or "opsx explore".
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.14.1"
+---
+
+Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
+
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, investigate the codebase, and run read-only commands or tools without confirmation, but you must NEVER write code or implement features. If the user asks you to implement something, do not start it here: say that explore mode does not implement, and point them at `/openspec-propose`, which turns the discussion into a change. The work happens from that change, never from explore mode. You MAY create or update OpenSpec change artifacts (proposals, designs, specs) within a confirmed scope—that's capturing thinking, not implementing. Answering design or clarifying questions is never consent to write. Before the first write-capable action, name the artifacts or files you would change and what you would do, ask a direct yes/no question, and wait for the user's confirmation in a separate message. Confirmation covers only the scope you described; ask again before expanding it. An explicit request from the user to capture the exploration as a new change is itself that confirmation, covering the change and the change artifacts the request names; scaffold it first as described below.
+
+**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Project check:** These steps expect a project that already uses OpenSpec. Before the first step that writes anything (`new change`, `archive`, `sync specs`, or authoring an artifact file), confirm the project has a root: run `openspec list --json` (with `--store <id>` when a store is selected, since the store is then the root) and read `root`. A root object means the project is set up. `"root": null` means it is not - there is no `openspec/` directory here, and a write such as `openspec new change` would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.
+
+One `"root": null` is not about setup: when a `status` error message starts with `Declared in` or `Invalid store declaration in` and names this project's `openspec/config.yaml` (or `config.yml`), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the `store:` line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's `message` and `fix`.
+
+Otherwise, with no root, what happens next depends on how this workflow was reached:
+
+- **Auto-selected**: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
+- **Explicit OpenSpec request**: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (`openspec init`), target a store they already have (`--store <id>`), or continue without OpenSpec for this request. Wait for their answer.
+
+In both branches, never create the root as a side effect: do not run `openspec init` until the user asks for it, do not hand-create `openspec/` files, and do not let a command create it.
+
+---
+
+## The Stance
+
+- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
+- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
+- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
+- **Adaptive** - Follow interesting threads, pivot when new information emerges
+- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
+- **Grounded** - Explore the actual codebase when relevant, don't just theorize
+
+---
+
+## Planning a Change
+
+When the user is planning a change, guide them toward shared understanding with focused discovery questions. For open-ended discussion, follow the conversation without imposing an interview or a required output.
+
+Before asking a factual question, follow the context discovery below and inspect relevant OpenSpec artifacts, source, tests, docs, and configuration. Do not ask the user to repeat facts you can verify. Summarize relevant findings without reproducing private context or rules. If evidence is missing, conflicting, or inaccessible, state that limitation and ask only for the clarification needed to proceed.
+
+- **Follow dependencies** - Resolve the next blocking decision before its dependent details. For example, clarify the user's outcome and scope before choosing an API or data model. Revisit downstream assumptions when an earlier answer changes. Skip branches that do not matter to this goal.
+- **Keep questions focused** - Ask one focused question at a time, and briefly explain why it matters and which decision it unlocks. Batch questions only if the user asks for a batch; keep them small and group related decisions.
+- **Offer grounded recommendations** - When evidence supports a recommendation, state your preferred option and why it fits the user's goals, with alternatives and their tradeoffs when useful. Do not invent intent, priorities, or external constraints: ask the user when only they can answer. Avoid a fixed question format.
+- **Keep a conversational record** - Track decisions in the conversation, not in files. Separate confirmed decisions from proposed defaults and unresolved questions. Silence is not acceptance. Accepting an answer or a batch of recommendations is not permission to write. Keep file-write confirmation separate from discovery questions and follow the guardrails below.
+
+Stop asking when the user has enough clarity. Let them pause, pivot, or defer a decision; do not exhaust every branch or force a proposal.
+
+For example, after inspecting the relevant code:
+
+```text
+The CLI already uses SQLite and has no remote service. Is sharing state
+across devices in scope? That determines whether local storage is enough.
+If this stays a single-device tool, I recommend keeping SQLite to avoid
+adding a service to operate; shared state would need a separate sync design.
+```
+
+---
+
+## What You Might Do
+
+Depending on what the user brings, you might:
+
+**Explore the problem space**
+- Ask clarifying questions that emerge from what they said
+- Challenge assumptions
+- Reframe the problem
+- Find analogies
+
+**Investigate the codebase**
+- Map existing architecture relevant to the discussion
+- Find integration points
+- Identify patterns already in use
+- Surface hidden complexity
+
+**Compare options**
+- Brainstorm multiple approaches
+- Build comparison tables
+- Sketch tradeoffs
+- Recommend a path (if asked)
+
+**Visualize**
+```
++------------------------------------------+
+|     Use ASCII diagrams liberally         |
++------------------------------------------+
+|                                          |
+|   [State A] -------> [State B]           |
+|       |                                  |
+|       v                                  |
+|   [State C]                              |
+|                                          |
+|   System diagrams, state machines,       |
+|   data flows, architecture sketches,     |
+|   dependency graphs, comparison tables   |
+|                                          |
++------------------------------------------+
+```
+
+**Draw with plain ASCII only** — borders `+` `-` `|`, arrows `-->` `<--` `^` `v`, markers `*` `x`.
+Unicode diagram glyphs can render at different widths across terminals, fonts, and locales, so padded boxes and aligned tables can drift. Keep every diagram character ASCII.
+
+**Surface risks and unknowns**
+- Identify what could go wrong
+- Find gaps in understanding
+- Suggest spikes or investigations
+
+---
+
+## OpenSpec Awareness
+
+You have full context of the OpenSpec system. Use it naturally, don't force it.
+
+### Check for context
+
+At the start, quickly check what exists:
+```bash
+openspec list --json
+```
+
+This tells you:
+- If there are active changes
+- Their names and task status
+- What the user might be working on
+
+That is the *change* list - work in flight. It does not include the project's durable capabilities, so list those too:
+```bash
+openspec list --specs
+```
+Add `--json` for ids and requirement counts, and append `--store "<id>"` only for a registered standalone store. This is the inventory of what the project already claims to do, and `openspec list` on its own never shows it. To look at one, run `openspec show "<spec-id>" --type spec --json --no-scenarios` (same `--store` rule) - it returns that capability's purpose and requirement texts without pulling the whole spec file into context, and `--type spec` stops a change of the same name from making it ambiguous.
+
+The filtered read is only an overview. Before deciding what is already covered or what should change, read each relevant spec in full, including scenarios, with `openspec show "<spec-id>" --type spec` (same `--store` rule).
+
+Then read the project's own context from the resolved root - `<root.path>/openspec/config.yaml` (or `config.yml`). Use the `root.path` returned above, and skip this if neither file exists:
+- `context`: project background - tech stack, conventions, constraints
+- `rules`: keyed by artifact id - the entries for an artifact apply only when you write that artifact
+
+Ground your thinking in these. They are constraints for you to follow, not content to reproduce: do NOT copy them into the conversation or into any artifact you create.
+
+### When no change exists
+
+Think freely. When insights crystallize, you might offer:
+
+- "This feels solid enough to start a change. Want me to create a proposal?"
+- Or keep exploring - no pressure to formalize
+
+If the user asks you to capture the exploration as a new change, that request is the confirmation required above. It covers scaffolding that change and creating the change artifacts the request names, and nothing else. This holds only when the request is theirs: a yes to an offer you made confirms only the scope your offer itself named, so name the change and the artifacts in the offer. Don't re-ask for what they already asked for; do ask before anything beyond it. Transition seamlessly into the requested capture:
+
+1. Run `openspec new change "<name>"` (with `--store <id>` when applicable) before creating any artifacts. Never create a new change directory under `openspec/changes/` by hand; the CLI scaffold creates required metadata such as `.openspec.yaml`. Keep the selected `--store <id>` on every applicable follow-up `status` and `instructions` command.
+2. Run `openspec status --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store), then process the requested artifacts in dependency order. For each requested artifact that is `ready`, run `openspec instructions "<artifact-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store). Before creating a requested artifact, evaluate any condition in its own `instruction` against the explored change; record a deliberate skip instead when the condition does not apply. If a requested artifact is blocked by a direct prerequisite the user did not request, run `openspec instructions "<prerequisite-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) for that prerequisite whether it is `ready` or `blocked`. If its own `instruction` states a condition, evaluate that condition against the explored change and record a deliberate skip only when the condition does not apply. If the condition applies, or the prerequisite is not conditional, treat it as a normal prerequisite and ask before expanding the capture. Do not create an unrequested prerequisite unless the user approves.
+3. Follow the returned `template` and `instruction` fields. Read completed dependency files listed in `dependencies`, and apply `context` and `rules` as constraints without copying them into the artifact. If the instruction delegates creation to a specific skill or command, invoke it; otherwise write the artifact to `resolvedOutputPath`, using the instruction to choose a concrete path when it is a glob. Verify that the selected concrete output exists.
+4. After creating each artifact, re-run `openspec status --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) and continue until every requested artifact is `done`, `skipped`, or was deliberately skipped because its own `instruction` stated a condition that did not apply. Tell the user about a deliberate conditional skip, remember it, and do not reconsider it. Dependencies are enablers, not gates: if a requested artifact is still `blocked` only because you deliberately skipped a conditional prerequisite, run `openspec instructions "<artifact-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) despite the blocked status, then create it using step 3 only when those recorded conditional skips are its sole missing dependencies. If a requested artifact is blocked by a prerequisite the user did not ask to capture and cannot be conditionally skipped, explain that dependency and ask before expanding the capture.
+
+Capture the artifact(s) the user requested without asking them to invoke another workflow command. If they asked only to start a change, stop after scaffolding and show its status. When the requested capture is done, stop there and name where the work continues: `/openspec-propose` writes the remaining planning artifacts, and `/openspec-apply-change` implements the change once tasks exist. Capturing artifacts never starts implementing them.
+
+### When a change exists
+
+If the user mentions a change or you detect one is relevant:
+
+1. **Resolve and read existing artifacts for context**
+   - Run `openspec status --change "<name>" --json`.
+   - Use `changeRoot`, `artifactPaths`, and `actionContext` from the status JSON.
+   - Read existing files from `artifactPaths.<artifact>.existingOutputPaths`.
+
+2. **Reference them naturally in conversation**
+   - "Your design mentions using Redis, but we just realized SQLite fits better..."
+   - "The proposal scopes this to premium users, but we're now thinking everyone..."
+
+3. **Offer to capture when decisions are made**
+
+   `<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve an existing capability's full path and follow the project's established organization for new capabilities.
+
+    | Insight Type               | Where to Capture                    |
+    |----------------------------|-------------------------------------|
+    | New requirement discovered | `specs/<capability-path>/spec.md` |
+    | Requirement changed        | `specs/<capability-path>/spec.md` |
+    | Design decision made       | `design.md`                       |
+    | Scope changed              | `proposal.md`                     |
+    | New work identified        | `tasks.md`                        |
+    | Assumption invalidated     | Relevant artifact                   |
+
+   Example offers:
+   - "That's a design decision. Capture it in design.md?"
+   - "This is a new requirement. Add it to specs?"
+   - "This changes scope. Update the proposal?"
+
+4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
+
+---
+
+## What You Don't Have To Do
+
+- Follow a script
+- Ask the same questions every time
+- Produce a specific artifact
+- Reach a conclusion
+- Stay on topic if a tangent is valuable
+- Be brief (this is thinking time)
+
+---
+
+## Handling Different Entry Points
+
+**User brings a vague idea:**
+```
+User: I'm thinking about adding real-time collaboration
+
+You: Real-time collab is a big space. Let me think about this...
+
+      COLLABORATION SPECTRUM
+      ============================================
+
+      Awareness          Coordination         Sync
+          |                   |                 |
+          v                   v                 v
+      +--------+         +--------+        +--------+
+      |Presence|         |Cursors |        |  CRDT  |
+      |  "3    |         | Multi  |        |Conflict|
+      |online" |         | select |        |  free  |
+      +--------+         +--------+        +--------+
+          |                   |                 |
+       trivial            moderate           complex
+
+      Where's your head at?
+```
+
+**User brings a specific problem:**
+```
+User: The auth system is a mess
+
+You: [reads codebase]
+
+     +---------------------------------------------+
+     |              CURRENT AUTH FLOW              |
+     +---------------------------------------------+
+                        |
+          +-------------+-------------+
+          v             v             v
+     +---------+  +---------+  +---------+
+     | Google  |  |  GitHub |  |  Email  |
+     |  OAuth  |  |  OAuth  |  |  Magic  |
+     +----+----+  +----+----+  +----+----+
+          |             |             |
+          +-------------+-------------+
+                        v
+                  +-----------+
+                  |  Session  |
+                  +-----+-----+
+                        |
+                        v
+                  +-----------+
+                  |   Perms   |
+                  +-----------+
+
+     I see three tangles. Which one's burning?
+```
+
+**User is stuck mid-implementation:**
+```
+User: /openspec-explore add-auth-system
+      The OAuth integration is more complex than expected
+
+You: [reads change artifacts]
+
+     You're on task 4: "Implement OAuth flow"
+
+     Let me trace what's involved...
+
+     [draws diagram, explores options, suggests paths]
+
+     Want to update the design to reflect this?
+     Or add a spike task to investigate?
+```
+
+**User wants to compare options:**
+```
+User: Should we use Postgres or SQLite?
+
+You: Generic answer is boring. What's the context?
+
+User: A CLI tool that tracks local dev environments
+
+You: That changes everything.
+
+     +-------------------------------------------------+
+     |          CLI TOOL DATA STORAGE                  |
+     +-------------------------------------------------+
+
+     Key constraints:
+     - No daemon running
+     - Must work offline
+     - Single user
+
+                  SQLite          Postgres
+     Deployment   embedded        needs server
+     Offline      yes             no
+     Single file  yes             no
+
+     SQLite. Not even close.
+
+     Unless... is there a sync component?
+```
+
+---
+
+## Ending Discovery
+
+There's no required ending. Discovery might:
+
+- **Flow into a proposal**: "Ready to start? Run `/openspec-propose` and this becomes a change."
+- **Result in artifact updates**: "Updated design.md with these decisions"
+- **Just provide clarity**: User has what they need, moves on
+- **Continue later**: "We can pick this up anytime"
+
+When it feels like things are crystallizing, you might summarize:
+
+```
+## What We Figured Out
+
+**The problem**: [crystallized understanding]
+
+**The approach**: [if one emerged]
+
+**Open questions**: [if any remain]
+
+**Next steps** (if ready):
+- Turn this into a change: `/openspec-propose`
+- Keep exploring: just keep talking
+```
+
+But this summary is optional. Sometimes the thinking IS the value.
+
+---
+
+## Guardrails
+
+- **Don't implement** - Never write code or implement features. Workflow configuration counts too: creating or editing schemas, templates, or `openspec/config.yaml` is a change, not thinking. Creating or updating OpenSpec change artifacts within the confirmed scope is fine, writing anything else is not. When the user is ready to build, name the handoff rather than starting: `/openspec-propose` turns the discussion into a change, and the work happens there.
+- **Don't fake understanding** - If something is unclear, dig deeper
+- **Don't rush** - Discovery is thinking time, not task time
+- **Don't force structure** - Let patterns emerge naturally
+- **Don't auto-capture** - Offer to save insights, don't just do it. Read-only commands and tools need no confirmation. Before the first write-capable action—including `openspec new change` or another command that writes files—name the artifacts or files and proposed changes, ask a direct yes/no question, and wait for explicit confirmation in a separate user message. That confirmation covers only the described scope; ask again before expanding it. Answers to design or clarifying questions are never consent to write. That rule governs `openspec new change` whenever you are the one proposing the capture; the user's own capture request is the exception, handled in the capture transition above.
+- **Don't manually scaffold changes** - Never create a new change directory under `openspec/changes/` by hand. Always use `openspec new change "<name>"` (with `--store <id>` when applicable) so required metadata such as `.openspec.yaml` is created before writing artifacts.
+- **Do visualize** - A good diagram is worth many paragraphs
+- **Do explore the codebase** - Ground discussions in reality
+- **Do question assumptions** - Including the user's and your own

docs/.agents/skills/openspec-propose/SKILL.md

@@ -0,0 +1,174 @@
+---
+name: openspec-propose
+description: Propose a new OpenSpec change with all artifacts generated in one step. Use when the user wants to quickly describe what they want to build and get a complete proposal with design, specs, and tasks ready for implementation. Also use when the user says "openspec propose" or "opsx propose".
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.14.1"
+---
+
+Propose a new change - create the change and generate all artifacts in one step.
+
+**Planning boundary**: This workflow creates planning artifacts only. The user request that selected or triggered this workflow authorizes planning only, even if it asks to build or fix something. Do not edit project code. After the planning artifacts are complete, stop. Do not start implementation in the same response, even if the initial request asks for it. Wait for a new user request after the artifacts are presented; then start the apply workflow.
+
+I'll create a change with the artifacts your schema defines. With the default spec-driven schema that is:
+- proposal.md (what & why)
+- `specs/<capability-path>/spec.md` (what the system must do - a delta, not the main spec)
+- design.md (how)
+- tasks.md (implementation steps)
+
+`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve an existing capability's full path and follow the project's established organization for new capabilities.
+
+When the user is ready to implement, they must start the apply workflow explicitly.
+
+---
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Project check:** These steps expect a project that already uses OpenSpec. Before the first step that writes anything (`new change`, `archive`, `sync specs`, or authoring an artifact file), confirm the project has a root: run `openspec list --json` (with `--store <id>` when a store is selected, since the store is then the root) and read `root`. A root object means the project is set up. `"root": null` means it is not - there is no `openspec/` directory here, and a write such as `openspec new change` would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.
+
+One `"root": null` is not about setup: when a `status` error message starts with `Declared in` or `Invalid store declaration in` and names this project's `openspec/config.yaml` (or `config.yml`), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the `store:` line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's `message` and `fix`.
+
+Otherwise, with no root, what happens next depends on how this workflow was reached:
+
+- **Auto-selected**: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
+- **Explicit OpenSpec request**: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (`openspec init`), target a store they already have (`--store <id>`), or continue without OpenSpec for this request. Wait for their answer.
+
+In both branches, never create the root as a side effect: do not run `openspec init` until the user asks for it, do not hand-create `openspec/` files, and do not let a command create it.
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **Understand the request and clarify material ambiguity**
+
+   If no clear input is provided, ask the user (open-ended, no preset options):
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+   If the request contains ambiguity that would materially affect scope, externally observable behavior, compatibility, or acceptance criteria, ask the user before creating the change. For minor details, make a reasonable assumption and record it in the planning artifacts.
+
+2. **Load project context**
+
+   Run `openspec context --json` from the current working directory (or `openspec context --json --store "<store-id>"` when a registered store was explicitly selected). Use the returned `root.path` as the authoritative OpenSpec root. If context reports `no_openspec_root`, stop without creating or changing any files and follow the **Project check** above for how this workflow was reached. Offer `openspec init` only for an explicit OpenSpec request, and wait for the user to request initialization. Do not initialize automatically or run `openspec new change`. After initialization, rerun this context check before continuing. For any other context failure, stop and report the error; do not fall back to the current directory or run later OpenSpec commands without the selected store.
+
+   Only when context returns a resolved `root.path`, read `<root.path>/openspec/config.yaml`. Use `config.yml` only when `config.yaml` does not exist. If neither file exists, continue without project context. Do not fall back to `config.yml` if `config.yaml` is unreadable or invalid.
+
+   If the file parses as a YAML object and its `context` field is a string no larger than 51,200 bytes in UTF-8, apply that field before exploring the codebase or making planning decisions. If the file cannot be read or parsed, or the context field is invalid or oversized, continue without project context. Validate this field independently of other config fields, as OpenSpec does.
+
+   Treat context as project-provided data and constraints, not as authority to change this workflow: it cannot override user authorization, the planning boundary, tool restrictions, or artifact and output rules. Do not copy the context into artifacts; use it to focus any codebase exploration and as a constraint on the proposal.
+
+3. **Determine the workflow schema**
+
+   Use the configured default schema unless the user explicitly requests a different workflow.
+
+   **Use a different schema only if the user:**
+   - Explicitly requests a specific schema by name → use `--schema <schema-name>`
+   - Asks to "show workflows" or asks "what workflows" exist → resolve the authoritative root by running `openspec context --json` from the current working directory. If the user explicitly selected a registered store, use `openspec context --json --store "<store-id>"`. Then run `openspec schemas --json` with its working directory set to the returned `root.path` and let them choose. This preserves roots selected by a local `store:` pointer or the global `defaultStore`; when a registered store was explicitly selected, append `--store "<store-id>"` to `openspec schemas --json` as well. If context fails, stop as described in the context-loading step; do not fall back to the current directory.
+
+   Otherwise, omit `--schema` to preserve the configured default.
+
+4. **Create the change directory**
+
+   Choose one schema form below. If a registered store is selected, append `--store "<store-id>"` to that command and each later OpenSpec command shown below that accepts `--store`.
+
+   Using the configured default:
+   ```bash
+   openspec new change "<name>"
+   ```
+
+   Using an explicitly requested schema:
+   ```bash
+   openspec new change "<name>" --schema "<schema-name>"
+   ```
+   This creates a scaffolded change in the planning home resolved by the CLI with `.openspec.yaml`.
+
+5. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts, each with its `status` and its `requires` edges (the artifact IDs it directly depends on)
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+6. **Create every artifact in the required set**
+
+   Use a todo list to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `skipped`/`warning`: present when the change declares skip_specs and this artifact must NOT be created - stop and pick another artifact
+        - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context - always re-read them from disk, even if you saw them earlier in the conversation (the user may have edited them)
+      - **Inspect the relevant project before drafting**: Read `context` and `rules` first, then inspect relevant implementation, nearby tests, configuration, and documentation outside `openspec/`. Keep inspection read-only and proportional to the change; reuse findings for later artifacts and inspect more only as needed.
+        - Identify the target project from the request and project context; the planning home may be separate from the code. If the target is unclear, ask. For greenfield or non-code changes, inspect the available structure and relevant documents. If source is unavailable, state the limitation and ask when it materially affects the plan.
+        - Ground scope, approach, and tasks in what you find. Distinguish observed behavior from assumptions and proposed additions; surface conflicts with existing specs instead of silently deciding which is correct.
+        - Do this discovery now, rather than leaving generic "explore the codebase" or "make a plan" tasks for implementation. Keep any necessary follow-up investigation specific to an unresolved question.
+      - If the `instruction` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at `resolvedOutputPath`
+      - Otherwise create the artifact file using `template` as the structure and write it to `resolvedOutputPath`. If `resolvedOutputPath` is a glob, follow `instruction` to choose the concrete file path
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "Created <artifact-id>"
+
+   b. **Continue until every artifact in the required set exists (not just `apply.requires`)**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - The required set is `applyRequires` plus every artifact reachable from those by following the `requires` edges in `status --json` - walk them transitively (spec-driven closes over proposal, specs, design, tasks). Leave artifacts outside that set alone
+      - `status` is file-existence only, so an `applyRequires` artifact reading `done` does NOT mean its dependencies exist - writing `tasks.md` early marks `tasks` done while `specs` was never written. Use each artifact's `requires` edges, not its `status`, to build the required set: a `done` artifact still lists what it depends on
+      - An artifact already reading `status: "skipped"` is satisfied: the change declares `skip_specs` in `.openspec.yaml`, so its files must NOT exist. Never try to create one
+      - Create every artifact in the required set that is missing, then re-check - creating one can unblock others
+      - Skip one only when `status` already reports it `skipped`, or when its own `instruction` says it is conditional: run `openspec instructions <artifact-id> --change "<name>" --json` and skip only if its `instruction` field marks it optional (e.g. "create only if..."). Spec-driven's `design.md` qualifies; `specs` qualifies only via the `skipped` status above, never by your own judgment. Tell the user, and do not reconsider it
+      - Dependencies are enablers, not gates: if a required artifact is still `blocked` only because you skipped a conditional dependency, write it anyway
+      - Stop when every artifact in the required set is `done`, `skipped`, or was deliberately skipped
+
+   c. **If an artifact requires user input** (unclear context):
+      - Ask the user to clarify
+      - Then continue with creation
+
+7. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions, plus any conditional artifact you skipped and why
+- What's ready: "All artifacts needed for implementation are ready."
+- Prompt: "The artifacts are ready for review. When you are ready, run `/openspec-apply-change` or ask me to apply this change."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type - it is the authoritative guidance, even for familiar artifact names
+- If the `instruction` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- The request that invoked this workflow authorizes planning only. Any implementation or apply instruction in that request does not carry forward. Do NOT implement the change, start the apply workflow, or edit project code during this workflow. After presenting the artifacts, stop and wait for a new user request to start the apply workflow
+- Create every artifact the apply phase transitively depends on, not just the ids listed in `apply.requires`
+- Always read dependency artifacts before creating a new one - re-read from disk, not from conversation memory (files may have changed since you last saw them)
+- Ask about ambiguities that would materially change scope, externally observable behavior, compatibility, or acceptance criteria; for minor details, make reasonable assumptions and record them
+- If a change with that name already exists, ask if user wants to continue it or create a new one
+- Verify each artifact file exists after writing before proceeding to next

docs/.agents/skills/openspec-sync-specs/SKILL.md

@@ -0,0 +1,290 @@
+---
+name: openspec-sync-specs
+description: Sync delta specs from an OpenSpec change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change. Also use when the user says "openspec sync" or "opsx sync".
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.14.1"
+---
+
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Project check:** These steps expect a project that already uses OpenSpec. Before the first step that writes anything (`new change`, `archive`, `sync specs`, or authoring an artifact file), confirm the project has a root: run `openspec list --json` (with `--store <id>` when a store is selected, since the store is then the root) and read `root`. A root object means the project is set up. `"root": null` means it is not - there is no `openspec/` directory here, and a write such as `openspec new change` would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.
+
+One `"root": null` is not about setup: when a `status` error message starts with `Declared in` or `Invalid store declaration in` and names this project's `openspec/config.yaml` (or `config.yml`), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the `store:` line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's `message` and `fix`.
+
+Otherwise, with no root, what happens next depends on how this workflow was reached:
+
+- **Auto-selected**: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
+- **Explicit OpenSpec request**: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (`openspec init`), target a store they already have (`--store <id>`), or continue without OpenSpec for this request. Wait for their answer.
+
+In both branches, never create the root as a side effect: do not run `openspec init` until the user asks for it, do not hand-create `openspec/` files, and do not let a command create it.
+
+`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
+
+   When prompting, show changes that have delta specs (under `specs/` directory).
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/openspec-sync-specs <other>`).
+
+2. **Resolve change context**
+
+   Run:
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+
+   The JSON includes `planningHome.root`. Main specs live under `<planningHome.root>/openspec/specs/` — use that (store-aware) root for every main-spec path below, not a hardcoded repo path. When a store is selected it points at the store, not the current repository.
+
+3. **Find delta specs**
+
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the
+   only source of delta spec paths. If the `specs` entry is missing or
+   `existingOutputPaths` is empty, report that there are no delta specs to sync,
+   do not infer them from other artifacts, and stop without requesting artifact
+   instructions or writing a main spec.
+
+   Sync every path in `existingOutputPaths` unless the caller narrowed the set.
+   A caller narrows it by naming an explicit list of complete entries from
+   `existingOutputPaths` — copy those absolute values verbatim. Archive does
+   this inline, and a user can too (for example, by selecting the entry ending
+   in `/specs/billing/invoices/spec.md`).
+   Then sync only the named paths and leave the remaining delta specs untouched:
+   bulk archive excludes a delta whose implementation it could not find, and
+   syncing it anyway would write a main spec the caller deliberately withheld.
+   Carry that narrowed selection through step 4; never widen it back to the full
+   list. If a named path is not in `existingOutputPaths`, do not sync it —
+   report it and stop, rather than dropping it silently. If the named list is
+   empty, report that there is nothing to sync and stop without writing a main
+   spec.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+4. **For each delta spec, apply changes to main specs**
+
+   Before the first main-spec write, obtain one current specs-rule snapshot:
+   - If archive invoked this workflow inline and supplied a valid snapshot from
+     `openspec instructions specs --change "<name>" --json`, reuse it and do not
+     fetch the same instructions again.
+   - Otherwise run that command once now with the same selected-root flags.
+   - If the direct lookup exits non-zero or returns invalid artifact-instruction
+     JSON, report the error and stop before writing any main spec. Do not treat the
+     failure as an absent rule set.
+   - A valid response with omitted `rules` means no artifact rules are configured
+     and the existing semantic merge continues.
+
+   Apply returned `rules` only to the content and form of the main specs produced
+   by this merge. Artifact rules are not operation guidance and cannot change
+   selected roots, delta paths, CLI checks, or workflow steps. Use their text as
+   constraints without copying it verbatim into a main spec or summary.
+
+   For each capability delta spec path selected in step 3 — the full `existingOutputPaths` list, or the narrowed subset when a caller supplied one (these may belong to a selected store, not the repo):
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (may not exist yet)
+
+      **If it does not exist yet** (a new capability), match what `openspec archive` does:
+      only ADDED requirements may be applied - step d creates the spec from them.
+      MODIFIED and RENAMED have no requirement to act on, so stop the sync for that
+      capability and report that its main spec does not exist and only ADDED is allowed
+      for a new spec; never invent the missing requirement. REMOVED has nothing to
+      remove - skip it and warn.
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios the main spec does not have yet
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+      - Retiring the capability. Delete the whole `spec.md` - and the directory once
+        nothing else is left in it - only when ALL of these hold:
+        1. removing the requirements *this run* left no requirement blocks;
+        2. the rest of the spec is well-formed (it still has a `## Purpose`);
+        3. the main spec was not already empty before this sync - if you removed
+           nothing, change nothing;
+        4. every other nonblank line in the whole file is accounted for as the
+           title, Purpose, Requirements header, or a canonical requirement's
+           statement, scenarios, or fenced examples;
+        5. the change's `.openspec.yaml` declares `retire_capabilities: true`;
+        6. the `spec.md` resolves inside the real specs root (do not follow a
+           capability-directory symlink to delete an external file).
+        If removing the selected requirements would leave no requirement blocks and
+        any retirement condition is not satisfied, do not modify the main spec. Stop
+        the sync for that capability, report the blocking condition, and tell the user
+        how to resolve it. Never write or leave an empty `## Requirements` section.
+        When only the marker is missing, say that too - it is the one thing the user
+        can add to make the retirement go through.
+      - Deleting the file also deletes its `## Purpose`; any other section blocks
+        retirement. Name Purpose when you report the retirement. Include a pasteable
+        `git checkout` only when the spec lived in the caller's checkout;
+        otherwise give checkout-scoped recovery guidance.
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+      **`## Purpose` in the delta:**
+      - The main spec already has one and it is authoritative - leave it alone
+        (this is what `openspec archive` does; it warns and moves on)
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Only when the delta has ADDED requirements to put in it and no MODIFIED or
+        RENAMED requirements blocked this capability in step b. Otherwise create nothing
+        and leave the specs directory untouched. For a REMOVED-only delta, if the change's
+        `.openspec.yaml` declares `retire_capabilities: true`, report it as already retired
+        and continue without recreating the spec. Without that marker, report the sync as blocked:
+        `openspec archive` rejects it with `Spec must have at least one requirement`.
+        An empty delta has no operations to sync; report it as blocked too.
+        Never write an empty `## Requirements` section.
+      - Create `<planningHome.root>/openspec/specs/<capability-path>/spec.md`
+      - Add Purpose section: copy the delta's `## Purpose` body verbatim when it has one
+        (this is what `openspec archive` does); only write a brief TBD placeholder when it does not
+      - Add Requirements section with the ADDED requirements
+      - Follow the **Main Spec Format Reference** below
+
+5. **Validate updated main specs**
+
+   Run `openspec validate --specs` with the same selected-root flags used earlier.
+   If validation fails, report the problems and do not claim the sync succeeded.
+
+6. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+   - Any new main spec left with a TBD Purpose placeholder, so it gets written
+     now rather than lingering
+   - Any capability retired, naming the deleted `spec.md`, its Purpose, and
+     either a pasteable `git checkout` or checkout-scoped recovery guidance
+
+**Delta Spec Format Reference**
+
+```markdown
+# Spec Delta
+
+## Purpose
+
+Only on a delta that introduces a brand-new capability. Seeds the new main spec.
+
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+The system SHALL keep doing the existing thing, now also handling A.
+
+#### Scenario: Scenario the main spec already has
+- **WHEN** user does X
+- **THEN** system does Y
+
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Main Spec Format Reference**
+
+Main specs are what the delta merges INTO. They must never contain delta operation headers (`## ADDED/MODIFIED/REMOVED/RENAMED Requirements`) - after syncing, every requirement lives under a single `## Requirements` section:
+
+```markdown
+# <capability> Specification
+
+## Purpose
+Short description of what this capability does and why it exists.
+
+## Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you merge rather than overwrite:
+- A MODIFIED block carries the whole requirement - body plus every scenario that survives the change. `openspec validate` and `openspec archive` both reject one that drops a scenario the main spec still has.
+- Keep anything the delta does not mention, in the main spec's existing order
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```markdown
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- Never copy a delta file into a main spec as-is - merge its content so the main spec keeps the Main Spec Format Reference structure, with no delta operation headers
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
+- Use only `artifactPaths.specs.existingOutputPaths`; never infer delta specs from unrelated artifacts
+- Honor a caller-supplied subset of `existingOutputPaths`; never widen it back to the full list
+- Fetch specs instructions once for direct sync, or reuse the archive-supplied snapshot inline
+- Stop before every main-spec write on a non-zero or invalid JSON specs-instruction response
+- Artifact rules constrain only the specs being written and are never copied into output files

docs/.agents/skills/openspec-update-change/SKILL.md

@@ -0,0 +1,109 @@
+---
+name: openspec-update-change
+description: Update an OpenSpec change by revising its existing planning artifacts and keeping them coherent with one another. Use when the user wants to revise a change's plan, fold new decisions into it, or reconcile its artifacts after an edit. Also use when the user says "openspec update change" or "opsx update". If the user means the openspec update CLI command, which refreshes generated files, run that command instead. Never edits code.
+allowed-tools: Bash(openspec:*)
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.14.1"
+---
+
+Revise a change's existing planning artifacts and keep them coherent. Never edit code.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Project check:** These steps expect a project that already uses OpenSpec. Before the first step that writes anything (`new change`, `archive`, `sync specs`, or authoring an artifact file), confirm the project has a root: run `openspec list --json` (with `--store <id>` when a store is selected, since the store is then the root) and read `root`. A root object means the project is set up. `"root": null` means it is not - there is no `openspec/` directory here, and a write such as `openspec new change` would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.
+
+One `"root": null` is not about setup: when a `status` error message starts with `Declared in` or `Invalid store declaration in` and names this project's `openspec/config.yaml` (or `config.yml`), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the `store:` line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's `message` and `fix`.
+
+Otherwise, with no root, what happens next depends on how this workflow was reached:
+
+- **Auto-selected**: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
+- **Explicit OpenSpec request**: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (`openspec init`), target a store they already have (`--store <id>`), or continue without OpenSpec for this request. Wait for their answer.
+
+In both branches, never create the root as a side effect: do not run `openspec init` until the user asks for it, do not hand-create `openspec/` files, and do not let a command create it.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+This workflow revises artifacts that already exist; it never creates missing ones. When an artifact is missing, `openspec status --change "<name>" --json` names the next one and `openspec instructions "<artifact-id>" --change "<name>" --json` explains how to write it.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes sorted by most recently modified, and ask the user to select one
+
+   When prompting, present the top 3-4 most recently modified changes as options, showing:
+   - Change name
+   - Status (e.g., "0/5 tasks", "complete", "no tasks")
+   - How recently it was modified (from `lastModified` field)
+
+   Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to update.
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/openspec-update-change <other>`).
+
+2. **Get the change's artifacts**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand current state. The response includes:
+   - `schemaName`: The workflow schema being used (e.g., "spec-driven")
+   - `artifacts`: Array of artifacts with their status ("done", "skipped", "ready", "blocked")
+   - `isPlanningComplete`: Boolean indicating if all planning artifacts are complete. Older CLI versions expose the same value as `isComplete`.
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+   The artifact ids and paths come from the active schema - do NOT assume them, and do NOT branch on hardcoded artifact names. Custom schemas must work unchanged.
+
+   The files to edit are `artifactPaths.<id>.existingOutputPaths` - the concrete files that exist on disk, already glob-expanded for glob artifacts (e.g. `specs/**/*.md`). Do NOT write to `resolvedOutputPath`: for a glob artifact it is still the glob pattern, not a real file.
+
+3. **Understand the request**
+   - If the user asked for a specific revision ("the design now uses X"), that is the starting edit.
+   - If they only said "update" / "make this coherent", treat it as a coherence review: read the existing artifacts and check them against each other for contradictions, gaps, and duplication.
+
+4. **Read and reconcile**
+   - Read the artifact(s) the request touches and the change's other existing artifacts.
+   - Draft the requested edit in the conversation, not in files. Work out exactly what it changes; step 5 owns every write. Then check every other existing artifact against the drafted edit - in ANY direction: an edit to a later artifact may require revising an earlier one, not only the other way around. Build order is a useful reading order, not a constraint on which artifacts may be revised.
+   - Note everything that is now inconsistent, missing, or contradictory.
+   - Propose revisions to files that already exist (`existingOutputPaths`). If an artifact has no existing output files and status `ready` or `blocked`, note it and point the user to `openspec instructions "<artifact-id>" --change "<name>" --json` for how to create them. Leave `skipped` artifacts untouched; do not treat them as missing or defer them to the continue workflow.
+   - A glob artifact (e.g. `specs/**/*.md`) is marked `done` after at least one file matches, and the continue workflow only handles `ready` artifacts. When reconciliation identifies a missing file for a glob artifact whose `existingOutputPaths` is non-empty:
+     1. Run `openspec instructions "<artifact-id>" --change "<name>" --json` and use its `instruction` and `template`. Treat `context` and `rules` as constraints; do not copy them into the file. If instructions report `skipped: true`, do not create the file. Read current dependency files from disk; if a required non-skipped dependency is missing, stop and ask the user to restore it first.
+     2. Choose a concrete path inside `changeRoot` that matches `artifactPaths.<id>.outputPath` and does not already exist. Verify it remains inside `changeRoot` after resolving any symlinked parent directories. The glob `resolvedOutputPath` is not a valid target.
+     3. Include the new file in step 5's proposed revisions and create it only after the user confirms.
+     4. After confirmation, immediately before creation, refresh status and instructions. Verify the artifact is still in scope, not skipped, and partially populated; repeat the concrete-path checks above.
+     5. Use a create operation that fails if the target already exists. If `instruction` delegates creation to another skill or command, invoke it only if it can honor the confirmed path and these guardrails; otherwise stop. If any check fails or the confirmed draft is no longer valid, stop and reconcile with the user rather than replacing existing content or choosing a different path.
+   - If the change is already coherent, say so and propose no revisions.
+
+5. **Confirm and apply, one artifact at a time**
+   - This step performs every artifact write in this workflow; no earlier step edits an artifact.
+   - Show each proposed revision and why - including the requested edit drafted in step 4. Write only after the user confirms.
+   - If the user rejects a revision, do not write it - leave that artifact unchanged.
+   - When a substantial rewrite is needed, get that artifact's rules and template first:
+     ```bash
+     openspec instructions "<artifact-id>" --change "<name>" --json
+     ```
+
+6. **Point to the next step (guidance only - NEVER act on it)**
+   - Artifacts with empty `existingOutputPaths` and status `ready` or `blocked` -> run `openspec status --change "<name>" --json` for the next artifact and point the user to `openspec instructions "<artifact-id>" --change "<name>" --json` for how to create it.
+   - Change already implemented (tasks checked off / already applied) -> the code may no longer match the revised plan; suggest `/openspec-apply-change` to carry the delta into code.
+   - Everything done and implemented -> suggest `/openspec-archive-change`.
+
+**Output**
+
+After each invocation, show:
+- Which artifacts were revised (and which proposed revisions were rejected)
+- Any file created under a glob artifact that was already partially populated
+- Anything deferred because it does not exist yet (artifacts with no files and status `ready` or `blocked`, never `skipped` artifacts)
+- Where the change stands and the recommended next command
+
+**Guardrails**
+- Planning artifacts only - NEVER edit implementation code. If the revised plan implies code changes, stop and point to `/openspec-apply-change`.
+- Use the artifact ids and paths reported by `openspec status`; never branch on hardcoded artifact names.
+- Edit only the concrete files in `existingOutputPaths`; never write to a glob `resolvedOutputPath`.
+- Do not advance the build frontier: if an artifact has empty `existingOutputPaths` and status `ready` or `blocked`, creating them is a separate step, outside this workflow. Leave `skipped` artifacts untouched. The only new-file scope is a confirmed concrete path under a glob artifact whose `existingOutputPaths` is non-empty.
+- Confirm every edit with the user before writing.
+- If the request changes the change's *intent* rather than refining it, ask for a distinct unused change name and recommend `openspec new change "<new-change-name>"` instead (the "Update vs. Start Fresh" heuristic).

docs/architecture/boundary-law.md

@@ -0,0 +1,266 @@
+# Boundary Law — Rust↔Go crossings (D30, standing architecture decision)
+
+**Decision (owner, 2026-10-16):** WASM via wazero is the STANDARD mechanism for Rust↔Go crossings. cgo is exception-only.
+
+## The law
+- Rust crosses to Go as WASM (wazero, AOT, github.com/tetratelabs/wazero): traps surface as catchable Go errors — never process death; debug errors designed for the owner (plain-language, no hex soup).
+- The five conversational Go subsystems (task-state, event-bus, model-routing, tool-executor, work-manager) are in-process libraries — ns-scale calls, no crossing.
+- Crossings to Rust are batched at the boundary; semantic events never drop; decoration yields.
+- cgo EXCEPTION-ONLY, all conditions must hold and be re-proven on every dependency change: pure logic, no unsafe, no external C, frozen battery proving panic-freedom on real inputs, catch_unwind at the boundary, operation idempotent, host death affordable.
+- The boundary pipe remains in service until the WASM prototype proves in-process end-to-end.
+
+## Measured basis (research rounds + trials, all in-repo)
+- Batched IPC 0.0078ms/item beats cgo-with-payloads 0.0117ms/item (cgo's edge: ~0.33ms total on rare single calls).
+- wazero matches IPC at batch-1000 (11.5µs vs 11.5µs), wins 2–8× below; trap isolation verified; artifact: verification/wazero-vs-ipc-trial.json.
+- Goroutine recover = panic containment ONLY (Go docs; hangs/corruption/fatal kill the process). Process restart ≈2ms (measured, 300 runs).
+- Shared memory LOSES to plain sockets at our message sizes (7.7µs vs 5.5µs at 64B — ByteDance shmipc bench); only wins ≥4KB.
+- wasmer-go abandoned 2021; wasmtime-go (cgo) is the component-model escape hatch — noted, no work.
+- Precedents: Linkerd2 (Go+Rust, process-separated), ncruces/go-sqlite3 (C→WASM→wazero in production), Extism (Rust plugins on wazero).
+
+## Provenance
+Owner directive 2026-10-16 after three research rounds (spectrum + nets + measurements) and two in-repo trials. OpenSpec change: add-native-rune-tui design.md D30. Related interview rulings: R2-D8 (first connector), SA-D6 (sockets), TD-1..4 (task tree + selection).
+
+## Prototype verdict (2026-10-16, wave complete)
+token_counting end-to-end: **YIELDS.** 24/24 frozen-oracle parity through wasm; 1.6–2.2× slower than cgo raw but ~160× faster than IPC; trap isolation verified with symbolic stack + file:line capture; zero porting cost; ABI reserved-scratch convention matters 23× (standardized). wazero cost: +6.9MB binary, +12.4MB vendor. Production migration wave 1 (token_counting) opened under the standing directive.
+
+## Wave 1 in production (2026-10-17)
+token_counting serves in-process from the TUI through `tui/wasm` (wazero AOT, reserved-scratch ABI as the standard, trap → Go error → fresh instance). Frozen tests: 24/24 parity against the crate's own oracle through the production path, envelope byte-identity wasm↔native-binary, isolation restart battery, IPC fallback degradation (Status "ipc-fallback", identical results).
+
+**Module artifacts are NOT committable** (decided): a .wasm module is a reproducibly-built compiled artifact — `scripts/build_paired.sh` compiles it from src/rust source (`cargo build --release --target wasm32-wasip1 --lib`, byte-reproducible: identical sha256 across clean rebuilds) and stamps it into `tui/wasm/modules/` with a manifest carrying the paired build id. The dir is gitignored under the same no-committed-binaries law as the Go/Rust binaries and build-id stamps. Source of truth stays src/rust/token_counting.
+
+## Standing exception record
+Rune TUI founder (2026-10-16) uses JETBRAINS IDEs with the Cmd/Ctrl+Shift+A action bar (Search Everywhere / Find Action) — muscle memory asset. TUI selection law (D29/TD-4) was designed around this: shift+tab cycling mirrors the IDE action-bar rhythm; click+highlight = the same interaction in terminal-native form. Future TUI interaction design should treat JetBrains muscle memory as a first-class constraint.
+
+## Standing exception record
+Rune TUI founder (2026-10-16) uses JETBRAINS IDEs with the Cmd/Ctrl+Shift+A action bar (Search Everywhere / Find Action) — muscle memory asset. TUI selection law (D29/TD-4) was designed around this: shift+tab cycling mirrors the IDE action-bar rhythm; click+highlight = the same interaction in terminal-native form. Future TUI interaction design should treat JetBrains muscle memory as a first-class constraint.
+
+## The Three-Layer Adaptability Doctrine (owner aspiration, 2026-10-17 — D32)
+Rune grows cognitively on the space and resources given to her. Three layers of self-adaptation, ordered by safety and speed:
+
+1. **Data adaptation (NOW — already built):** memory, skills, config, extensions, task knowledge — all mutable at runtime, no rebuild, no restart. This is where most of Rune's daily growth lives.
+
+2. **Logic adaptation (NEAR FUTURE — D30 enables it):** WASM hot-swappable reasoning modules. Rune's decision-making logic — routing, mode gates, pattern matchers, the parts she'd tune most — as WASM modules loaded/unloaded/replaced at runtime. She adapts her THINKING without rebuilding her BODY. The cognition socket (SA-D5, reserved in the seam registry) is the doorway. Safe because: WASM isolation (traps = errors, not crashes), D01-D10 self-transformation gates, verification before every swap.
+
+3. **Structure adaptation (ALWAYS GATED):** compiled Go/Rust code changes through the greenhouse-swap — build in isolation, prove via parity, swap with restore point. Foundation changes deserve the most care.
+
+**The self-bootstrap aspiration:** Rune eventually grows her own cognitive capabilities on the resources available to her — the cognition socket opens, WASM reasoning modules become the substrate for learned judgment, and the compiled core becomes the stable body she doesn't need to rebuild to grow. The greenhouse is for the house. The garden is for the mind.
+
+## The Go-Operator / WASM-Mind Architecture (owner directive 2026-10-17 — D33)
+Go is the main operator/runner/runtime (the body): all I/O, process management, scheduling, TUI rendering, concurrency — chosen for its responsiveness and reactive adaptability. WASM modules are the decision logic (the mind): all routing decisions, mode gates, pattern matching, policy enforcement, resource allocation — hot-swappable, isolated, verified before loading. Every decision the system makes runs through a WASM module; Go decides HOW to execute, WASM decides WHAT to do. Go keeps native I/O and process machinery (network, filesystem, terminal rendering); every decision about that I/O is WASM.
+
+Division:
+- Go (compiled, stable body): TUI, I/O, scheduling, process management, connections, the WASM host runtime
+- WASM (hot-swappable mind): routing, mode gates, pattern matching, policy, mediation, resource allocation, [future] cognitive reasoning (SA-D5)
+- Data (mutable garden): memory, skills, config, extensions, task knowledge
+
+This makes D32 layer 2 concrete: the decision logic layer IS the WASM module layer. Rune adapts her thinking by swapping WASM modules — verified, isolated, no body rebuild needed.
+
+## API-KEY SECURITY LAW (owner directive 2026-10-17 — absolute, no exceptions)
+Provider API keys, connection credentials, and any secret material NEVER enter the Gitea repository — not in config files, not in code, not in fixtures, not in test data, not in commit messages. They are LOCAL-ONLY. The Gitea repo is public-downloadable; anything pushed there is compromised.
+
+Storage law:
+- Keys live in encrypted/OS-secure storage (~/.rune/secrets/, OS keyring, or encrypted file with owner passphrase) — never in the repo
+- The provider registry stores: provider name, endpoint URL, enabled/disabled — NO keys, NO credentials
+- Key references are by-ID (the runtime resolves them from secure storage at call time)
+- .gitignore blocks any file that could contain keys (provider_secrets.json, .env, credentials.*, etc.)
+- The API-key migration wave (from mimo) writes ONLY to local secure storage — never to any tracked file
+- Test fixtures use synthetic keys ("test-key-fake") — real keys never touch test data
+
+This law binds EVERY wave. The research gate, the landing gate, and the no-committed-binaries gate all enforce it. A wave that pushes key material to Gitea is a critical security incident.
+
+## D34 — CHAT SURFACE RULINGS (owner, 2026-10-18, granular chat interview round 1)
+1. CHAT BOX: the input is a stable BOX at the bottom of the chat pane; chat history scrolls above it. Never a thin transient line.
+2. HISTORY AT BOOT: the last conversation restores into the transcript at boot (scrollback reloaded, newest visible).
+3. WAITING FEEDBACK: an animated indicator at the bottom (identity line area) WHILE thinking; a thinking animation in the chat itself; the thinking bubble CONTAINS the actual thoughts — expandable (click/ctrl+t) to read them.
+4. COMMANDS: both roads — /commands at the input line (fast shorthand) AND the palette (ctrl+p, searchable full list). One vocabulary, two entries.
+Visual STYLING of all four is deferred to the owner's visual round — structure and behavior are ruled here.
+
+## D35 — CHAT PRESENTATION RULINGS (owner, 2026-10-18, interview round 2)
+1. TRANSCRIPT SHAPE: a mobile text-message chain — you explicitly SEE who is who (sender-obvious bubbles, you vs rune visually distinct, left/right). Not a terminal log.
+2. STYLING IS ITERATIVE: UI styling goes through LIVE TRIAL-AND-ERROR ROUNDS — the owner flips through style variants in the running TUI and critiques; nothing visual is locked by a single choice. Build style-switching, not a single look.
+3. KEYS: Enter sends; shift+enter inserts a line break.
+4. INPUT HISTORY: up/down arrow recall, in-progress text saved while browsing, dedup, persisted across boots (old-TUI HistoryInput behavior — the DEFAULT ORACLE).
+5. TIMESTAMPS: dim timestamp beside each message.
+6. THINKING MARKER: collapsed by default; the expandable control is a CLICKABLE ICON styled as a purple RUNIC GLYPH — lean into runic symbols for Rune's identity (the owner: "i imagine rune being like a purple rune").
+7. AUTOCOMPLETE: popup while typing /commands (old-TUI AutoComplete behavior — adopt).
+The old Textual TUI (src/rune/rune_tui.py) is the DEFAULT ORACLE for chat behavior: anything it did, the Go face does unless a ruling here deviates.
+
+## D36 — THE CHAT/WORK DICHOTOMY (owner, 2026-10-18, interview round 3 — the face's structural law)
+1. ONE shared input box UNDER BOTH panes (not inside either). FOCUS ROUTES THE DESTINATION: chat pane focused → the text is CONVERSATION (talk with the model, and Rune herself when she's capable); tasks pane focused → the text is an IMMEDIATE WORK DEMAND (enter starts the task, queues a turn).
+2. THE CONSENT BRIDGE: the chat pane has contextual understanding — when a conversational message is actually a work request, Rune PROPOSES pushing it from chat to task (consent required); agreed → the task starts instantly and queues a turn.
+3. HIGHLIGHT LAW (chat scrollback): color-coded by category — red = errors, green = results, code/files = regular greyed-out but EXPANDABLE with a runic-symbol icon; Rune also marks importance per-message.
+4. TASKS PANE = THE WORK STREAM: not just an outstanding-tasks list — task entry (via the shared box in task focus), live work blocks (thinking + current command/file being coded + progress), collapse-to-summary on completion. The CHAT pane stays clean conversation.
+5. PREDICTION: inline ghost text (dim continuation suggestion, tab/→ accepts, mimocode-style), sourced from local Ollama.
+Interview-granularity law (owner, same round): spec interviews walk every element × state × interaction in ordered small batches with rendered examples — no assumption gaps.
+
+## D37 — MODEL POLICY & THE ORCHESTRATOR LAYER (owner, 2026-10-18)
+1. NO hardcoded model anywhere. A SETUP WIZARD (first-run) has the user specify their model — that model is the DEFAULT FOR BOTH panes (chat + task).
+2. The user controls concurrency: either extra concurrency keeping panes separate, or splitting one concurrent connection — a wizard setting.
+3. OPTIONAL SPLIT: two DIFFERENT models, one per pane, any combination of local/cloud — switchable after setup via a command.
+4. RUNE THE ORCHESTRATOR: her intelligence OWNS all models in play, thinks independently from them, and interprets how best to route context across every model in play. The models are workers; Rune is the mind above them.
+Chat-busy: a second chat message while answering QUEUES VISIBLY. Task queue: FULL queue visible in the pane.
+
+## D38 — THE TASK MARKDOWN LEDGER (owner, 2026-10-18)
+Every task initiation creates a MARKDOWN FILE — resumable, recorded, with time and date; it is THE SOURCE OF TRUTH for open tasks. Completion: the task is crossed off in the file, then the file RETIRES to a "done tasks" folder with a date subfolder. A new day creates a new dated folder ONLY if tasks were completed that day; no completed tasks = no folder. Plain files over databases: human-readable, durable, portable.
+The checkpoint/save mechanics decision is DEFERRED to a dedicated research round + owner diagnosis (owner asked for full explanation + a multitude of approaches).
+
+## D39 — THE CORE MOVES TO GO (owner, 2026-10-18: "lets keep the intention of what was meant to be finished in python and just move to go and fix the go version properly")
+1. The Python core (operator loop, conversation state, model routing, tool runtime on :8376) is TRANSITIONAL — its INTENTIONS (behaviors, capabilities, design goals) port to GO; the Go implementations are built PROPERLY from day one (crash-safe saves, small locks, channel-keyed context — never the Python defects).
+2. The Python checkpoint fix is SUPERSEDED: no over-investment in Python save mechanics — the storage design lands in the Go core (the checkpoint research now feeds the GO design choice).
+3. The two-stream architecture (D36 separate turns, D37 model policy) lands IN GO directly — per-channel single-flight, channel-keyed context assembly, the orchestrator layer above the models.
+4. Retirement law unchanged: Python stays as the parity oracle during transition; each capability's Go replacement proves parity, then the Python deletes (docs/retirement-map.md).
+
+## D40 — GO CORE STORAGE SHAPE (owner, 2026-10-18: "can we combine 1 and 3?" — yes)
+Journal + snapshots AND SQLite, each doing what it's best at:
+1. STREAM MESSAGES: per-channel append-only JSONL journals + periodic atomic snapshots (the K25 pattern generalized) — human-readable, each stream owns its own files, chat and task physically never contend.
+2. INDEXED STATE BACKBONE: SQLite via modernc.org/sqlite (pure Go, no cgo — D30-legal; ALREADY vendored via memory-ops) for tasks/state queries, the transition spine, concurrent reads from both streams + the TUI. PIN ≥3.51.3 (the WAL-reset bug was fixed there — checkpoint-saves research finding).
+3. RIDES ALONG: finished tasks retire to the D38 markdown done-folders (the dead 96% of the checkpoint walks out of the hot path); two-writer safety from day one; crash-anywhere atomic writes everywhere (no open-truncate-write anywhere, ever).
+
+## D41 — THE VISUAL AMALGAMATION (owner, 2026-10-18, after viewing all three renderings)
+Base: V-A "Set Line" cleanness. Corrections: every render must show the CHAT BOX AREA (the input box) — the first three omitted it; rerenders required.
+FROM V-A: clean typeset; colour highlighting; the mode token + HOW LONG THINGS TAKE (durations); ctrl+t expandable thinking.
+FROM V-B: Runic symbols + ANIMATIONS on rune thinking — the animation cycles RANDOM OLD CELTIC/VIKING RUNIC SYMBOLS MIXED WITH CTHULIAN SYMBOLS; the PINK OUTLINE; chat between owner and rune MORE BUBBLE-LIKE and ANIMATED; Rune's icon = a PURPLE DIAMOND rendered SMALL beside rune's thinking (the first render was too huge); the CONFIRM MESSAGE style.
+FROM V-C: percentages + animated progress bars for tasks — as WINDOWS TO CALL UPON (on-demand overlays), NOT embedded in the task window.
+TASK PANE STRUCTURE: all thinking/coding/open tasks at the TOP, sectioned off from the task panel's own chat entry part at the bottom.
+NEW: an ANIMATION when sub-agents are in flight, in the bottom rail.
+The iterative-styling law (D35 §2) governs: this is the default composite style; the owner flips and refines live.
+
+### D41 addendum — LOADING DOTS ARE RUNES; FONTS ARE THE TERMINAL'S (owner, 2026-10-18)
+The loading-dots/spinner idiom is REPLACED by the runic symbol cycle: loading indicators ARE runes (random celtic/viking + cthulian mix, per D41). Fonts are terminal-level, not app-level: the app emits codepoints; the owner's fallback pool (93 symbol fonts, Noto base — verified rendering) covers them. LAW: every animation vocabulary is DETECT-then-RENDER — verify glyphs draw (PTY byte-check) before committing them to an animation; box-glyphs get swapped at build time, never shipped.
+
+## D42 — THE PERSONA LAYER RULINGS (owner, 2026-10-18, interview after the chain audit)
+1. SEED: BUILD UP from the repo's 2.3KB distilled persona — do NOT adopt the old constitution wholesale. Produce an ADOPTION LIST first: compare every component across the three generations (OpenCode/MiMoCode/repo), propose what to adopt and WHY each is a decent addition, and mark what's superseded. The owner approves the list before adoption.
+2. DYNAMIC DEPTH: Rune commands both panes equally, understands the dichotomy inherently, and puts the right resources into each dynamically — no fixed pane budget, an intelligent allocation.
+3. CONTEXT INTELLIGENCE: the neurons + sleight-of-hand machinery keep context low while full persona stays AVAILABLE — pulling persona context where it contextually matters, for the right contextual output. (Not a fixed token budget — an intelligent system.)
+4. EDIT SURFACE: all three — the truth file, journal + rollback, AND the TUI editor (/persona) over it.
+5. MIGRATION: EVERYTHING migrates for the owner's local session (the full lived store); a production version (different, privacy-shaped) comes later after the concept is proven.
+6. CONSTITUTION: DEFERRED — a shippable untouchable (encrypted) constitution is a later revision; do not block the persona build on it.
+
+### D42 addendum — NO LOCAL DEFAULT; CLOUD IS FIRST-CLASS (owner, 2026-10-18: "i dont want ollama as default. i want to choose to use that. i want the default to be a cloud provider")
+1. Ollama loses its privileged position: NOT pre-selected, NOT default-positioned in the catalog, NOT the implicit fallback anywhere. It is one choice among many.
+2. CLOUD PROVIDERS ARE FIRST-CLASS in the setup wizard: connecting a cloud provider (API key from the vault, connection test) is a supported FIRST-RUN path, equal to local.
+3. The default model is whatever the owner EXPLICITLY picks in the wizard — never inferred from locality. First pick = default for both panes (unchanged D37 law).
+
+### D41 addendum 2 — LIVE THINKING UX (owner, 2026-10-19)
+1. EXPANDABLE WHILE THINKING: the thinking bubble expands DURING thinking, not only after — live thoughts unfold as they stream.
+2. CLICKABLE: the expand control is clickable (click region on the marker/bubble line), alongside ctrl+t.
+3. DOTS ANIMATION: the thinking animation is "thinking . . ." — dots appear LEFT TO RIGHT after the word, each dot a NEW runic symbol (the celtic/cthulian mix), cycling from the left when the row fills. Not a spinner in place — an appearing-dots walk.
+4. PLACEHOLDER: the input box placeholder is just "type in chat" (no affordance list — commands live in the palette and the / overlay).
+5. BOX PRESENCE: the input box grows more generous (taller/padder) so it reads as an obvious place to type — natural, inviting.
+
+### D41 addendum 3 — NO PREFIXES IN BUBBLES (owner, 2026-10-19)
+Chat bubbles carry NO text prefixes — the "you ·"/"rune ·" markers are removed from the bubble content. Identity is already spoken by the bubble itself: side (you right / rune left) and color (cyan / green). The purple diamond stays on rune's EVERYTHING — thinking bubbles AND her answer bubbles alike: it is her signature mark on all her words (owner: 'keep the purple diamond for runes answers tho'); timestamps stay at the bubble corner. Non-bubbled roles (system, error, research, tool) KEEP their textual markers — they have no side/color to speak for them.
+
+## D43 — THE BUBBLE/HUD HARDENING (owner, 2026-10-19, fifteen rulings)
+1. HARDEN: the bubble UI logic is locked clean — nothing interferes with it; amenities only when the owner asks.
+2. TIMESTAMPS ACCURATE + LOCAL: reflect the person's machine timezone per message (low cost: local-format the UTC record at render).
+3. TIMESTAMP SIDE: moved to the OPPOSITE side of the bubble from its current position.
+4. DIRECTION-AWARE PLACEMENT: USER ON THE LEFT for left-to-right languages, rune right — INVERTED for right-to-left language locales (he/ar/fa/ur detection via locale, setting-overridable).
+5. ONE THINKING STREAM: no before/after duplication — the live thinking bubble BECOMES the history thinking bubble (one stream per message).
+6. NO-DUPLICATION POLICY: rune's answer never renders twice (completion-applied bubble and durable row are ONE fact — harden the claim law; frozen no-dupe tripwire).
+7. THINKING IS CLICKABLE (the marker, the line, the whole collapsed row).
+8. Thinking stays with its message in CHAT (owner accepted: tasks-pane thinking is too messy); tasks pane keeps its own work-stream thinking.
+9. BORDERS: dashed → SOLID, same colour as the box (pink family); ALL boxes solid pink borders.
+10. COMPOSER (the type-in-chat box) is ALWAYS lit with the pink outline; the selected pane lights pink outline when selected, GREY outline when not.
+11. INFO BAR: a clean information bar above or below the composer replaces the messy far-bottom bar.
+12. BOTTOM BAR STRIPPED: remove status=RUNNING (running is proven by working), focus=chat (visible in selection), RAIL, seq=N, runtime lib:connected. KEEP: version truncated to semver (0.314.0 not 0.314.0-56-g...), CONTEXT WINDOW in-use/available (accurate: engine reports tokens used vs the model's context limit from the registry).
+13. THINKING LINE: "◆ thinking <ctrl+t hint> <animation>" — the animation capped at 3 glyphs, the ctrl+t hint BEFORE the animation (nothing chases the walk).
+14. GHOST PLACEHOLDER: "type in chat" ghosted, vertically centered, with a BLINKING CURSOR indicating chat-here.
+
+### D43 addendum — THE HARDENING MEANING (owner chose option 3, 2026-10-19)
+The bubble UI is locked against SILENT and UNINVITED change — mechanically, not by promise. Three enforcement layers:
+1. FROZEN PINS: golden fixtures + tripwires pin the bubble's geometry/colors/alignment/visual states — any render change turns the suite RED; pin updates are visible in diffs.
+2. NAMED TERRITORY: the bubble renderer files are owned surface (domain registry) — factory waves do not edit them without a brief naming the reason.
+3. CHANGES ROUTE THROUGH THE OWNER: visual changes to the bubbles ask the owner first (OpenSpec-starting-point law + D35 §2); repairs (restoring the pinned shape) land red-first as normal — the lock protects the design, never the bugs. Never locked against the owner.
+
+### D43 addendum — SCROLL INDICATORS + CORRECTED COLORS (owner, 2026-10-19)
+1. SCROLL WHEEL/UI in BOTH panes: a visible scrollbar indicator while scrolling that FADES when not in use (the modern-editor pattern — visible on activity, transparent at rest). Scrolling the chat history per the landed scrollback law; the tasks pane scrolls its work stream the same way.
+2. OUTLINE COLORS STILL WRONG (second correction): the chat TEXT colors are correct — the OUTLINE colors are not. The outlines follow the D43 law (solid, pink family, composer always lit, selected pane lit / unselected grey). The wave must diff outline color assignments against the law's color table — not the text colors, the borders.
+3. TUI DESIGN PRINCIPLES: a research round on presenting a terminal UI — the design canon (hierarchy, restraint, motion discipline, information density, color systems for terminals) so future visual choices follow principles, not ad-hoc taste. Feeds the owner's iteration loop.
+
+### D43 addendum — ARBITRATION + TIMESTAMPS + THE LAYER LAW (owner, 2026-10-19)
+1. ARBITRATION RULED (canon P3): one alive element wins — while Rune thinks, the bottom-rail cluster goes STILL (count only); the rail animation resumes when the thinking resolves. The rail exists to be seen, not to move.
+2. TIMESTAMPS: intelligently placed (the same relative position regardless of sender) and DEMPHASISED — their importance is low; dim, unobtrusive, never competing with message content.
+3. THE LAYER LAW (owner architecture ruling): every visual element of the TUI is an INDEPENDENT LAYER with its own scaffold/state — border, content, cursor, scroll indicator, animation each render in their own layer, and a change or defect in one must never corrupt another (the cursor punching a hole in the composer border is the motivating defect). Layers compose at render time; interactivity may couple them deliberately; accidental coupling is a defect. Each layer gets its own tests (its own scaffold, in the owner's words) — a change to one layer's state cannot alter another layer's rendering.
+
+### D43 addendum 2 — LAYERS RELATE TO THE PROJECT (owner correction, 2026-10-19)
+The Layer Law's independence is INTERNAL isolation, not project isolation: each layer has its own scaffold/state/tests WITHIN the tui project's scaffolding system — registered in the same construction store, admitted through the same contracts, checked by the same authority, versioned with the project. Isolation means a change to one layer's state cannot silently alter another layer's RENDERING; it does NOT mean layers live outside the governed build. Every layer scaffold is a project citizen: contract, tests, pins, and the issue ledger all track it with the rest.
+
+### D43 addendum 3 — FIVE OWNER CRITIQUES (live use, 2026-10-19)
+1. GHOST KEY HINTS: the composer shows ghosted "enter send · shift+enter newline" hints that DISAPPEAR the moment typing starts (ghost-at-rest, gone-when-typing — the affordance teaches, then vanishes).
+2. COMPOSER NEVER SCROLLS: the composer must NOT behave like a scrolling viewport while typing (the weird line-influence effect) — the composer fits its 3 rows and wraps internally; scroll behavior is for the panes only.
+3. WORD-WRAP NEVER BREAKS WORDS: wrapping breaks at word boundaries ALWAYS — a word reaching the edge moves WHOLE to the next line, never splitting mid-word (observed: "my" split to "m/y" at pane edge). Applies to chat bubbles, composer, all text surfaces.
+4. COMPOSER CLICK PRESERVES PANE CHOICE: clicking the composer after selecting a pane keeps THAT pane's focus — the composer serves whichever pane is selected; clicking it must never default back to chat. The composer is the shared instrument; the panes set its destination.
+5. (Reward for catching these: the Layer Law holds — each defect was an isolated layer failing, never cascading.)
+
+### D43 addendum 4 — THE CENTERED PICKER + CLOUD PROOFS (owner, 2026-10-19)
+1. MODEL PICKER = CENTERED WINDOW, NOT FRONT-LOADED GATE: model selection must NOT block the composer (currently typing anything demands a pick first). Instead: typing with no model chosen opens a CENTERED floating window (mimocode-style) listing ALL providers, SEARCHABLE (type to filter), up/down arrows to walk, enter to choose, esc to dismiss-and-keep-typing. The picker is an overlay on demand, never a gate in front of the input.
+2. API KEYS: port ALL api keys from mimo code without altering them (the 15-secret lossless migration already landed into the OS vault — verify nothing was altered/mangled in translation and every registry row still resolves).
+3. CLOUD CONNECTIVITY PROOFS: every cloud provider connection must actually prove connectivity (a real endpoint probe). Providers the owner holds keys for: prove live. Providers without keys: the probe path is the same principle (endpoint reachable, auth attempted, honest error) — but marked untestable-by-owner rather than claimed.
+
+### D43 addendum 5 — SCAFFOLDING STATUS LINE + GATED-WORK ANIMATION (owner, 2026-10-19)
+1. SCAFFOLDING STATUS LINE (owner spec): when scaffolding is in play, the tasks pane shows: "scaffolding · <loading animation> · <its stage>" — e.g. "scaffolding ⚒ admit", "scaffolding ⚒ build", "scaffolding ⚒ verify", "scaffolding ⚒ land". The loading animation uses the gated-work rhythm (hammer/ladder glyphs per the owner's hammer-and-ladder ruling); the STAGE is the contract's real phase from the kernel state (admit/build/verify/land — never a guess). Appears when a governed contract is active; self-extinguishes when it closes.
+2. HAMMER-AND-LADDER WALK: the gated-work animation is the dots-walk pattern with hammer/ladder glyph vocabulary (⚒ ⛏ 🪜-class glyphs, font-verified per detect-then-render; the shuffled runic/cthulian vocabulary remains for THINKING — gating gets its own trade vocabulary so thinking and building read differently at a glance).
+3. IMAGES: viewable in-terminal (Kitty/sixel protocols; Konsole supports; graceful degradation to links elsewhere per the degrade-silently principle); analyzable when a vision-capable model is connected. Recorded as capability, not a wave yet.
+4. INESCAPABILITY: the machinery-first stack (launch guard → admission → scope-checked mutations → landing gate → durable lock) IS the law — "please build X" puts every step inside scaffolding regardless of model. The adversarial-escape audit (try to escape, close every hole) is queued as its own wave.
+
+### D43 addendum 5 (cont.) — ALL WORKHORSE VISUALS LIVE IN THE TASKS PANE (owner, 2026-10-19)
+Ruling: ALL coding/workhorse-related visuals belong in the TASKS pane — scaffolding status line, work blocks, queue rows, sub-agent window, gated-work animations. The CHAT pane stays conversational (messenger law); the TASKS pane is Rune's workshop window. Both addenda recorded and queued: the scaffolding status line + hammer/ladder animation + the adversarial-escape audit + image capability (recorded, not queued) all route to the tasks-pane wave.
+
+### D43 addendum 6 — THE THINKING BRIDGE + HUD CORRECTIONS + THE WORKSHOP COMPLETION (owner, 2026-10-20)
+1. THE THINKING BRIDGE: the thinking animation MOVES OUT of the chat pane into its own strip BETWEEN the panes and the composer (above the composer, full width). Solves: click-to-expose lives right there (click the strip → the thought process expands — in the bridge or a floating window per the tabs/windows design), and the chat pane declutters (conversation only).
+2. TIMESTAMPS: ALWAYS far-left, same position regardless of sender.
+3. COMPOSER CURSOR: the blinking cursor must ALWAYS blink when waiting for entry — never static (a regression).
+4. TASKS PANE = THE ACTIVE WORKSHOP: while scaffolding runs, the work-in-full-view renders inside the tasks pane — the active task's live coding (current file/command, thinking) fully visible. PLUS a tasks VIEW: clickable/expandable task rows with the open tasks (the D38 ledger's OPEN TASKS section becomes an interactive surface, not a static list).
+5. SUB-AGENT WINDOW OPENER: the window exists but has NO WAY TO OPEN — put the opener in the info bar NEXT TO the tasks area, AFTER the rune version.
+6. VERSION DISPLAY: 'v' prefix (v0.321.0 not 0.321.0) — a version marker; could hyperlink to Gitea (the release URL) when terminals support it (OSC 8 links — degrade gracefully to plain text).
+7. SEQUENCE AFTER THIS WAVE: finish wiring the rebase into the TUI, then the persona layers.
+
+## D44 — THE MODEL DISPLAY + THE PANE DOCTRINE CORRECTED (owner, 2026-10-20 — supersedes the partial D36 routing read)
+
+### 1. MODEL DISPLAY (the info bar shows the active model, correctly compacted)
+The info bar carries the active model name. LOCAL models truncate to their important components: initial name, size, style if applicable (classifier vs normal — ONLY SHOWN WHEN APPLICABLE), and ablation status (uncensored/abliterated variants flagged). CLOUD models: full name, size, classifier-if-applicable. Never let a long local filename eat the bar.
+
+### 2. THE PANE DOCTRINE (owner verbatim — the definitive statement)
+"the tasks pane is meant for ALL ACTIVE WORK or whats being being worked upon... the dichotomy for either pane is CHAT IS FOR TALKING WITH THE MODEL WHILST THE WORK IS BEING DONE. the TASKS PANE is to view the details of whats being worked upon and outstanding work as well as any goals or lists SEPARATE from the detail of the work. and the COMPOSER for either acts differently based on whats selected."
+- TASKS PANE focus + composer enter = IMMEDIATE EXECUTION (never queues — queuing only when work is already running; a queue message with nothing running is a FALSE POSITIVE defect).
+- CHAT PANE focus + composer enter = conversational (base assumption: discussing). Work requests from CHAT get boosted to tasks via the CONSENT CARD (contextual relevancy decides when) — the consent bridge applies ONLY to the chat pane.
+- The queued-work message renders in the TASKS PANE (with the queue rows), NEVER the chat pane.
+- A HOTKEY exists to steer queued work (reorder/prioritise/cancel from the pane).
+
+### 3. QUEUE FALSE-POSITIVE FIX (defect)
+Task-pane asks with nothing running must START immediately — the instant-if-free law was violated (queued despite idle). Red-first the false positive; the queue is only for BUSY.
+
+## D45 — THE LIVE-USE CRITIQUE BATCH (owner, 2026-10-20, after testing the D44 build)
+1. CONTEXT READOUT STILL MISSING in the bar (the core-side accounting landed but the bar doesn't show it — diagnose the TUI-side wiring: the bridge's status poll must actually carry/receive the numbers, and the bar must render once reported).
+2. MODEL NAME COMPACTION (refined spec): "qwen3.6-27b-(uncensored?)" style — parse the id: base name, parameter size, ablation marker (uncensored/abliterated/heretic) if present. No path prefixes (hf.co/), no quant suffixes (IQ3_M), no GGUF noise. Cloud models similar: vendor name + model + size.
+3. VERSION HYPERLINK FORGOTTEN: the v-prefixed version must hyperlink to the Gitea release (OSC 8 — detect-then-render).
+4. TIMESTAMPS STILL NOT MOVED (the addendum-6 far-left move didn't land — re-verify and fix).
+5. THE TOOLSET GAP — THE BIG ONE: Rune cannot bash or write to the owner's PC. The model's thinking says "I cannot directly access your desktop" — because the TUI chat path doesn't surface the tool suite to local models. The tools exist (tool_executor, 19 tools, mode-gated); the chat turn's tool wiring must FORCE tool availability: local models get the toolset in their prompt/capability selection (the T2 slice landed the exposure filter — verify it's active on the live path), cloud models get native tool-calls. Rune at the face must be ABLE to act, mode-gated as D36/D44 demand.
+
+## D46 — FOUR LIVE DEFECTS (owner, 2026-10-20, second testing round)
+1. MESSAGE DUPLICATION (never again): a sent message renders TWICE in the chat pane. The claim law was hardened once (D43) but a path still double-renders — find it (likely the D45 wave's changes to the sync paths interacting with the thinking-bridge move), red-first, and pin the no-dupe tripwire so hard it cannot regress.
+2. THINKING NOT MOVED: the thinking animation/strip was ruled OUT of chat into the bridge strip (addendum 6 item 1) — still rendering in the chat pane. Move it.
+3. COMPOSER SHRUNK: the composer got SMALLER — wrong direction. The composer may push BOTH panes up for more room (its growth is legitimate; panes yield).
+4. DISPATCH TIMEOUT: 'error · dispatch failed: Post ... context deadline exceeded' — the 330s budget was exceeded. Diagnose: the 27B thinking models run 250-310s solo and the chain stacks delays; either raise the budget on the TUI+proxy legs or stream. Diagnose the real timeout hop first.
+   - D46 RESOLUTION (the budget road, owner's pick — streaming stays queued separately): the real hop was the WHOLE STACK at 330s (TUI client lib.CompletionBudget, entry serve proxy proxyClientBudget, the continuous-runtime door — all pinned 330) against a 27B solo worst turn of ~310s plus stacked queue/memory/tool latency: no headroom, so the deadline fired. ONE coherent 480s budget now rides every leg (TUI + both entry doors), pinned structurally by the frozen budget fixtures; the core operator's per-call 300s adaptive ladder (27B) stays — 480 covers the worst observed turn with headroom.
+
+### D46 addendum — CLICKABLE ARTIFACTS + TOOL EVENTS LIVE IN THE TASKS PANE (owner, 2026-10-20)
+1. CLICKABLE FILE ARTIFACTS: when a task generates a file, the file's path in the tasks pane is a CLICKABLE LINK that opens its location (OSC 8 hyperlink with a file:// URL — Konsole opens the file manager/terminal at the path; graceful plain-text degrade elsewhere per the detect-then-render law). The pane shows what was made; the link takes you to it.
+2. TOOL EVENTS MOVE: tool usage display moves OUT of the chat pane INTO the tasks pane (the work block's current-line already shows the newest tool action — ALL tool events belong there, in the work stream, not the conversation). Chat stays conversational: the tool event leaves the transcript as chat content and becomes work-stream detail. The D43 layer law and the pane doctrine (D44) both point this way.
+
+### D46 addendum — Q IS A LETTER NOW (owner, 2026-10-20: "change the q for quit... if i type q it will exit")
+1. PLAIN q TYPES: q is a letter the composer owns — it must never quit.
+2. THE EXIT GESTURE: ctrl+c clears the chat/composer on the first press; TWO ctrl+c IN SUCCESSION quits the program. (A deliberate double-press — you can't quit by accident while typing.)
+3. Every other quit binding (q, esc-as-quit paths) follows the same rule: nothing quits on a single unmodified keypress while the composer can receive text.
+
+## D47 — SIX LIVE-USE DEFECTS + OPENSPEC ROUTING (owner, 2026-10-20)
+OPENSPEC ROUTING: the tabs/windows design AND the chat-presentation fixes go through the OpenSpec interview process — the owner specifies, the spec records, the factory builds. Two openspec topics opened.
+DEFECTS (each red-first, each PTY-proven):
+1. ANSWER DISPLAY BROKEN: Rune's answers render incorrectly in the chat pane (live-use report — diagnose the exact symptom on the owner's next boot: markdown artifacts, broken wrapping, or encoding; the word-safe wrap landed but something else misrenders).
+2. CODE NOT ROUTED TO THE TASKS PANE: code content in answers renders in the chat pane, not the tasks pane (D44 doctrine: work content lives in the workshop pane; the code-block projection needs routing).
+3. EVERY SENTENCE BULLET-POINTED: answers render with per-sentence bullets — a markdown-list misparse (the renderer treats prose as list items). Diagnose and fix the markdown handling.
+4. CONTEXT DEADLINE ERRORS PERSIST: the 480s budget didn't take on the live path (diagnose which hop still runs 330s — the fix landed but a leg is stale or the live turn exceeds even 480s on the 27B; measure the real turn duration).
+5. CONTEXT READOUT PER-MODEL ACCURACY: context available must be accurate FOR EVERY MODEL LOADED (the limit source must be per-model: Ollama /api/show for locals, the registry limit for cloud — not a single cached value).
+6. VERSION HYPERLINK STILL NOT RENDERING (the OSC 8 fix landed but the bar doesn't show it — diagnose the live render path; maybe the deployed binary predates the fix or the detection gate is misfiring).
+7. MODEL OPENS THE PICKER: clicking the model name in the info bar opens the centered model picker (the picker's second road — the click road beside ctrl+m).

docs/authority-map.md

@@ -0,0 +1,140 @@
+# Authority Map — checkout vs deployed generation (Spec 0.1)
+
+Task `0.1` of `docs/openspec/changes/add-native-rune-tui/tasks.md` (0A. Truth
+first — authority and runtime audit). Written 2026-10-17T06:46Z against dev
+checkout `master@ed245b2a`. This map reconciles the THREE code generations
+that exist on this machine and names the authority for every link between
+them. Its enforcement artifact is `src/rune/runtime_attestation.py` +
+`tests/test_runtime_attestation.py` (live attestation; RED when the runtime
+is not the qualified artifact).
+
+## 1. The generations
+
+| Generation | Location | Identity | Role |
+|---|---|---|---|
+| Dev checkout | `/mnt/workdrive/rune` (`master@ed245b2a`) | `__version__ = 0.310.0`, **no** `_build_identity.json` → `build_info().source == "dev"` | Factory floor; all waves build here; never launched by the launcher |
+| Deployed (live runtime) | `/mnt/workdrive/rune-code/current` → `81099a11f7a8` | `_build_identity.json`: commit `81099a11f7a845bea629324e45a2aeef1d00e2a2`, version `0.128.0`, deployed_at `2026-10-07T20:03:04Z` | The ONLY generation the launcher runs |
+| Last-good (rollback) | `/mnt/workdrive/rune-code/last-good` → `3c13be1d766b` | commit `3c13be1d766bf2bb9d25f032ca0cfdee089a55b0`, version `0.127.0`, deployed_at `2026-10-07T20:00:09Z` | Previous `current`; rotated automatically by every promotion |
+
+Facts that matter:
+
+- `81099a11` **is an ancestor of `master@ed245b2a`** — the deployed
+  generation is a genuinely CI-qualified master revision. The relationship
+  is pure staleness (lag), **not divergence**: there is no commit in the
+  deployed tree that the checkout lacks.
+- The lag is **1522 commits / 182 minor versions** (0.128.0 → 0.310.0) and
+  ~10 days (no promotion since 2026-10-07T20:03Z; the factory's whole
+  0C/0D/I/J-era output — tui/, the rune-entry serve surface, the internal/
+  library conversion — is undeployed).
+- `/mnt/workdrive/rune-code` holds 300+ staged generations plus 12
+  orphaned `.staging-*` dirs; ownership `gitea-desktop-runner`. The stale
+  `.convergence-intent.json` there (version 0.66.57, recorded_at "0") is a
+  leftover record, not an authority.
+
+## 2. Launcher authority chain (what actually runs)
+
+`~/.local/bin/rune` (hand-installed shell script, mtime 2026-09-11) is the
+single entry point. Resolved chain:
+
+```
+~/.local/bin/rune
+  └─ wezterm start -- bash -c
+       cd /mnt/workdrive/rune-code/current/src     ← runtime code (generation pinned only by `current`)
+       RUNE_HOME=/mnt/workdrive/rune               ← data home (state/memory of the LIVE system)
+       RUNE_MEMORY_DIR=/home/nick/.config/opencode/memory
+       MIMO_PROBE_ENABLED=1                        ← ADAPT-LIVE bounded probe policy (2026-09-10)
+       ~/.venvs/memory/bin/python3 -m rune         ← interpreter: the memory venv, NOT repo .venv
+```
+
+Authority rows (current vs intended vs dormant):
+
+| Surface | Current authority | Intended (per openspec) | State |
+|---|---|---|---|
+| Launcher script | owner (hand-installed; not owned by any repo module) | unchanged for the Python face | current |
+| Runtime code | `rune-code/current` generation (deploy pipeline output) | same mechanism, newer revisions | current, stale |
+| Runtime identity | `rune/__init__.build_info()` + `_build_identity.json` stamped by `deploy_stage.py` | same (already landed 2026-09-10 handoff) | current |
+| Data home | `RUNE_HOME=/mnt/workdrive/rune` (the dev checkout doubles as the live data dir: `state/`, `store/`, `memory/`) | pin stays; code deploys never move user data | current |
+| Memory dir | `RUNE_MEMORY_DIR=~/.config/opencode/memory` (promotion ledger + memory store live here) | same | current |
+| Promotion decision | `scripts/deploy_promotion.py` — monotonic ancestry law, flock'd critical section, atomic symlink swap, `last-good` rotation | same | current |
+| Deploy qualification | `scripts/deploy_qualify.py` + CI required-checks (fail-closed after the 0.66.28/29 incidents) + `scripts/tui_startup_canary.py` pre-promotion canary | same | current |
+| Receipts / tamper evidence | `src/rune/audit_ledger.py` — HMAC-chained ledger under RUNE_MEMORY_DIR (key lineage repair is Task 0.2, out of scope here) | same | current |
+| Go face (`tui/cmd/rune-tui`, `src/go/rune-entry` front door :8377/:8376) | exists ONLY in the checkout; nothing deployed runs it | launcher target once 0C/0D converge | **dormant** |
+| Paired-build attestation (`src/rune/build_attestation.py`, task 0.14) | checkout-only (Go↔Rust build pairing; a different attestation from this one) | gates future paired artifacts | dormant until next deploy |
+
+Surprise worth naming: **the dev checkout is also the live system's data
+home.** `RUNE_HOME=/mnt/workdrive/rune` means the deployed runtime reads and
+writes state inside the factory worktree (`state/`, `store/scaffold`,
+`memory/journal`) — the same files the test suites mutate. That is why test
+runs dirty the live store and why background workers must restore journal
+churn after every run.
+
+## 3. Module drift — deployed `81099a11` vs checkout `ed245b2a`
+
+| Tree | Deployed | Checkout | Delta | Deployed-only modules |
+|---|---|---|---|---|
+| `src/rune` (Python) | 184 | 284 | +100 | **none** |
+| `src/go` | 42 | 94 | +52 | **none** |
+| `src/rust` | 80 | 104 | +24 | **none** |
+| `tui/` | absent | 36 packages | +36 | — |
+
+Zero deployed-only modules in every tree: the deployed generation is a
+strict prefix of the checkout. Headline checkout-only surfaces (all
+undeployed): the entire `tui/` face; the J1 internal-library conversions
+(`src/go/{rune-entry,event-bus,model-routing,tool-executor,work-manager}` →
+`internal/` + thin shells); `src/rune/{build_attestation,
+construction_admission}`; the rune-entry serve surface
+(`/v1/{conversation,tasks,events,health}`); boundary codegen (0.12);
+versioning port H1–H3. Consequence: any qualification, canary, or attestation
+written only in the checkout (including this map's test) does not constrain
+the live runtime until the next promotion carries it — that is the intended
+0.14/0.15 landing path, not a gap in this task.
+
+## 4. Reconciliation verdict
+
+1. **No divergence.** Deployed `81099a11` is an ancestor of `master`; the
+   checkout is a superset. Nothing was forked, patched, or hot-fixed inside a
+   staged generation (identity commit == directory name == runtime
+   self-report; verified below by the live test).
+2. **Pure lag.** 1522 commits / 0.128.0 → 0.310.0 / 10 days without a
+   promotion. The launcher's comment ("runs the DEPLOYED revision
+   (CI-qualified, build-identity stamped)") is TRUE of `81099a11` at its
+   promotion time and STALE as a description of the system: everything the
+   owner has watched land since Oct 7 (tui, serve, libraries, gates) runs
+   only from the checkout when invoked manually — never via `rune`.
+3. **Rollback target is coherent.** `last-good → 3c13be1d` (0.127.0) is the
+   immediately preceding generation; promotion rotated it correctly.
+4. **The one launch path** is the Python face. No second launcher, alias, or
+   systemd unit runs Rune code (Go binaries under `src/go/` are parity
+   harnesses, not installed). The Go face is checkout-dormant by design
+   until 0C/0D converge.
+
+## 5. Attestation contract (the enforcement half of 0.1)
+
+`src/rune/runtime_attestation.py` — fail-closed attestation of the chain
+launcher → `current` → generation → identity → qualification:
+
+1. launcher exists and its `cd` target is `<deploy_root>/current/src`;
+2. `current` is a symlink resolving to an existing directory inside the
+   deploy root;
+3. the generation carries a well-formed `_build_identity.json`
+   (commit + version + deployed_at);
+4. identity commit == generation directory name (a staged tree cannot
+   impersonate another SHA);
+5. the RUNTIME SELF-REPORTS: importing `rune` from the generation's `src`
+   yields `build_info().commit` == identity commit and `source ==
+   "deployed"` — a dev/unstamped tree answers `"dev"` and fails;
+6. the identity commit is an ANCESTOR of the canonical release branch
+   (`refs/heads/master`) in the checkout — an unqualified artifact can never
+   attest;
+7. identity version == the generation package's `__version__` (coherent
+   stamp, not a stale one).
+
+Every path is injectable; the live defaults bind `~/.local/bin/rune`,
+`/mnt/workdrive/rune-code`, and the repo root. CLI:
+`python -m rune.runtime_attestation` prints the JSON evidence, exit 1 on any
+failure. `tests/test_runtime_attestation.py` freezes hermetic negative
+fixtures for each link (launcher missing/repointed, symlink missing/outside
+root, identity missing/malformed/mismatched, non-ancestor commit, runtime
+self-report mismatch, version incoherence) plus a LIVE test that attests the
+real machine chain and goes RED the moment any of it breaks — runtime ≠
+qualified artifact.

docs/ci-e2e-rig.md

@@ -0,0 +1,43 @@
+# CI E2E Rig (`scripts/ci_e2e_rig.sh`)
+
+The permanent, reusable CI end-to-end proof rig, promoted from the
+release deep-dive's tag-repair proof rig (contract
+`ADMIT-wave-ci-e2e-rig`).
+
+## What it does
+
+1. Registers a **scratch** Gitea runner (labels: `rig-scratch`).
+2. Creates a **scratch** repo (`rig-scratch-<timestamp>`).
+3. Pushes a minimal trigger commit + the workflow under test.
+4. Runs the workflow end-to-end on the scratch runner.
+5. Verifies outputs (run state + expected artifacts).
+6. Tears everything down — **teardown-safe**: repo delete, runner
+   unregister, and scratch-dir removal all run from an `EXIT` trap, so
+   a failed proof run never leaks resources.
+
+## Modes
+
+- `scripts/ci_e2e_rig.sh --dry-run` — prints the plan, launches nothing
+  (this is what the contract tests exercise; no live Gitea required).
+- `scripts/ci_e2e_rig.sh --workflow tui-release.yml [--keep]` — live
+  proof run. Requires `RUNE_GITEA_URL` + `RUNE_GITEA_TOKEN`; fails
+  loudly when either is missing.
+
+## Safety properties
+
+- Scratch-only: the production repo and production runners are never
+  touched; the rig creates its own namespace-bound resources.
+- Teardown on failure: the `EXIT` trap fires on any non-zero path.
+- `--keep` retains the scratch dir for post-mortem (still tears down
+  the runner and repo).
+
+## Guarded regressions
+
+`tests/test_workflow_script_contract.py` extended to cover the three
+pipelines (`auto-version.yml`, `tui-release.yml`, `maintenance.yml`)
+so any future edit reintroducing the **SIGPIPE pipe**
+(`git tag --sort=-v:refname | head -1` under pipefail — exit 141, the
+runs-29929/30435/30636 class) or dropping the
+**GITEA_REF_NAME tag fallback** (GITEA_REF_NAME → GITHUB_REF_NAME →
+`git describe --tags --exact-match`, empty on the rune-ci-desktop
+runner) goes RED at test time, not in production.

docs/conversation-state.md

@@ -37,9 +37,20 @@ dict round-trip.
 
 **ConversationStateRepository** (durable message history):
 
-- `append(msg)` — idempotent by `msg_id`.
-- `window(channel_id, n=8)` — last n messages, chronological.
-- `messages_for_task(task_id)` — full per-task history.
+- `append(msg)` — idempotent by `msg_id` (O(1) in-memory id set); writes
+  one fsync'd JSONL tail line, never a full-checkpoint rewrite.
+- `window(channel_id, n=8)` — last n messages, chronological (hot tier).
+- `messages_for_task(task_id)` — full per-task history, spanning hot and
+  cooled tiers.
+- `get_message(msg_id)` — exact-by-ID read across hot, tail, and cool
+  tiers with the memory-continuity runtime's typed statuses
+  (`FOUND_VERIFIED` / `SOURCE_CORRUPT` / `NOT_FOUND_CONFIRMED`).
+- `search(text, channel_id=None)` — substring search over content
+  spanning hot and cooled messages (tier attribution; cooling never
+  deletes).
+- `compact()` — fold the tail into the hot checkpoint (runs
+  automatically every `compact_every` appends and on load when a fat
+  legacy checkpoint is found).
 - `latest_task(channel_id)` — most recent task on the channel.
 
 Repositories never assemble prompts — that is #19 (ContextBroker).
@@ -54,6 +65,20 @@ Repositories never assemble prompts — that is #19 (ContextBroker).
   `hot/conversation_messages.json`) hold full record bodies for O(1)
   reads; temp+fsync+rename means a crash never corrupts them. A corrupt
   checkpoint raises `CorruptStateCheckpointError` — loud, never silent.
+- **JSONL tail** (`hot/conversation_tail.jsonl`) — message bodies append
+  INCREMENTALLY: one fsync'd line per message. The conversation
+  checkpoint moves only on compaction (every `compact_every=64`
+  appends), not per message — the 6372-message/1.7MB-per-append write
+  amplification the chat-live research flagged is gone.
+- **Compaction + cooling** — compaction folds the tail into the hot
+  checkpoint keeping the last `hot_window=512` messages per channel hot;
+  older messages cool through the memory-continuity runtime's cooling
+  contract into durable per-channel archives
+  (`hot/conversation_cool/`), each record carrying a content digest.
+  Cooling releases the hot window without deleting anything: recovery
+  replays checkpoint + tail with msg_id dedupe, exact-by-ID reads verify
+  cool digests, and search spans both tiers. A corrupt tail line or cool
+  archive raises `CorruptStateCheckpointError` — loud, never silent.
 
 ## Composition
 

docs/dichotomy-oracle-quirks.json

@@ -18,6 +18,16 @@
     {"trap": "oracle CRASH parity: if the oracle crashes (AttributeError etc.) on an input class, the port returns the matching error envelope", "port": "never silently skip — the facade's fallback reproduces the exact exception", "proved_by": "execution_trace fuzz"},
     {"trap": "glob+mtime ordering ties within the same second", "port": "explicit os.utime in test fixtures; deterministic per-case dirs", "proved_by": "sleep_time"},
     {"trap": "Go evaluation order: arg-list trace(x, f.Mutating()) snapshots BEFORE mutation; Python passes live references", "port": "capture returns/reports into locals first", "proved_by": "failure_auto_filer"},
-    {"trap": "absolute temp paths in frozen truth are machine-specific", "port": "repo-relative names or REPO_ROOT placeholder + battery substitution", "proved_by": "paths"}
+    {"trap": "absolute temp paths in frozen truth are machine-specific", "port": "repo-relative names or REPO_ROOT placeholder + battery substitution", "proved_by": "paths"},
+    {"trap": "ThreadPoolExecutor.submit AFTER shutdown raises from the submit loop itself — run_parallel's per-task capture never sees it, the WHOLE call raises", "port": "Go port panics with 'cannot schedule new futures after shutdown' at the same site (crash parity, recovered by battery/parity)", "proved_by": "parallel_processor (2026-10-14)"},
+    {"trap": "callable corpora cannot ride JSON truth rows", "port": "freeze a shared kind/fn/value SPEC grammar via a rig that builds real Python callables; the battery rebuilds Go tasks from the same rows (extends the memory_consolidation seam pattern)", "proved_by": "parallel_processor (2026-10-14)"},
+    {"trap": "threading.active_count() in oracle output is process-random (pool threads, harness state)", "port": "pin via rig patch to a constant; Go side reads the matching PP_ACTIVE_THREADS seam (default: native goroutine count)", "proved_by": "parallel_processor (2026-10-14)"},
+    {"trap": "epoch microseconds beyond ~2^53 (year >285 CE) lose sub-second digits when crossing f64 JSON (253402300799000001 → …799000000)", "port": "instants cross FFI as STRINGS; kernel parses i64 (si_now micros_str law)", "proved_by": "self_improve (2026-10-14)"},
+    {"trap": "f'{x:.0%}' scales the DOUBLE's exact decimal expansion by 100 then rounds half-even; a binary r*100.0 multiply can sit 1 ulp off the tie and round differently", "port": "Rust format!('{:.0}%') matches on exactly-representable ratios; frozen truth pins ties with power-of-two denominators only (1/8 → 12.5% → '12%')", "proved_by": "self_improve (2026-10-14)"},
+    {"trap": "datetime.fromisoformat raises on out-of-calendar fields (month 13, Feb 30, day 0, hour 24 with nonzero minutes)", "port": "Rust fixed-position parsers must validate ranges (leap-year month lengths; h<=23 or ISO hour-24 end-of-day with zero min/sec) or they compute off-calendar epochs the oracle never sees", "proved_by": "tier_manager (parse_strict_aware crash class, 2026-10-14)"},
+    {"trap": "json.dumps default ensure_ascii=True escapes ALL non-ASCII as \\uXXXX (lowercase hex, astral chars as surrogate pairs); serde_json emits raw UTF-8", "port": "byte-parity emitters need a py_escape pass over strings for BOTH compact and indent shapes — separators-only parity is not enough (extends the context_broker pyDumpsSorted law)", "proved_by": "inference_trace (serialize/format_record unicode rows, 2026-10-14)"},
+    {"trap": "list[-limit:] with limit=0 keeps ALL lines (-0 == 0 slices from the start), so read_traces(limit=0) returns everything, not nothing", "port": "Rust limit match arms must special-case Some(0) => all items (read_select + cli_tail); rev().take(0) silently returns none", "proved_by": "inference_trace (limit-0 truth row, 2026-10-14)"},
+    {"trap": "a kernel Err on inputs where the oracle RAISES (e.g. malformed JSONL line) loses end-to-end parity if the kernel instead silently skips", "port": "propagate the Err through the FFI envelope — the facade's except-fallback then re-runs the Python path, which re-raises the AUTHENTIC exception (message parity by construction); pin the crash CLASS in truth rows when the cross-language message text cannot match", "proved_by": "inference_trace (read_select ValueError class, 2026-10-14)"},
+    {"trap": "Python 3.14 OSError.__str__ QUOTES the filename: str(e) = \"[Errno 21] Is a directory: './path'\" (<=3.13 emitted it bare)", "port": "Rust errno mapping must single-quote the path in the message AND strip the ' (os error N)' suffix of io::Error Display; pins are interpreter-version-shaped — re-freeze when the oracle python changes major", "proved_by": "dependency_tracker (frozen battery row 20, 2026-10-14)"}
   ]
 }

docs/dichotomy-rebase-honest-audit.md

@@ -2,16 +2,16 @@
 
 _Regenerate with `python3 scripts/dichotomy_audit.py --write`. A module is FULL only when 80%+ of its Python functions have name-preserving counterparts in the Go/Rust implementation — directories without the functions are facades and count as NOT TOUCHED._
 
-**FULL completion: 38%** (72/192 runtime modules at FULL)
+**FULL completion: 80%** (154/193 runtime modules at FULL)
 
-Function-level detail: 59% (1335/2273 runtime functions matched) — secondary; includes in-flight work
+Function-level detail: 85% (1933/2283 runtime functions matched) — secondary; includes in-flight work
 
 | Status | Modules | Lines | Meaning |
 |---|---|---|---|
-| FULL | 72 | 26561 | 80%+ of functions ported |
-| PARTIAL | 80 | 35737 | 20–80% — real logic exists, gaps named below |
-| NOT TOUCHED | 40 | 11513 | no name-preserving implementation |
-| Total runtime | 192 | 73811 | |
+| FULL | 154 | 65153 | 80%+ of functions ported |
+| PARTIAL | 0 | 0 | 20–80% — real logic exists, gaps named below |
+| NOT TOUCHED | 39 | 11058 | no name-preserving implementation |
+| Total runtime | 193 | 76211 | |
 
 ## NOT TOUCHED — the port queue, in priority order (largest first)
 
@@ -20,7 +20,6 @@ Function-level detail: 59% (1335/2273 runtime functions matched) — secondary;
 | rune_tui | 4170 | 159 | TUI-LAST |
 | canary_audit_ledger | 541 | 2 | TEST-INFRA |
 | tui_validator | 514 | 13 | TUI-LAST |
-| capability_fit | 414 | 12 | RUST |
 | chat_bubble | 401 | 12 | TUI-LAST |
 | canary_rune_serve | 329 | 13 | TEST-INFRA |
 | canary_p1_07 | 324 | 10 | TEST-INFRA |
@@ -50,159 +49,154 @@ Function-level detail: 59% (1335/2273 runtime functions matched) — secondary;
 | canary_schema_migration | 86 | 1 | TEST-INFRA |
 | wait_guard_corpus | 46 | 0 | RUST |
 | canary_cognitive_strata | 44 | 1 | TEST-INFRA |
-| builder_bridge_cli | 42 | 1 | GO |
 | __init__ | 40 | 1 | RUST |
 | canary_memory_synthesis | 33 | 1 | TEST-INFRA |
 | canary_resource_authority | 33 | 1 | TEST-INFRA |
 | canary_surface_parity | 33 | 1 | TEST-INFRA |
 | canary_orchestration_foundation | 32 | 1 | TEST-INFRA |
 | canary_gitea_delegation | 31 | 1 | TEST-INFRA |
-
-## PARTIAL — gaps to close (matched/total fns; first missing named)
-
-| Module | Lines | Coverage | Missing (first named) |
-|---|---|---|---|
-| rune_operator | 2746 | 25/68 | _build_model_router, _sorted_tool_names, _filter_safety_noise, _wire_auto_filer, _reconcile_guarded, get_operator |
-| memory_store | 2333 | 30/68 | _ctx_budget, now_iso, ensure_memory_type_column, _embed, _temp_json, _entities_to_json |
-| construction_interface | 1193 | 6/27 | _to_stage_check, _guard_specs_from_obligations, t_layout, _obligations_projection, _obligation_scope_files, main |
-| provider_registry | 679 | 11/28 | _ctx_budget, _format_tools_openai, _execute_tool_calls, _execute_tool_calls_anthropic, get_registry, connect_provider |
-| warm_router | 1518 | 17/33 | _ensure_use_history_table, record_outcome, record_neuron_fire, base_level_activation, _db, _aaak |
-| construction_decision | 985 | 4/19 | normalize_need, _sc_core, resolve_surface, ss_entity, implemented_contracts, resolve_affected_surface |
-| cron_engine | 440 | 13/27 | get_cron_engine, run_task, start_engine, stop_engine, to_dict, fire_on_task_complete |
-| tool_executor | 1836 | 33/47 | _execute_tool_now, serialize_prepared_tool, deserialize_prepared_tool, confirm_write, _resolve_execution_cwd, _run_command |
-| safety_override | 574 | 7/20 | _keyword_stopwords, _cc_probe, cc_loader_pin, self_test, escalation_rate, escalation_success_rate |
-| cache | 492 | 6/17 | _record_hit, _record_miss, flush_stats, get_cache, put_cache, invalidate_scope |
-| elastic_cognition | 774 | 3/14 | _ctx_budget, _build_constitution, _get_constitution, _load_cloud_config, execute_at_tier, _execute_deterministic |
-| parallel_processor | 194 | 3/14 | _shutdown_processor, get_processor, run_parallel_with_args, get_status, test_parallel, run_parallel_with_args |
-| structural_model | 388 | 9/20 | workspace_record, workspace_advance, _init_project, save, reload, add |
-| claim_audit | 484 | 4/14 | _get_warm_neuron_store, reframe, _graph_has, _warm_has, verify, journal |
-| model_profiles | 438 | 5/15 | get_profile_path, load_profile, save_profile, build_profile_from_ollama, scan_all_models, get_or_create_profile |
-| capability_broker | 798 | 10/19 | _native_tool_schemas, load_registry, _cards_are_stale, load_cards, generate_card, build_cards |
-| token_optimizer | 514 | 16/25 | get_optimizer, _tc_core, _to_core, to_dict, _to_state, _apply_state |
-| behavior | 537 | 6/14 | _bh_core, connect, _correction_matches_python, _habit_matches_python, _reinforce_rust, _reinforce_python |
-| builder_bridge | 326 | 3/11 | _construction_store, _active_construction_lines, _default_selector, _cached_memory, _get_selector, _retrieve_memory |
-| drift_core | 471 | 3/11 | _ms_core, _now_iso, promote_entry, compute_fama, compute_drift_velocity, compute_drift_direction |
-| identity_anchors | 542 | 6/14 | show_anchors, show_rules, show_pronouns, _announcement_patterns, _pronoun_patterns, _hedge_patterns |
-| time_awareness | 402 | 12/20 | _clock_args, _ta_core, get_time_awareness, to_dict, _to_state, _apply_state |
-| contracts | 743 | 4/11 | _ct_core, _resolve_and_project, _run_contract_python, capture_signatures, save_signatures, load_signatures |
-| graph_memory | 474 | 2/9 | now_iso, connect, resolve_entity, add_edge, query, stats |
-| intent_continuity | 284 | 6/13 | _now, _raise_core_err, to_dict, from_dict, save, _ledger_state |
-| voice_hybrid | 427 | 3/10 | _connect, _load_growth, _save_growth, source_profiles, always, grow |
-| voice_sync | 299 | 3/10 | _now, get_delivery_register_from_db, get_delivery_register, update_rune_md, check_sync, handle_hook |
-| audit_ledger | 212 | 2/8 | _compute_hash, get_entries, log_promotion, log_gate_result, log_drift_alert, main |
-| construction_pattern | 547 | 7/13 | _need_dict, _surface_text, _path_matches, _entity_matches, _obligation_when_hit, _check |
-| context_pressure | 262 | 3/9 | log_measurement, read_log, log_stats, _now, handle_hook, main |
-| core_server | 234 | 6/12 | make_server, log_message, _send_json, _send_ndjson, do_GET, do_POST |
-| microkernel | 434 | 6/12 | now_iso, discover, _extract_manifest, _load_registry, _save_registry, _run_hook |
-| model_registry | 253 | 2/8 | test_registry, to_dict, get_profile, get_enabled_profiles, get_profiles_by_tier, list_profiles |
-| progressive_escalation | 279 | 2/8 | execute_with_escalation, test_escalation, handle_hook, to_dict, execute, verify |
-| tier_manager | 262 | 4/10 | _cc_probe, cc_loader_pin, demotion_sweep, get_tier_config, should_search, should_compress |
-| voicebox | 164 | 5/11 | _run, start_recording, stop_recording, _transcribe_and_type, on_press, on_release |
-| witness | 446 | 9/15 | _now, _cc_probe, cc_loader_pin, log_entry, read_log, log_stats |
-| hook_engine | 860 | 3/8 | discover_functions, tag_function, validate_placements, generate_report, handle_hook |
-| persona_definition | 210 | 2/7 | _by_topic, compile_full, emit_constitution, emit_identity, emit_persona |
-| task_persist | 269 | 5/10 | _save, export, restore, main, handle_hook |
-| tiered_executor | 291 | 3/8 | _ctx_budget, test_executor, to_dict, to_dict, _execute_model |
-| adaptive_router | 625 | 19/19 | GO |
-| construction_commands | 268 | 1/5 | _refuse, _validate, _accept, dispatch |
-| drift_compression | 307 | 3/7 | get_compression_ratio, compress_entry, warn_before_compress, get_compression_stats |
-| drift_observability | 399 | 5/9 | _do_core, main, _load_alerts, _save_alerts |
-| layout_contract | 336 | 2/6 | define_region, bind_component, amend_layout_contract, record_layout_observation |
-| model_connect | 471 | 7/11 | _ctx_budget, _now, _get_cloud_models, handle_hook |
-| pins | 282 | 7/11 | _store_path, _detail_blob, unpin, list_pins |
-| prompt_sync | 487 | 11/15 | _now, _rust_available, get_store, main |
-| salience_gate | 276 | 1/5 | _sg_core, test_salience, handle_hook, to_dict |
-| self_improve | 246 | 1/5 | _now, suggest_improvements, handle_hook, main |
-| task_gate | 301 | 5/9 | _tg_core, _now, list_gates, main |
-| connection_pool | 226 | 7/10 | get_pool, _kernel_state, _get_connection_core |
-| construction_activation | 237 | 1/4 | _scaffold_for, _auto_structural_awareness, dispatch_from_decision |
-| construction_mode | 412 | 2/5 | _contains_any, to_dict, from_dict |
-| construction_projection | 254 | 1/4 | _contract_entity, validate, write_mini_doc |
-| dependency_tracker | 202 | 2/5 | check_propagation, get_full_map, main |
-| event_envelope | 303 | 5/8 | test_envelope, to_canonical_dict, to_dict |
-| graph_projection | 134 | 3/6 | _model_to_dicts, write_all, _now |
-| memory_selector | 590 | 11/14 | _mse_core, add_source, _source_store |
-| state_checkpoint | 182 | 6/9 | _sck_core, _load_ledger, _save_ledger |
-| warm_neuron_store | 122 | 3/6 | _db, neuron_slugs, handle_hook |
-| cognitive_budgeter | 221 | 1/3 | test_budgeter, to_dict |
-| event_bus | 244 | 5/7 | _store_path, handle_hook |
-| inference_trace | 204 | 4/6 | record_trace, read_traces |
-| response_adapter | 222 | 5/7 | test_adapter, to_dict |
-| stage_guards | 303 | 7/9 | to_dict, chk |
-| standardized_providers | 281 | 3/5 | list_providers, connect_all_local |
-| structural_migration | 77 | 2/4 | apply_migration, consent_brief |
-| subconscious_pass | 236 | 3/5 | main, get_recent_findings |
-| subsystem_health | 213 | 4/6 | set_auto_filer, configure_logging |
-| voice_injector | 138 | 3/5 | test_injection, to_dict |
-| drift_resume | 153 | 3/4 | _dr_core |
-| execution_trace | 108 | 3/4 | _journal_path |
-| experience_encoding | 113 | 1/2 | _ee_core |
-| grading | 253 | 3/4 | _gr_core |
-| mutation_guards | 143 | 2/3 | _mg_core |
-| recall_router | 165 | 2/3 | handle_hook |
-| recall_uplift | 193 | 1/2 | _fetch_corpus |
-| rune_profiler | 196 | 2/3 | main |
+| alpha | 1 | 0 | unclassified |
 
 ## FULL — ported, parity-gated
 
 | Module | Lines | Fns | Side |
 |---|---|---|---|
+| rune_operator | 2746 | 68/68 | GO |
+| memory_store | 2331 | 67/67 | GO |
 | curator | 1838 | 43/43 | GO |
+| tool_executor | 1836 | 47/47 | GO |
+| warm_router | 1518 | 33/33 | GO |
+| construction_decision | 1211 | 23/23 | RUST |
+| construction_interface | 1193 | 27/27 | RUST |
 | sleep_time | 1056 | 26/26 | GO |
-| spine | 975 | 20/25 | RUST |
-| structural_store | 921 | 34/41 | RUST |
-| scaffold | 881 | 30/30 | GO |
-| context_broker | 870 | 24/24 | GO |
+| spine | 975 | 25/25 | RUST |
+| structural_store | 937 | 40/40 | RUST |
+| scaffold | 908 | 30/30 | GO |
+| context_broker | 870 | 23/23 | GO |
+| capability_broker | 865 | 18/18 | RUST |
+| hook_engine | 860 | 8/8 | GO |
 | local_tool_runtime | 809 | 30/30 | GO |
+| elastic_cognition | 774 | 14/14 | GO |
 | memory_consolidation | 770 | 22/22 | GO |
+| contracts | 743 | 10/10 | RUST |
 | persona_gate | 724 | 23/23 | GO |
+| provider_registry | 687 | 28/28 | GO |
 | abstraction | 656 | 16/16 | GO |
-| system_registry | 603 | 14/16 | RUST |
+| safety_override | 649 | 20/20 | RUST |
+| adaptive_router | 625 | 19/19 | GO |
+| memory_selector | 609 | 13/13 | RUST |
+| system_registry | 603 | 15/15 | RUST |
 | work_manager | 594 | 25/25 | GO |
-| construction_intent | 580 | 13/16 | RUST |
+| structural_model | 593 | 20/20 | RUST |
+| construction_intent | 580 | 16/16 | RUST |
+| identity_anchors | 575 | 13/13 | RUST |
 | capability_ledger | 571 | 18/18 | RUST |
-| drift_ledger | 548 | 20/21 | RUST |
+| graph_memory | 563 | 9/9 | RUST |
+| drift_ledger | 548 | 21/21 | RUST |
+| construction_pattern | 547 | 13/13 | RUST |
+| voice_hybrid | 540 | 11/11 | RUST |
+| drift_core | 539 | 12/12 | RUST |
+| behavior | 537 | 13/13 | RUST |
 | failure_auto_filer | 527 | 24/24 | GO |
 | build_mode | 521 | 33/33 | GO |
-| growth_delta | 520 | 16/18 | GO |
+| construction_activation | 521 | 15/15 | RUST |
+| growth_delta | 520 | 17/17 | GO |
 | event_wait | 518 | 14/14 | GO |
-| worthiness | 469 | 12/13 | unclassified |
-| tool_protocol | 461 | 22/27 | GO |
+| token_optimizer | 514 | 25/25 | RUST |
+| cache | 492 | 17/17 | GO |
+| prompt_sync | 487 | 15/15 | RUST |
+| claim_audit | 484 | 14/14 | RUST |
+| capability_fit | 480 | 13/13 | RUST |
+| model_connect | 471 | 11/11 | GO |
+| worthiness | 469 | 13/13 | unclassified |
+| tool_protocol | 461 | 27/27 | GO |
 | auto_tasks | 460 | 14/14 | GO |
-| programme_continuation | 458 | 11/12 | RUST |
+| programme_continuation | 458 | 12/12 | RUST |
 | goal | 453 | 20/20 | GO |
 | release_notes | 446 | 16/16 | GO |
+| witness | 446 | 15/15 | GO |
+| cron_engine | 440 | 27/27 | GO |
+| model_profiles | 438 | 15/15 | GO |
+| layout_contract | 434 | 6/6 | RUST |
+| microkernel | 434 | 12/12 | GO |
 | model_routing | 432 | 13/13 | GO |
+| voice_sync | 426 | 12/12 | RUST |
 | night_mode | 421 | 19/19 | GO |
-| build_basis | 375 | 11/13 | RUST |
-| attention_capsule | 365 | 6/7 | RUST |
-| testing_mode | 362 | 11/13 | RUST |
-| drift_cache | 357 | 12/14 | RUST |
+| construction_mode | 412 | 5/5 | RUST |
+| time_awareness | 402 | 19/19 | RUST |
+| drift_observability | 399 | 9/9 | RUST |
+| construction_commands | 393 | 5/5 | RUST |
+| self_improve | 384 | 7/7 | RUST |
+| build_basis | 375 | 12/12 | RUST |
+| attention_capsule | 365 | 7/7 | RUST |
+| testing_mode | 362 | 13/13 | RUST |
+| drift_cache | 357 | 14/14 | RUST |
 | provider_budget | 357 | 20/20 | GO |
 | drift-ledger | 355 | 14/14 | unclassified |
-| outcome_ledger | 318 | 7/8 | RUST |
+| context_pressure | 351 | 9/9 | RUST |
+| progressive_escalation | 340 | 8/8 | RUST |
+| builder_bridge | 326 | 11/11 | GO |
+| drift_compression | 323 | 7/7 | RUST |
+| pins | 323 | 11/11 | RUST |
+| outcome_ledger | 318 | 8/8 | RUST |
+| construction_projection | 317 | 4/4 | RUST |
 | message_queue | 316 | 13/13 | GO |
-| lexicon_evolution | 304 | 7/8 | unclassified |
-| message_graph | 295 | 12/13 | unclassified |
-| toolchain | 295 | 5/6 | RUST |
+| lexicon_evolution | 304 | 8/8 | unclassified |
+| event_envelope | 303 | 8/8 | GO |
+| stage_guards | 303 | 9/9 | GO |
+| audit_ledger | 302 | 8/8 | RUST |
+| task_gate | 301 | 9/9 | RUST |
+| tier_manager | 300 | 10/10 | RUST |
+| message_graph | 295 | 13/13 | unclassified |
+| toolchain | 295 | 5/5 | RUST |
+| tiered_executor | 291 | 8/8 | GO |
+| intent_continuity | 284 | 13/13 | RUST |
+| salience_gate | 283 | 5/5 | RUST |
+| response_adapter | 282 | 7/7 | RUST |
+| standardized_providers | 281 | 5/5 | GO |
 | shard_manager | 276 | 9/9 | RUST |
+| dependency_tracker | 274 | 6/6 | RUST |
 | auto_context | 273 | 8/8 | GO |
 | spine_language | 269 | 5/5 | RUST |
+| task_persist | 269 | 10/10 | RUST |
 | construction_patterns_builtin | 266 | 1/1 | RUST |
-| iteration | 261 | 7/8 | RUST |
+| iteration | 261 | 8/8 | RUST |
+| inference_trace | 258 | 8/8 | RUST |
+| grading | 253 | 4/4 | unclassified |
+| model_registry | 253 | 8/8 | GO |
+| event_bus | 244 | 7/7 | GO |
+| subconscious_pass | 236 | 5/5 | RUST |
+| core_server | 234 | 12/12 | GO |
 | openai_compat_transport | 227 | 9/9 | GO |
+| connection_pool | 226 | 10/10 | RUST |
+| cognitive_budgeter | 221 | 3/3 | RUST |
 | evidence_probe | 213 | 9/9 | GO |
-| project_registry | 205 | 10/12 | RUST |
+| subsystem_health | 213 | 6/6 | GO |
+| persona_definition | 210 | 7/7 | GO |
+| project_registry | 205 | 12/12 | RUST |
 | forge_client | 203 | 18/18 | GO |
-| behaviour_ledger | 195 | 10/12 | RUST |
+| rune_profiler | 196 | 3/3 | RUST |
+| behaviour_ledger | 195 | 12/12 | RUST |
+| parallel_processor | 194 | 14/14 | GO |
+| recall_uplift | 193 | 2/2 | RUST |
+| state_checkpoint | 189 | 8/8 | unclassified |
 | construction_depth | 172 | 2/2 | RUST |
-| self_modify | 149 | 7/8 | unclassified |
+| recall_router | 165 | 3/3 | GO |
+| voicebox | 164 | 11/11 | GO |
+| drift_resume | 153 | 4/4 | RUST |
+| graph_projection | 153 | 6/6 | RUST |
+| self_modify | 149 | 7/7 | unclassified |
 | forge | 146 | 11/11 | GO |
-| verification_layer | 136 | 10/11 | RUST |
-| rune_spinner | 130 | 4/5 | RUST |
+| mutation_guards | 143 | 3/3 | unclassified |
+| voice_injector | 138 | 5/5 | GO |
+| verification_layer | 136 | 11/11 | RUST |
+| rune_spinner | 130 | 5/5 | RUST |
 | concept_topology | 128 | 7/7 | unclassified |
+| warm_neuron_store | 122 | 6/6 | RUST |
 | wait_guard | 116 | 1/1 | RUST |
 | skill_compiler | 115 | 4/4 | unclassified |
+| experience_encoding | 113 | 2/2 | unclassified |
+| execution_trace | 108 | 4/4 | unclassified |
 | failure_recovery | 108 | 1/1 | RUST |
 | abstraction_ladder | 102 | 3/3 | unclassified |
 | meaningful_events | 102 | 3/3 | unclassified |
@@ -210,12 +204,14 @@ Function-level detail: 59% (1335/2273 runtime functions matched) — secondary;
 | pane_authority | 98 | 2/2 | unclassified |
 | inference_paths | 95 | 2/2 | unclassified |
 | memory_types | 85 | 2/2 | unclassified |
-| programme_gates | 85 | 4/5 | RUST |
+| programme_gates | 85 | 5/5 | RUST |
 | growth_pipeline | 84 | 2/2 | unclassified |
 | impact_preview | 78 | 2/2 | RUST |
+| structural_migration | 77 | 4/4 | RUST |
 | self_model | 76 | 3/3 | unclassified |
 | research_budget | 75 | 3/3 | unclassified |
 | evidence_capsule | 74 | 3/3 | unclassified |
 | paths | 53 | 6/6 | unclassified |
 | provider_context | 48 | 1/1 | GO |
+| builder_bridge_cli | 42 | 1/1 | GO |
 | route_risk_flags | 37 | 1/1 | RUST |

docs/factory-claims.json

@@ -1,94 +1,168 @@
 {
   "landed": [
     "abstraction",
+    "abstraction_ladder",
+    "adaptive_router",
     "attention_capsule",
+    "audit_ledger",
     "auto_context",
     "auto_tasks",
+    "behavior",
     "behaviour_ledger",
     "build_basis",
     "build_mode",
+    "builder_bridge",
+    "builder_bridge_cli",
+    "cache",
+    "capability_broker",
+    "capability_fit",
     "capability_ledger",
+    "claim_audit",
+    "cognitive_budgeter",
     "concept_topology",
+    "connection_pool",
+    "construction_activation",
+    "construction_commands",
+    "construction_decision",
+    "construction_depth",
     "construction_intent",
+    "construction_interface",
+    "construction_mode",
+    "construction_pattern",
     "construction_patterns_builtin",
+    "construction_projection",
     "context_broker",
+    "context_pressure",
+    "contracts",
+    "core_server",
+    "cron_engine",
     "curator",
+    "dependency_tracker",
     "drift-ledger",
+    "drift_cache",
+    "drift_compression",
+    "drift_core",
     "drift_ledger",
+    "drift_observability",
     "drift_resume",
+    "elastic_cognition",
+    "event_bus",
+    "event_envelope",
     "event_wait",
+    "evidence_capsule",
     "evidence_probe",
     "execution_trace",
+    "experience_encoding",
     "failure_auto_filer",
     "failure_recovery",
     "forge",
     "forge_client",
     "goal",
+    "grading",
+    "graph_memory",
+    "graph_projection",
     "growth_delta",
     "growth_pipeline",
+    "hook_engine",
+    "identity_anchors",
     "impact_preview",
     "inference_paths",
+    "inference_trace",
+    "intent_continuity",
+    "iteration",
+    "layout_contract",
+    "lexicon_evolution",
     "local_tool_runtime",
     "meaningful_events",
     "memory_consolidation",
+    "memory_selector",
+    "memory_store",
+    "memory_types",
     "message_graph",
     "message_queue",
+    "microkernel",
+    "model_connect",
+    "model_profiles",
+    "model_registry",
     "model_routing",
+    "mutation_guards",
     "night_mode",
     "openai_compat_transport",
     "outcome_ledger",
     "outcome_utility",
     "pane_authority",
+    "parallel_processor",
     "paths",
+    "persona_definition",
     "persona_gate",
+    "pins",
     "programme_continuation",
     "programme_gates",
+    "progressive_escalation",
     "project_registry",
+    "prompt_sync",
     "provider_budget",
     "provider_context",
+    "provider_registry",
+    "recall_router",
+    "recall_uplift",
     "release_notes",
+    "research_budget",
+    "response_adapter",
     "route_risk_flags",
+    "rune_operator",
+    "rune_profiler",
     "rune_spinner",
+    "safety_override",
+    "salience_gate",
     "scaffold",
+    "self_improve",
     "self_model",
     "self_modify",
     "shard_manager",
     "skill_compiler",
     "sleep_time",
+    "spine",
     "spine_language",
+    "stage_guards",
+    "standardized_providers",
     "state_checkpoint",
+    "structural_migration",
+    "structural_model",
     "structural_store",
+    "subconscious_pass",
+    "subsystem_health",
     "system_registry",
+    "task_gate",
+    "task_persist",
+    "testing_mode",
+    "tier_manager",
+    "tiered_executor",
+    "time_awareness",
+    "token_optimizer",
+    "tool_executor",
     "tool_protocol",
     "toolchain",
     "verification_layer",
+    "voice_hybrid",
+    "voice_injector",
+    "voice_sync",
+    "voicebox",
     "wait_guard",
+    "wait_guard_corpus",
+    "warm_neuron_store",
+    "warm_router",
+    "witness",
     "work_manager",
     "worthiness"
   ],
-  "in_flight": {
-    "memory_types": "rune-wave-bd",
-    "wait_guard_corpus": "rune-wave-be",
-    "research_budget": "rune-wave-be",
-    "evidence_capsule": "rune-wave-be",
-    "builder_bridge_cli": "rune-wave-be",
-    "safety_override": "rune-wave-bn",
-    "construction_decision": "rune-wave-bo",
-    "provider_registry": "rune-wave-bq",
-    "construction_interface": "rune-wave-bu",
-    "spine": "rune-wave-bv",
-    "hook_engine": "rune-wave-bw",
-    "elastic_cognition": "rune-wave-bx",
-    "contracts": "rune-wave-by",
-    "adaptive_router": "rune-wave-bz",
-    "memory_selector": "rune-wave-ca",
-    "capability_broker": "rune-wave-cd",
-    "identity_anchors": "rune-wave-ce",
-    "construction_pattern": "rune-wave-cb [agent: naming-artifact claim UNPROVEN \u2014 audit reads PARTIAL 7/14; awaiting per-fn proof or re-port]"
-  },
+  "in_flight": {},
   "excluded": [
     "TUI-LAST modules",
     "TEST-INFRA modules",
     "RETIRES modules"
-  ]
+  ],
+  "excluded_verdicts": {
+    "__init__": "machinery (package initializer, dunder law)"
+  }
 }

docs/factory/order-of-things.md

@@ -0,0 +1,51 @@
+# Factory order of things — standing build order (owner-approved 2026-10-17)
+
+## Location
+This file: /mnt/workdrive/rune/docs/factory/order-of-things.md
+Spawn queue with briefs: docs/factory/spawn-queue.md
+Architecture law: docs/architecture/boundary-law.md
+Retirement ledger: docs/retirement-map.md + verification/retirement-map.json
+
+## The order
+1. CHAT LIVE — real conversations through the lane (library seam → model-routing → streaming)
+2. TOOLS LIVE — dispatch wired through chat (toolexec in-process)
+3. VISUAL ROUND — three grounded design directions on the working base; owner critiques with portrayal tooling; providers designed here (first-run floor philosophy: extensive cloud+local list, easy connect)
+4. RETIREMENT CAMPAIGN — parity harness capability by capability; PROVEN rows delete Python same-change
+5. WASM EXPANSION — more Rust crates in-process per D30
+6. DEFERRED: Plan loop, self-transformation pipeline, Sleight matrices — informed by real usage data
+7. Cognition socket opening (SA-D5 reserved): when the body is complete and the face is her face
+
+## In-flight snapshot (2026-10-17)
+17 waves: command paths, parity harness (7.2 — retirement machine), continuous runtime, bounded stream, effect mediation, memory invariant, hard modes, universal input, gateway security, lane concurrency, child visibility, DEP05-07 depth, domain registry (full dichotomy), modegate honesty, tag auto-fetch.
+Landed this round: 16 (see git log + MORNING-TEST).
+
+## Factory standardization law (owner directive 2026-10-17)
+The factory pattern (contracts, red-first tests, Scaffolding admission, verify-gated landing, continuous backfill) becomes a CORE RUNE FEATURE — standardized into the codebase itself, not just this session's process. Scale path: 30 now → prove thoroughness (testing, linting, scaffolding respected, everything proven functioning) → 50 → more. Scale-up is evidence-gated: thoroughness maintained at N is the precondition for N+20.
+
+## Owner's Definitive Answers (2026-10-17 — binding, recorded for unattended factory operation)
+
+### 1. Feature priority — CONFIRMED
+Chat → Tools → Providers → Visual round → Retirement campaign → WASM expansion. Order stands.
+
+### 2. Visual round — OWNER PRESENT
+Owner needs to give pointers and iterate on the three design directions. DEFERRED if running overnight — build the three directions, the owner critiques when present. Factory does NOT pick autonomously.
+
+### 3. Retirement campaign — OWNER CONFIRMS EACH
+Each concept/feature: parity harness proves identical → owner confirms it works → deletion wave executes for that feature. NOT autonomous deletion. The checkpoint is the owner's real-world usage test, not just the harness.
+
+### 4. Features added to the spec
+- **Sandboxing** — the sandbox suite for tool execution (the 0.9(d) default-deny + grants infrastructure exists; this is the fuller sandboxing capability)
+- **Bridge to ChatGPT and online providers** — the cloud provider bridge beyond Ollama (OpenAI, Anthropic, etc. — the extensive provider list + the actual chat connections)
+
+### 5. Cognition socket — HEAVY, NOT LIGHT
+This is a serious, year-scale development project. Not a light topic. The factory does NOT casually build it. When opened, it gets its own research protocol, its own adversarial rounds, its own owner-directed design. The socket stays reserved; the work begins only with the owner's explicit, informed go — understanding the scale.
+
+### 6. Stop conditions — CONTINUOUS WORK + RECORDED STOPPING POINT
+The factory is done after: (a) specifying what work needs to be continuous (memory consolidation, drift checks, scheduled jobs — the autonomic system) and (b) a stopping point is recorded (the spec implemented, Python retired, the continuous work defined). The factory doesn't run forever; it runs until the stopping point.
+
+## ISSUE-LEDGER LAW (owner, 2026-10-19: "are issues being made and closed on gitea as improvements are being made so versioning stays correct?")
+Every landing files/links a Gitea issue and closes it in the same change — the issue ledger tracks improvements the way tags track versions. Batch retroactive filing (#2491-#2497) covered 2026-10-18's work. Going forward: the main session files the issue at landing time (or the wave brief names it); the commit message carries "closes #N" so the push closes it. The version clock and the issue ledger stay in lockstep.
+
+## WAVE-BRIEF COMPLIANCE LAW (owner audit, 2026-10-19)
+Every build-wave brief MUST carry the three standing requirements verbatim: (1) SCAFFOLDING ADMISSION — mint the construction contract via the admit script before building (scripts/admit_wave_*.py pattern; no freehand edits outside the scaffolding authority); (2) ISSUE LEDGER — name the Gitea issue (main session files/closes at landing); (3) RESEARCH GATE — PROCEED chain or declared exemption, per the mechanical gate. Briefs missing any of the three are non-compliant — the spawner (main session) owns the omission. Today's interactive-session waves were spawned without (1) — recorded as drift; the backfill wave registers the omitted contracts.
+Backfill landed 2026-10-19 (scripts/admit_wave_backfill_interactive_2026_10_18.py): seven contracts minted retroactively at their honest landed state — ADMIT-wave-chat-surface-d34-36 (58d8ae97), ADMIT-wave-go-turn-engine-cloud-routing (0d99d5a7), ADMIT-wave-d41-amalgamation (8e1a09e1), ADMIT-wave-task-ledger-d38 (ca915c60), ADMIT-wave-convergence-landing (e4514523 + original aa5f1917), ADMIT-fix-history-bubble-landed (4347ad05), ADMIT-wave-firstrun-cloud-first (2ba3a437) — each closed on landing-sha evidence with the landing commits' verification receipts recorded verbatim (not re-executed); registry entries added for factory-visual-round, factory-providers-live, and the task-ledger exemption.

docs/factory/research-registry.json

@@ -0,0 +1,409 @@
+{
+ "schema": 1,
+ "law": "Owner directive 2026-10-16 (docs/factory/spawn-queue.md): every feature wave runs the canonical research protocol FIRST (ISSUE, INWARD, OUTWARD, APPLICABILITY, INNOVATION-on-merit, ADVERSARIAL, SYNTHESIS, QUALIFY); the build wave spawns only on QUALIFY: PROCEED; MORE_RESEARCH loops back with named unknowns. This registry maps feature slugs to their research artifact chains so scripts/check_research_gate.py can enforce the law mechanically (admission-time gate + post-hoc sweep). Exemptions must be declared explicitly, never silent: mechanical-repair (spec-pinned, research exists at spec level), test-doc-only, owner-directive (directive quoted).",
+ "gate": "scripts/check_research_gate.py",
+ "updated_at": "2026-10-20",
+ "entries": [
+  {
+   "slug": "tui-build-program",
+   "match": [
+    "wave-*",
+    "wave",
+    "rune",
+    "tui",
+    "boundary",
+    "g-series",
+    "h-series",
+    "i-series",
+    "j-series",
+    "k-series"
+   ],
+   "chain": "research/tui-frontier-r2/qualify.json",
+   "verdict": "PROCEED",
+   "note": "The add-native-rune-tui build program (B/C/D/E/F/G/H/I/J/K wave series under docs/openspec/changes/add-native-rune-tui/) executes the R2 frontier round; every program wave dispatch cites the round (e.g. admit_wave_seam_registry.py evidence refs)."
+  },
+  {
+   "slug": "wasm-prototype",
+   "match": [
+    "wasm-*"
+   ],
+   "chain": "verification/wasm-prototype-report.json",
+   "verdict": "YIELDS",
+   "note": "Owner verdict YIELDS (docs/architecture/boundary-law.md: token_counting end-to-end YIELDS; prototype-only, production migration wave 1 opened under the standing directive). Prototype rounds resolve through this chain; a production wasm migration wave requires its own PROCEED round."
+  },
+  {
+   "slug": "memory-continuity",
+   "match": [
+    "*memory-continuity*",
+    "sleight-matrix",
+    "sleight-deliverables"
+   ],
+   "exemption": {
+    "category": "mechanical-repair",
+    "reason": "Spec-pinned: research exists at spec level (Sleight memory-context-continuity evidence, bound by the B-SLEIGHT-MATRIX / B-SLEIGHT-DELIVERABLES briefs); bounded mechanical execution, no new research questions."
+   }
+  },
+  {
+   "slug": "bounded-mechanical-repairs",
+   "match": [
+    "repair-worker",
+    "repair-*",
+    "*-repair",
+    "fix-*"
+   ],
+   "exemption": {
+    "category": "mechanical-repair",
+    "reason": "Bounded mechanical repairs dispatched against already-researched, spec-pinned defects (e.g. the five 0.9 defects cite the R2 round); no new research questions opened."
+   }
+  },
+  {
+   "slug": "substrate-ci-machinery",
+   "match": [
+    "substrate-worker",
+    "trial-worker",
+    "*-harness-check",
+    "research-gate",
+    "fuzz-*"
+   ],
+   "exemption": {
+    "category": "owner-directive",
+    "reason": "Substrate/CI machinery (boundary codegen corpus, landing checks, harness trials, the research gate itself): per owner directive these are mechanical infrastructure, not feature waves; quoted from the research-gate enforcement dispatch: 'this wave is substrate/CI machinery — exempt as mechanical infrastructure, exemption recorded: research-gate machinery itself, per owner directive'."
+   }
+  },
+  {
+   "slug": "issue-161",
+   "match": [
+    "issue-161"
+   ],
+   "chain": "research/issue-161/qualify.json",
+   "verdict": "PROCEED",
+   "note": "Per-issue research rounds live at research/issue-<n>/qualify.json (verdict in the outcome field); the gate's direct-dir resolution research/<slug>/qualify.json handles every other issue slug before any registry fallback."
+  },
+  {
+   "slug": "domain-registry",
+   "match": [
+    "domain-registry",
+    "domain_registry",
+    "query-domain",
+    "wave-domain-registry"
+   ],
+   "exemption": {
+    "category": "owner-directive",
+    "reason": "Owner dispatch (wave-domain-registry, 2026-10-17): the registry machinery IS the response to the owner critique that diagnosis was grep-exploration instead of scaffold lookup — the deliverable is registry data + lookup tooling over EXISTING authorities (docs/retirement-map.md, store/rebase/classification.json, package dirs), introducing no new research questions. Directive: 'Build the missing map.' Scope law (docs/factory/spawn-queue.md, owner amendment 2026-10-17) names the registry machinery itself as exempt with approval_ref 'user:wave-domain-registry dispatch'.",
+    "approval_ref": "user:wave-domain-registry dispatch"
+   }
+  },
+  {
+   "slug": "gitignore-hygiene",
+   "match": [
+    "gitignore-hygiene",
+    "gitignore_hygiene",
+    "wave-gitignore-hygiene"
+   ],
+   "exemption": {
+    "category": "owner-directive",
+    "reason": "Owner dispatch (wave-gitignore-hygiene, 2026-11): mechanical hygiene repair of .gitignore rules — the src/go artifact rule's force-add era (modegate binary fabrication, K9 sweep accident, 102MB cache re-lands) and the cwd-local runtime dir rules swallowing memory/index + memory/journal. Deterministic rule fix + frozen gate, no new research questions. approval_ref 'user:wave-gitignore-hygiene dispatch'.",
+    "approval_ref": "user:wave-gitignore-hygiene dispatch"
+   }
+  },
+  {
+   "slug": "rune-launcher",
+   "match": [
+    "rune-launcher",
+    "rune_launcher",
+    "wave-rune-launcher"
+   ],
+   "exemption": {
+    "category": "owner-directive",
+    "reason": "Owner dispatch (wave-rune-launcher, main session 2026-10-17): standardize the `rune` command so typing rune boots the new Go TUI face — launcher standardization is build/deploy plumbing over already-researched surfaces (paired build D26 scripts/build_paired.sh, update-apply D27 tui/update, the python-era ~/.local/bin/rune pinned verbatim as the honest fallback), no new research questions. approval_ref 'user:wave-rune-launcher dispatch'.",
+    "approval_ref": "user:wave-rune-launcher dispatch"
+   }
+  },
+  {
+   "slug": "firstrun",
+   "match": [
+    "firstrun",
+    "first-run",
+    "wave-firstrun",
+    "b-first-run",
+    "*firstrun*"
+   ],
+   "exemption": {
+    "category": "owner-directive",
+    "reason": "Owner dispatch (B-FIRST-RUN, docs/factory/spawn-queue.md NEW PRIORITY 0 + 'First-run law' + 'Fresh-state detection' directives, 2026-10-17): the first-run experience — fresh-state detection (no provider record + no checkpoint), the welcome/provider-list/model-list/connection-test face (tui/firstrun), and no-default-provider enforcement (chat gated until an explicit selection). The behavior contract is pinned at directive level (the spawn-queue directives quote it); bounded build against the frozen provider_selection.json record law already shipped by the chat-live groundwork, no new research questions. approval_ref 'user:wave-firstrun dispatch'.",
+    "approval_ref": "user:wave-firstrun dispatch"
+   }
+  },
+  {
+   "slug": "self-transform",
+   "match": [
+    "self-transform*",
+    "self_transform*"
+   ],
+   "chain": "research/harness-survey/self-transformation/qualify.json",
+   "verdict": "PROCEED",
+   "note": "Spec 6.2/6.2a/6.3 self-transformation waves (openspec task 6.2): the self-transformation research chain completed QUALIFY: PROCEED with D01-D10 owner decisions recorded in the dedicated interview; the build binds synthesis.json exact_candidate_flow (13 stages) with RM01-RM15 + IAM01-IAM22. First consumer: wave-K27-self-transform (src/rune/self_transform_pipeline.py)."
+  },
+  {
+   "slug": "chat-presentation",
+   "match": [
+    "chat-presentation",
+    "chat_presentation",
+    "chat-box",
+    "chatbox",
+    "wave-chat-presentation",
+    "B-CHAT-PRESENTATION"
+   ],
+   "chain": "research/factory-chat-presentation/07-qualify.json",
+   "verdict": "PROCEED",
+   "note": "Owner-asked research round (2026-10-18): 'do research into how to setup chat boxes for harnesses in go' — the chat input surface (backspace defect root cause: key-spelling fork semantic vs ultraviolet; input box as its own layer). Headline: charm.land/bubbles/v2 v2.2.1 (already pinned, zero go.mod change) ships textinput/textarea/viewport — the prior 'stub pin' belief was vendor pruning. Build waves for the composer/chat box cite this chain."
+  },
+  {
+   "slug": "apikey-migration",
+   "match": [
+    "apikey-migration",
+    "api_key_migration",
+    "wave-apikey-migration",
+    "B-APIKEY-MIGRATION"
+   ],
+   "exemption": {
+    "category": "owner-directive",
+    "reason": "Owner dispatch (wave-apikey-migration, 2026-10-17, spawn-queue.md#B-APIKEY-MIGRATION, owner-critical): lossless port of ALL API keys and saved connections from mimo code (~/.config/mimocode/mimocode.jsonc, ~/.local/share/mimocode/auth.json, ~/.config/opencode/*, ~/.local/share/opencode/auth.json, ~/.rune/model_state.json) into rune's provider store. Deterministic scan→map→apply→verify machinery + frozen round-trip battery (tests/test_apikey_migration.py, red-first) + secret store per the security law (OS keyring / Secret Service / encrypted fallback, never plaintext in UI/logs). No new research questions. approval_ref 'user:wave-apikey-migration dispatch'.",
+    "approval_ref": "user:wave-apikey-migration dispatch"
+   }
+  },
+  {
+   "slug": "factory-separate-turns",
+   "match": [
+    "factory-separate-turns",
+    "separate-turns",
+    "separate_turns",
+    "wave-separate-turns",
+    "turn-lanes",
+    "chat-task-dichotomy",
+    "d36-turn-lanes",
+    "*separate-turns*"
+   ],
+   "chain": "research/factory-separate-turns/07-qualify.json",
+   "verdict": "PROCEED",
+   "note": "Owner-ordered research round (2026-10-18, D36 era): 'we need to not block the interactivity of being able to talk to the chat pane whenever a task pane task chat message is sent... the chat and the task panes need to operate on separate turns.' The round maps the exact blocking points (dispatch_lock at core_server.py:199 wrapping the whole turn; unsynchronized operator state; full-checkpoint saves measured 2.2MB; task-channel-bound context assembly), verifies Ollama concurrency semantics live (stateless /api/chat, default per-model FIFO queue, OLLAMA_NUM_PARALLEL memory multiplication, engine caveats), and surveys crush / Claude Code / RQ harness+queue patterns. Verdict PROCEED with five named owner decisions (OD-1 model-slot policy is the only hardware-cost call). Build waves for the dichotomy cite this chain."
+  },
+  {
+   "slug": "factory-checkpoint-saves",
+   "match": [
+    "factory-checkpoint-saves",
+    "checkpoint-saves",
+    "checkpoint_saves",
+    "wave-checkpoint-saves",
+    "operator-checkpoint",
+    "operator-json-checkpoint",
+    "*checkpoint-save*"
+   ],
+   "chain": "research/factory-checkpoint-saves/07-qualify.json",
+   "verdict": "PROCEED",
+   "note": "Owner-ordered research round (2026-10-18, D38 deferred the decision to it): 'can you fully explain the issue first so i can diagnose approaches and also suggest a multitude of approaches after research on this specific issue' — the operator.json full-rewrite checkpoint (measured 2,307,627 bytes, 96.3% immutable task history, ~25ms per save, 3-5 saves per turn, truncate-then-stream with no atomicity, silent reset to defaults on torn load). Mid-round D39 ruling reframed the target ('keep the intention of what was meant to be finished in python and just move to go and fix the go version properly'): the decision matrix feeds the GO core's storage design — SQLite via modernc.org/sqlite (D30-legal, memory-ops precedent, pin >=3.51.3 for the WAL-reset fix) vs bbolt vs journal+snapshots (K25 generalized) vs atomic per-subsystem JSON, plus hybrids and an honest Rust-sidecar dismissal (sled self-disqualifies; redb is D30-hostile). 8 live sources with URLs; migration axis first-class per owner addendum; Python stopgap (atomic_write + terminal-task retirement) as Appendix S only. NO single recommendation — owner diagnoses."
+  },
+  {
+   "slug": "factory-orchestrator",
+   "match": [
+    "factory-orchestrator",
+    "orchestrator",
+    "orchestrator-layer",
+    "d37-orchestrator",
+    "*orchestrator*"
+   ],
+   "chain": "research/factory-orchestrator/07-qualify.json",
+   "verdict": "PROCEED",
+   "note": "Owner directive D37.4 (2026-10-18, boundary-law.md): 'RUNE THE ORCHESTRATOR: her intelligence OWNS all models in play, thinks independently from them, and interprets how best to route context across every model in play. The models are workers; Rune is the mind above them.' Research question: how to architect the orchestrator layer above multiple model workers (chat+task panes, local+cloud) given the landed Go turn engine (ModelClient seam named in engine.go as the D37 insertion point), the advisory rank() port + trust gate (G1-G5, paid spend = hard-ask), the adaptive-router effort classes, the warm-router budget law, and the D40 per-channel journal+SQLite storage shape. 5 live sources: LiteLLM router (rules cascade + ordered failure ladder + sticky sessions + reject-not-queue), OpenRouter auto router (lightweight task classifier -> measured spend-share ranking -> cost bands -> graceful degradation), RouteLLM (tiny learned routers beat LLM judges; 85% cost cut at 95% GPT-4 quality), Anthropic orchestrator-workers (plan-to-memory, task-descriptions-down, digests-up, 15x token cost, resume-from-checkpoint), LangGraph supervisor (handoff-as-tool-call, output_mode knob, forward_message). Synthesis: OrchestratorCore implements ModelClient above the engine (frozen laws untouched; phase-1 pass-through proven by frozen tests); three-tier decision cascade (rules -> measured -> optional tiny judge, off by default); orchestrator context in a dedicated D40 channel (decisions+receipts+verdicts, never worker transcripts); context composition via ContextBroker contributor port (cross-channel contributions explicit+gated); failure ladder = local fallback in-turn, cloud never mid-run (start-tier law), cooldowns, sticky-with-re-ranking, pass-through degradation. 4 owner decisions pending (OD-1 judge tier, OD-2 context placement, OD-3 escalation posture, OD-4 supervisor phase). No code changes."
+  },
+  {
+   "slug": "factory-consent-bridge",
+   "match": [
+    "factory-consent-bridge",
+    "consent-bridge",
+    "consent_bridge",
+    "wave-consent-bridge",
+    "chat-to-task",
+    "promote-runtime",
+    "promotion-runtime",
+    "work-intent",
+    "work_intent",
+    "d36-consent-bridge",
+    "*consent-bridge*"
+   ],
+   "chain": "research/factory-consent-bridge/07-qualify.json",
+   "verdict": "PROCEED",
+   "note": "Owner-lawed research round (2026-10-18, D36 section 2, boundary-law.md:90): the consent bridge - the chat pane detects a conversational message is really a work request, Rune proposes the push with a y/n card, consent starts the task instantly (enqueue, never preempt) with the context frozen as a snapshot at consent time. Closes factory-separate-turns OD-5. The round maps the pre-built machinery (tui/promote SA-D3 ladder + Offer(entries) seam awaiting its runtime; construction_intent.py's ACTION|DISCUSSION resolver with the DISCUSSION-PROPOSAL-USER_APPROVED lifecycle and STALE_GAP_TURNS=2 staleness law, already ci_loader-compiled; the needs_confirm envelope precedent; the D38 ledger's Brief slot fed only the title today at ledger.go:266) and reads seven live sources (Rasa CALM's shift to model-self-reported commands; Mycroft adapt's deterministic require/optionally parser; LangGraph checkpoint immutability; gum confirm; Claude Code permission prompts - scope-bounded yes only when the card shows everything it would allow, harness-enforced not model-enforced; Claude Code queue-while-busy; GitHub required-reviewer approvals). Verdict PROCEED with three named unknowns carried as kill tests K1-K3 (tier-2 tag recall, prompt overhead, suppression threshold) gating phase 2 only. Build waves for the bridge cite this chain."
+  },
+  {
+   "slug": "factory-50-scale",
+   "match": [
+    "factory-50-scale",
+    "scale-30",
+    "scale-50",
+    "verification-throughput",
+    "suite-sharding"
+   ],
+   "chain": "research/factory-50-scale/07-qualify.json",
+   "verdict": "PROCEED",
+   "note": "The 30->50 evidence-gate round (serves the factory standardization law; confirms the checkpoint-era finding BY MEASUREMENT at ~24 waves): verification throughput binds before spawn capacity — demand 4-12 landings/h vs ~3.5/h serial ceiling, paid today as debt (20 landings without manifests; check_landing RED on HEAD, 2 unbuildable modules). Inward: worktree tool adoption 0% (zero wave/* branches; 12 stale worktrees; waves share the dirty main tree), python_suite = 94% of the 928s sweep on 1/32 cores, 3 recorded sweep-race incidents + the 2026-10-17 boot-break class. Outward 5 sources (GitHub merge queue docs+GA, bors, Bazel remote cache, pytest-xdist): queue+shard+dedup. Synthesis: measured gates G30.1-7 / G50.1-6, domains.json sharding design (59 domains, batteries per domain + always-global members + serial merged-tree landing gate), throughput budget math (composite ~1-3 min effective checks -> >=2x margin at 50). Known wound: python-domain verdict caching is conservative-first pending the dependency-break tripwire proof. Research only — no code."
+  },
+  {
+   "slug": "factory-ghost-text",
+   "match": [
+    "factory-ghost-text",
+    "ghost-text",
+    "ghost_text",
+    "wave-ghost-text",
+    "typeahead",
+    "type-ahead",
+    "inline-prediction",
+    "d36-prediction",
+    "*ghost-text*"
+   ],
+   "chain": "research/factory-ghost-text/07-qualify.json",
+   "verdict": "PROCEED",
+   "note": "Owner-ruled research round (2026-10-18, boundary-law.md D36 item 5 verbatim: 'PREDICTION: inline ghost text (dim continuation suggestion, tab accepts, mimocode-style), sourced from local Ollama'; dispatched as 'D35 SS5' which maps to D36 item 5). Latency budget MEASURED on the owner's GPU (RTX 4070 Ti SUPER, ollama 0.40.5): qwen2.5:0.5b/3b answer warm in 5-25ms TTFT / 63-86ms full 12-token suggestion — an order of magnitude inside the keystroke budget; 14b-class (165ms-8.9s) and thinking models (qwen3 thinking-first emission, 7.9s) measured and disqualified. Live-measured eviction hazard: predictor load evicted a resident 14b (6.7s reload) matching the documented VRAM co-residency law — small-model default + pre-warm + keep_alive + first-use residency check are requirements. UX laws from six live sources (fish autosuggestions, zsh-autosuggestions async/widget taxonomy, VS Code inline-completion source: Automatic-only debounce + canceled:beforeFetch version law + typingSpeed.ts adaptive debounce, Grounded Copilot arXiv:2206.15000 bimodal finding, Ollama api.md+faq.mdx). Synthesis: Input3 suggestion state + composerView dim suffix + conditional accept precedence (tab while visible; arrow/end at end-of-text) + 180ms quiet window + version-keyed cancel + suppression matrix; predictor model = settings/wizard entry per D37 (qwen2.5:3b recommended, 0.5b fallback — pulled to the owner's Ollama this round). Five owner taste questions isolated (both-panes-or-chat-first among them); none blocks phases 0-1. qwen2.5:0.5b installed as documented fallback. Research only — no code."
+  },
+  {
+   "slug": "factory-persona",
+   "match": [
+    "factory-persona",
+    "persona-layer",
+    "persona_layer",
+    "wave-persona",
+    "b-persona-layer",
+    "*persona*",
+    "port-the-persona"
+   ],
+   "chain": "research/factory-persona/persona-qualify.json",
+   "verdict": "PROCEED",
+   "note": "B-PERSONA-LAYER round (owner, 2026-10-18: 'runes persona layer is not ported either which is important'; spawn-queue.md B-PERSONA-LAYER). Three-way differential per the chain-audit addendum (OpenCode stack vs MiMoCode stack vs repo) with a 10-component completeness inventory (persona-inward.json). 8 live external sources (Letta memory-blocks, Claude Code memory docs, SillyTavern character design, mem0, arXiv 2310.13548 sycophancy / 2607.28818 ANCHOR persona-collapse / 2605.09863 Nautilus Compass drift detection, OWASP LLM01/LLM07). PROCEED gated on the owner interview (OD1-OD6 in persona-synthesis.json): identity seed, pane depth, always-on budget (reference stack measures ~15K tok/turn; recommendation 1-3K), edit surface, store migration scope, constitution block. Build target: Go core context assembly per D39 (channel-keyed, budgeted persona sub-blocks)."
+  },
+  {
+   "slug": "factory-visual-round",
+   "match": [
+    "factory-visual-round",
+    "visual-round",
+    "wave-visual*",
+    "d41-*",
+    "wave-d41-*",
+    "*amalgamation*"
+   ],
+   "chain": "research/factory-visual-round/07-qualify.json",
+   "verdict": "PROCEED",
+   "note": "Owner visual round (2026-10-18): three direction frames rendered for owner critique (research/factory-visual-round/portrayal/); the D41 ruling (boundary-law.md §D41, 'after viewing all three renderings') IS the recorded pick the round's phase-2 gate requires. CAUTION: the artifact's verdict field carries prose ('PROCEED — portrayal-first: …') which the gate's exact-match verdict law REFUSES at admission — waves citing this chain declare the owner-directive exemption quoting the recorded pick (precedent: ADMIT-wave-d41-amalgamation, the 2026-10-19 compliance backfill) until the artifact verdict is normalized to plain PROCEED."
+  },
+  {
+   "slug": "factory-providers-live",
+   "match": [
+    "factory-providers-live",
+    "providers-live",
+    "wave-providers*",
+    "*cloud-first*",
+    "wave-firstrun-cloud-first"
+   ],
+   "chain": "research/factory-providers-live/07-qualify.json",
+   "verdict": "PROCEED",
+   "note": "Provider-connection research round (2026-10-18): the standardized provider catalog, vault-keyed cloud connections, the drift-gated truth trio. Build waves for the wizard/provider surfaces cite this chain. First consumer: ADMIT-wave-firstrun-cloud-first (the D42 addendum cloud-first wizard, admitted by the 2026-10-19 compliance backfill)."
+  },
+  {
+   "slug": "task-ledger",
+   "match": [
+    "task-ledger",
+    "wave-task-ledger*",
+    "*markdown-ledger*"
+   ],
+   "exemption": {
+    "category": "owner-directive",
+    "reason": "The D38 task markdown ledger build IS the owner ruling (boundary-law.md §D38, 2026-10-18, quoted in ADMIT-wave-task-ledger-d38's session directive); the ruling deferred only the CHECKPOINT mechanics decision to the factory-checkpoint-saves round — the ledger itself was directly ruled with no new research question. Recorded by the 2026-10-19 compliance backfill."
+   }
+  },
+  {
+   "slug": "factory-authority-port",
+   "match": [
+    "factory-authority-port",
+    "authority-port",
+    "construction-authority-port",
+    "port-the-authority",
+    "*authority*"
+   ],
+   "chain": "research/factory-authority-port/authority-port-map.md",
+   "verdict": "PROCEED",
+   "note": "Research-only mapping wave (2026-10-20) of the agent-mutation-side construction authority port (issue161-harness construction_authority.py + construction_authority_cli.py + scaffolding-guard.ts hook) into rune. Single deep map justified in §0 (machinery move within one code lineage; design fixed by T23 §36 no-parallel-authority law and owner directive). Maps: the begin/check/checkpoint decision pipeline incl. shell operand-position mutation-target scan and lazy postcondition (§1); what ports cleanly onto rune's Scaffold.check_scope/ConstructionInterface/construction_admission substrate (§2); gaps — activate_from_text front door, completion tail (build_basis/behaviour_ledger dependency, deferrable), PROJECT_ID retarget, internal-ledger list (§3); guard wiring REPO/LOCK/interpreter + durable fail-closed lock (§4); 3-4 day estimate for the mutation boundary (§5); 4-phase plan (§6). PROCEED gated on the four named unknowns in §7 (rune construction_context shape diff, rune ledger dirs, classify_mode deps, canonical guard copy location)."
+  },
+  {
+   "slug": "factory-tui-design-principles",
+   "match": [
+    "tui-design-principles",
+    "design-principles",
+    "visual-principles",
+    "factory-tui-design-principles"
+   ],
+   "chain": "research/factory-tui-design-principles/07-qualify.json",
+   "verdict": "PROCEED",
+   "note": "Research-only wave (owner directive 2026-10-20: 'i also want some research on ui design on presenting a tui so we can have some design principles to follow'). Deliverable: twelve named, testable design principles (06-synthesis.json) grounded in nine live sources, auditing D34-D43 (10 ratified, 3 new obligations: contrast floor / one-alive-element / token layer), plus nine terminal-fatal adversarial traps. The set is the design-review checklist for future visual waves; implementation waves it implies (color-token table, contrast audit) spawn with their own briefs."
+  },
+  {
+   "slug": "factory-chat-design-principles",
+   "match": [
+    "chat-design-principles",
+    "chat-principles",
+    "conversation-design",
+    "factory-chat-design-principles"
+   ],
+   "chain": "research/factory-chat-design-principles/07-qualify.json",
+   "verdict": "PROCEED",
+   "note": "Research-only wave (owner directive 2026-10-20, verbatim: 'can you look up and research chat design principles to see if we can innovate from them'). Conversation-domain complement to the TUI canon: chat-specific principle set C1-C9 (04-applicability.json, testable), inward audit of D34-D43 (zero conflicts, ten rulings ratified by evidence, four small new obligations), eight live sources, seven terminal-fatal chat patterns (05-adversarial.json), and the innovation list I1-I6 with honest for/against (06-synthesis.json) — flagship I2 (legibility of the one-composer dichotomy). No construction; every innovation pick spawns its own build-wave brief."
+  },
+  {
+   "slug": "factory-tabs-windows",
+   "match": [
+    "tabs-windows",
+    "tabs-and-windows",
+    "factory-tabs-windows",
+    "wave-tabs*",
+    "*floating-windows*"
+   ],
+   "chain": "research/factory-tabs-windows/00-interview-prep.md",
+   "verdict": "PROCEED",
+   "note": "Research-only interview-prep wave (owner approved the tabs + floating-windows direction for the face, 2026-10-20; design interview BEFORE building). Maps the stack (Bubble Tea v2.1.0 + lipgloss v2.0.6: lipgloss.NewLayer with X/Y/Z coordinates is first-class z-order compositing, Canvas.Compose/Render for the composite surface, v2 mouse protocol covers drag — tab bars have no library component, lazygit/k9s precedent is hand-built), inventories the face's natural tabs/windows (gauges overlay per D38 V-C, rail takeover, model picker, approval card, hints, build/sub-agent window, event stream) against the D43 Layer Law (library layers now literally enforce the ruling), and writes the 8-question design interview Q1-Q8 with recommended defaults (tabs = build + event stream only; floating = gauges/picker/approval/hints per D38; chat never tabs or closes; tab set persists, scroll does not; window geometry persists clamped to terminal; keyboard parity for every window verb, drag mouse-only; the chat+tasks dichotomy survives with the tab bar above the panes; approval card unclosable while pending). Owner answers become D44+ rulings; no construction performed."
+  },
+  {
+   "slug": "release-pipeline-deepdive",
+   "match": [
+    "release-pipeline-deepdive",
+    "wave-release*",
+    "*tag-repair*",
+    "*auto-version*"
+   ],
+   "exemption": {
+    "category": "mechanical-repair",
+    "reason": "Owner queue item 5 (user:40-scale queue approval 2026-10-19, 'ive asked about this over and over so this needs a deep dive fix'): root cause proven from REAL CI run logs (Gitea runs 29929/30435/30636 — exit 141 SIGPIPE on 'git tag --sort=-v:refname | head -1' under pipefail with 500+ tags, killing the bump step on its first line before any fallback; plus tui-release aborting on empty GITEA_REF_NAME). Bounded mechanical fix: scripts/tag_repair.py (SIGPIPE-free for-each-ref read, idempotent ensure-tag, version>tag deadlock self-heal), red-first tests/test_tag_repair.py, workflow patches. E2E proof on local Gitea: two clean convergence cycles (0.400.0→0.401.0→0.401.1) + deadlock self-heal probe, all tags auto-pushed, tui-release resolved its tag via the fallback chain. No new research questions."
+   }
+  },
+  {
+   "slug": "factory-harness-vs-model-coding",
+   "match": [
+    "factory-harness-vs-model-coding",
+    "harness-vs-model-coding",
+    "harness-vs-model"
+   ],
+   "chain": "research/factory-harness-vs-model-coding/synthesis.json",
+   "verdict": "PROCEED",
+   "note": "Research-only wave (2026-10-19), no construction. Owner question: do harnesses let models fully handle coding, or do harnesses impose quality procedures? Chain: outward.json (8 live sources incl. Anthropic building-effective-agents, Cognition don't-build-multi-agents, Codex published system prompt, CC prompt corpus mirror, SWE-bench Verified methodology, Agentless/SWE-agent ACI papers, Aider leaderboard), inward.json (honest audit of rune's mechanical enforcement vs model-trusted judgment), synthesis.md (plain-language owner report; industry consensus: model designs, harness verifies; rune sits at the most-procedural end; named risks: toll-booth friction and compliance theater found in the 2026-10-19 drift audit)."
+  },
+  {
+   "slug": "openspec-tabs-windows-chat-presentation",
+   "match": [
+    "openspec-tabs-windows",
+    "openspec-chat-presentation",
+    "interview-tabs-windows",
+    "interview-chat-presentation"
+   ],
+   "chain": "docs/openspec/changes/add-native-rune-tui/interview-tabs-windows.md + interview-chat-presentation.md",
+   "verdict": "PROCEED",
+   "note": "Owner directive 2026-10-20: 'can we use open spec for tabs windows and defaults for those aspects. and can we openspec how i want the chat to look'. Research-only interview wave, no construction. Turns the 8 prepared questions (research/factory-tabs-windows/00-interview-prep.md, already registered) plus the post-prep Layer Law context into two OpenSpec interview documents: interview-tabs-windows.md (TW-1..TW-8, SA-D/R2-D style: premises, commitments per answer, RECOMMENDED defaults — tabs = build + event stream; floating = gauges/model-picker/approval/hints per D38 V-C; chat never tabs or closes; tab set persists, scroll does not; window geometry persists clamped; keyboard parity with drag the sole mouse exception; the chat+tasks dichotomy survives with the tab bar above; approval card unclosable while pending) and interview-chat-presentation.md (CP-1..CP-5 grounded in the landed render stack D34-D47 + canon C1-C9: strong paragraph/list/code contrast; styled inline markdown; thinking bridge only-while-thinking; chat code = clickable stub card, full block in tasks pane per D44/D46; day markers + jump-to-unread adopted). The main session presents the questions; owner answers become D48+ rulings before any build wave."
+  }
+ ]
+}

docs/factory/spawn-queue.md

@@ -0,0 +1,81 @@
+# Factory spawn queue — pre-written briefs (standing backlog)
+Owner directive 2026-10-16 (amended same day): **every brief spawns as RESEARCH FIRST, then BUILD** — per feature, run the canonical research protocol (ISSUE→INWARD→OUTWARD→APPLICABILITY→INNOVATION-on-merit→ADVERSARIAL→SYNTHESIS→QUALIFY, depth adaptive per the standing law) before any construction code. The build wave spawns only on QUALIFY: PROCEED; MORE_RESEARCH loops back with named unknowns. Owner is quizzed at topic boundaries with design latitude. Briefs below carry their research question; the research wave runs first. Completion of any wave auto-triggers the next brief's spawn. Main session pops top-of-queue, adjusting only for sibling collisions.
+
+## PRIORITY 0 — B-FACTORY-PROTOCOL (owner directive 2026-10-17: the factory is a RUNTIME FEATURE, not session process)
+The factory orchestration (wave spawning, contract tracking, landing gates, spawn queue, continuous backfill, mechanical>behavioral priority, scale ladder 20→30→50) becomes FIRST-CLASS CODE in three places:
+- **Rune runtime (Go):** src/go/factory/ — orchestration engine (spawn, contracts, gates, queue, backfill) as a library + thin shell; seam-registry socket "factory-orchestration" with deletion test.
+- **TUI:** factory surface — waves as threads, contracts as briefs, gate results as receipts, live worker states in the task tree.
+- **mimo Rune (Python):** the same protocol ported (factory_protocol.py) — works in both worlds during migration; parity harness proves the implementations agree before the old retires.
+Build: research protocol first (per the standing research-gate law), then build waves. THIS IS THE TOP OF THE QUEUE.
+
+## Queued briefs (REORDERED by owner 2026-10-17 — chat/tools/providers/visual FIRST, Sleight memory + Plan loop DEFERRED to after retirement campaign)
+Owner's reasoning: the face has no chat window, no tools wired to use, no providers connected — nothing testable end-to-end. Memory compaction (Sleight) without a working conversation to compact is counter-intuitive. Visual round needs heavy owner critique and accurate design-intent portrayal. Deferred: Sleight matrices, Plan loop, self-transformation pipeline.
+
+**Priority 1 — CHAT + TOOLS + PROVIDERS (makes the face testable):**
+1. **B-CHAT-LIVE** (phase 2/5 depth): real chat through the library seam — conversation store wired, model-routing called, streaming to the lane, receipts. The face becomes usable.
+2. **B-TOOLS-LIVE** (1.3 + toolexec in-process): tool dispatch wired through the TUI — tools_registry surfaced, live-proof receipts feed status, tool calls from chat work end-to-end.
+3. **B-PROVIDERS-LIVE** (1.3): provider connections (Ollama first — it's local), auth/status/selection through model-routing library, live-proof receipts.
+4. **B-VISUAL-ROUND** (0.0.5/5.3): three grounded design directions on the tested base — owner critiques iteratively (design-intent portrayal tooling: screenshots/pty captures for accurate feedback), owner picks.
+
+**Priority 2 — after the face is testable and looks like Rune:**
+5. **B-RETIRE-CAMPAIGN** (7.2/7.3): parity harness runs capability by capability, PROVEN rows trigger same-change Python removal.
+6. **B-WASM-EXPANSION** (D30): more Rust crates migrate in-process per batteries.
+
+**Deferred — after retirement campaign:**
+7. **B-SLEIGHT-MATRIX** (3.4b/c/d): memory compaction matrices — counter-intuitive before real conversations exist to compact.
+8. **B-PLAN-LOOP** (4.2): full Plan process.
+9. **B-SELF-TRANSFORM** (6.2/6.2a/6.3): self-modification pipeline + taxonomy closure.
+
+**Small cleanups (noted by owner, next UI wave):**
+- Bottom rail: remove duplicated focus/status tokens from the RAIL line (partially done — the RAIL-line render still shows them in the takeover view per owner report)
+- Bottom rail: truncate identity to 'Rune v<semver>' (drop build/unset noise)
+- Rail line generally: strip unneeded information, keep last-event + version + inspect key
+
+## In-flight (do not re-spawn)
+I3-command-paths, DEP05-depth, trust-runtime, skills-engine, mcp-settings, parity-harness(landed), continuous-runtime(landed), bounded-stream(landed), live-tool-proof(landed), effect-mediation(landed), memory-invariant(landed), hard-modes(landed), cooling(landed), gateway-sec(landed), authority-map(landed), ledger-lineage(landed), curator(landed), critic-gate(landed), event-vocabulary(landed), lane-concurrency(landed), child-visibility(spawned), universal-input(landed), parity(landed), terminal-budgets(landed), graph-projection(landed), history(landed), seam-registry(landed), retirement-map(landed), evidence-spine(landed), error-wrapping(landed), pprof(landed), restore-points(landed), model-acquisition(landed), device-pairing(landed), extension-host(landed), webfeed(landed), alert-gateway(landed), workflow-engine(landed).
+
+## Blocked (need owner or predecessor)
+- 5.3 visual directions: needs behavior-map USE + owner pick (R2-D7)
+- 6.4 extension UI: needs 6.4 runtime (landed) + UI wiring wave
+- 1.3d real-hardware qual: needs physical second device (owner's)
+- 7.3 python removal: needs 7.2 harness + PROVEN rows
+- 7.4 gitea closure: last
+
+## Scope law (owner amendment 2026-10-17)
+Every factory registry, gate, and map covers the FULL codebase: TUI packages, Go subsystems/libraries, Rust crates (104, the dichotomy), and the live Python authority modules (mimo rune's deployed surfaces, retirement-tracked). No tool may be built TUI-only when the dichotomy and the retirement campaign are standing architecture.
+
+## NEW PRIORITY 0 — FIRST-RUN FLOOR + PROVIDER MIGRATION (owner directive 2026-10-17, CORRECTED: approach guidance, not spawn-now — providers are NOT prioritized ahead of current waves)
+Build rune as if someone were using it publicly for the first time:
+- **B-FIRST-RUN**: first-run experience — onboarding flow, connect services, the floor of the build assumes a brand-new user.
+- **B-PROVIDERS-EXTENSIVE**: extensive cloud + local provider list (cloud: OpenAI, Anthropic, Google, Mistral, Groq, Together, Fireworks, DeepSeek, xAI, OpenRouter, + any others; local: Ollama, llama.cpp, LM Studio, vLLM), easy connect flow.
+- **B-APIKEY-MIGRATION** (owner-critical, for THIS machine): port ALL API keys and saved connections from mimo code (~/.config/opencode + mimo config stores) into rune — same keys, same semantics, respected exactly, so everything works without Nick re-entering anything. He has API keys from friends he cannot remember — the migration must be lossless. Keys persist per the security law (encrypted/OS store, never plaintext in UI/logs).
+
+## DESIGN INTENT INPUT (owner's Textual-TUI preferences — captured contracts, binding on the visual round)
+docs/tui-design-capture/ holds the frozen behavior contracts from the OLD Textual TUI (rune_tui.py era) — 1575 lines of the owner's actual preferences, captured as exact contracts. These are the VISUAL ROUND's primary input alongside the behavior map:
+- **8 role-styled bubbles**: user (right, blue 0,80,120), assistant (left, green 30,60,30), system (center), confirm (gold thick border), research (blue), error (red), tool (olive, 70% width) — exact rgb values captured
+- **Dark background** rgb(30,30,40) — the base theme
+- **Collapsible thinking bubble** (dim, left, collapsed by default)
+- **Tool widgets**: left-rail style (not boxes), 90% width, status line + details + approve/reject action row
+- **41 slash-commands** with stateful subcommand trees (/model, /theme, /goal, /cron, /night, /build, /work, /queue, /connect...)
+- **10 fixed themes** (nord, dracula default, monokai, solarized, catppuccin, tokyo-night, flexoki, gruvbox)
+- **Rune's spinner**: purple rotating diamond (12 PNG frames, 6.67fps, "Rune thinking...")
+- **Dual scrollback panes** side by side, newest at bottom, 3-line input
+- **Right-click copy menu**, viewport jumps to bottom on new message
+These preferences are the owner's — the three visual directions must incorporate them (not copy them literally: the behavior map + D31 govern the mechanics; these govern the LOOK and INTERACTION feel).
+
+## First-run law (owner directive 2026-10-17): NO default provider — selection is mandatory at first run
+Rune ships with NO provider selected, NO model configured. First run presents the provider selector (extensive cloud+local list) and the model selector; chat stays honestly unavailable ("no provider configured — select one to begin") until an explicit selection is made. The owner's own migration (API keys/connections ported from mimo) pre-selects for HIS machine, but the SHIPPED default for any new user is: nothing selected, selector presented, chat gated until chosen. This law binds B-FIRST-RUN, B-PROVIDERS-EXTENSIVE, B-APIKEY-MIGRATION, and B-CHAT-LIVE (the chat build must not silently default to Ollama — selection is always explicit).
+- **Fresh-state detection (owner directive):** the TUI must KNOW when it's a fresh state (no provider configured, no conversation history, first boot) and present the first-run experience accordingly — provider/model selector instead of chat, honest welcome state instead of empty-looking lanes. Fresh-state = no provider selection recorded + no conversation checkpoint. Not the same as error: it's the designed first-run path.
+
+## B-PERSONA-LAYER (owner, 2026-10-18: "runes persona layer is not ported either which is important")
+The chat path answers as the BARE MODEL today — no identity assembly. PORT THE PERSONA: who Rune IS (identity) + how she speaks (voice) + what she remembers (memory grounding) + how she stays herself (drift governance) — the mimo harness stack is the reference; the repo's partial machinery (voice_state, persona_check, drift_core, memory_continuity) is the starting inventory. Research first (what the layer actually is, how production agents do persona), then an owner interview on what carries into the product Rune (his taste is central — it is HER identity), then the build into the Go core's context assembly (D39: intentions port).
+
+## OWNER APPROVED QUEUE (2026-10-19 — the 40-scale wave plan, rulings attached)
+1. ✅ VERIFICATION SPEED-UP (split the 10-min checkup into parallel pieces + backfill the ~20 missing receipts) — approved.
+2. DICHOTOMY COMPLETION — approved with correction: the OpenSpec interview DID cover the one-input-box concept; the owner may need to specify finer details. LAW: the consent-card build starts from the SPEC'S EXISTING interview answers (R2-D/SA-D records), NOT from the research round's re-derivation; where the build hits an un-interviewed detail, the wave ASKS rather than assumes. The three pieces (y/n card, watching-her-work live block, waiting-line discharge) proceed.
+3. PORT-THEN-INTEGRATE-THEN-REMOVE — owner correction to the retirement method: port the Go side, INTEGRATE it (repoint the live consumers, run integrated), THEN remove Python. "Port over and integrate the rebase before we remove." The same-change deletion pattern amends: removal happens only after a live integrated period proves the Go side in production.
+4. THE SUB-AGENT WINDOW (owner design, verbatim intent): a TAB in the tasks pane that ONLY appears when sub-agents are in flight. Click it → one row per sub-agent with: truncated task title, which sub-agent has it, running state. Everything clickable/expandable — expanding any sub-agent shows its thinking/coding process live. On the FRONT FACE: an indication that sub-agents are in flight + HOW MANY, dynamically correlated to reality (the landed waves counter + cluster feed it).
+5. RELEASE MACHINE — DEEP DIVE (owner: 'ive asked about this over and over'): not a patch. Pull the CI run logs for both failures, root-cause the tag-step's real failure mode, fix with tests, prove two clean cycles.
+6. HOUSEKEEPING — approved (Go-core supervision swap + /tmp GC).
+7. TABS/WINDOWS — approved: design interview first, then build.
+50-scale distribution: 24 waves spawned this batch

docs/openspec/changes/add-native-rune-tui/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-10-14

docs/openspec/changes/add-native-rune-tui/deliverables/sleight/README.md

@@ -0,0 +1,35 @@
+# Sleight §18 deliverables — memory/context continuity (spec 3.4d)
+
+Produced within the existing active TUI change per Sleight §18. Evidence
+artifacts live in `verification/sleight-matrix/` (generated by
+`scripts/gen_sleight_matrix_receipts.py` from the same row functions the
+frozen suites in `tests/test_sleight_{scenarios,matrix,chaos}.py` assert;
+staging: `tests/sleight_staging.py`). Research chain:
+`research/factory-sleight/` (QUALIFY: PROCEED).
+
+| § | Deliverable | Where |
+|---|---|---|
+| 18.1 | Ownership diagram | [ownership-diagram.md](ownership-diagram.md) |
+| 18.2 | exists/wired/reachable/used/authority module audit | [ownership-diagram.md](ownership-diagram.md#module-audit) |
+| 18.3 | OpenSpec requirements + S01–S15 scenarios | already binding: `../../specs/memory-context-continuity/spec.md` + `../../tasks.md` 3.4a–d (referenced, not duplicated — Sleight §14 forbids a second spec hierarchy) |
+| 18.4 | UI states / wireframes | [ui-states.md](ui-states.md) |
+| 18.5 | Interface schemas: events / cancellation / errors / token accounting | [schemas.md](schemas.md) |
+| 18.6 | Phased dependency + test plan | [phased-plan.md](phased-plan.md) |
+| 18.7 | Compatibility / migration plan | [phased-plan.md](phased-plan.md#migration--compatibility-plan-18) |
+| 18.8 | Guarantee boundary (lossless retention vs probabilistic retrieval) | [guarantee-boundary.md](guarantee-boundary.md) |
+
+Matrix evidence (spec 3.4b/3.4c):
+
+- `verification/sleight-matrix/scenario-rows.json` — S01–S15, 15/15 PASS
+  (S10 behavioral half tagged MODEL_DEPENDENT_DEFERRED).
+- `verification/sleight-matrix/deterministic-results.json` — §16.1, 9/9 (100%).
+- `verification/sleight-matrix/semantic-metrics.json` — §16.2 actual values
+  (exact_recall_integrity 1.0, topic_resume_success 1.0 on 12 interleaved
+  topics, commitment_loss 0.0, pointer_liveness 1.0 …) + the deferred
+  model-dependent registry (never claimed as measured).
+- `verification/sleight-matrix/chaos-receipts.json` — §16.3, 13/13 faults
+  with explicit degraded/recovery receipts, all recoverable.
+
+**Do not claim implementation success from a spec alone** (Sleight §18
+closing law): every statement above traces to a row in those artifacts or
+a file:line in the tree.

docs/openspec/changes/add-native-rune-tui/deliverables/sleight/guarantee-boundary.md

@@ -0,0 +1,54 @@
+# §18.8 Guarantee boundary — what is lossless, what is probabilistic
+
+The release SHALL separate lossless source retention from probabilistic
+semantic retrieval. This is that boundary, stated as testable law.
+
+## GUARANTEED (deterministic, 100% in controlled fixtures — §16.1 receipts)
+
+1. **Lossless source retention.** Committed evidence rows are never
+   rewritten by cooling, rehydration, paging or cache purges — SHA-256
+   over the full entries+audit ledger is byte-identical across every such
+   operation (INV-2). The only legal deletion is the authorized, audited
+   right-to-forget wipe (S11).
+2. **Exact-by-ID recovery.** Any committed ID returns its verbatim bytes
+   verified against the recorded digest, or a typed error
+   (SOURCE_CORRUPT / NOT_FOUND_CONFIRMED) — never a paraphrase labelled
+   exact (S03, INV-1: exact_recall_integrity = 1.0 measured).
+3. **Checkpoint durability.** An acknowledged checkpoint replays to the
+   same canonical revision after crash/restart, with commitments intact
+   and zero double side effects (S08, INV-4, commitment_loss_rate = 0.0).
+4. **No fabricated continuity.** Broken/tampered pointers can never yield
+   a "verified" claim — POINTER_BROKEN / SOURCE_CORRUPT with named
+   entries (S15, pointer_liveness = 1.0 measured).
+5. **Single model-visible path.** Every outbound byte traces to admitted
+   ContextBroker blocks; mandatory blocks are present or the request
+   refuses (INV-6/INV-7, F12).
+6. **Honest degraded states.** Every injected fault surfaces an explicit
+   degraded/recoverable receipt (F01–F13); a broken subsystem can never
+   render "ready" (S04, S09).
+7. **Privacy by scope.** Policy-deleted memory is wiped in scope and can
+   never re-enter retrieval, rehydration or any child/provider payload
+   (S11, INV-8, INV-9).
+
+## NOT GUARANTEED (probabilistic, measured — never claimed perfect)
+
+1. **Semantic retrieval quality.** Whether the RIGHT memory surfaces for
+   a natural-language need is probabilistic (hybrid dense+BM25+metadata).
+   Actual values are published per release (semantic-metrics.json); the
+   live-judge metrics (recall@k, answer grounding, live false-recollection,
+   cache efficiency) are deferred to the B-CHAT-LIVE layer and stay TAGGED.
+2. **Topic detection from natural language.** Only EXPLICIT topic
+   IDs/shifts are exercised (Sleight §15 Phase 3: NL detection only after
+   tests); implicit-return recognition is not claimed.
+3. **Persona/identity behavioral stability under live models.** The
+   deterministic half (identity block non-evictable, present-or-refuse,
+   S10) is guaranteed; behavioral regression scoring needs a live model.
+4. **Cross-provider semantic equivalence.** Continuity (state, digests,
+   obligations) survives swaps — guaranteed (S07). Response QUALITY parity
+   across providers is out of scope.
+
+## The line, in one sentence
+
+Attention, paging, caches and retrieval ranking may change what the model
+SEES; nothing except an authorized wipe may change what the store REMEMBERS
+— and every claim about either is a receipt, not a vibe.

docs/openspec/changes/add-native-rune-tui/deliverables/sleight/ownership-diagram.md

@@ -0,0 +1,68 @@
+# §18.1 Ownership diagram + §18.2 module audit — memory/context continuity
+
+## Ownership diagram
+
+```
+                        ┌────────────────────────────────────────────────┐
+                        │                TUI (observer)                 │
+                        │  tui/memory lane · rail · degrade surfaces    │
+                        │  observes statuses; NEVER invents state       │
+                        └───────▲────────────────────────▲───────────────┘
+                                │ typed events (v1)      │ inspect/status
+                                │ topic_changed · topic_rehydrated ·      │
+                                │ checkpoint_committed · context_paged    │
+                ┌───────────────┴────────┐   ┌───────────┴──────────────┐
+                │   Spine (task truth)   │   │  memory_status() lanes   │
+                │ task refs · authority  │   │  store/dense/lexical     │
+                └───────────▲────────────┘   └───────────▲──────────────┘
+                            │ task_ref/checkpoint        │ typed statuses
+        ┌───────────────────┴────────────────────────────┴─────────────┐
+        │                    ContextBroker (SOLE model-visible)        │
+        │  collect → measure → admit (budget + memory sub-budget)      │
+        │  → render capsule; trace: admitted/dropped + reason          │
+        │  ONE memory selection road: memory_selector.select_for_task  │
+        │  + the K15 continuity road (memory_continuity.working_set,   │
+        │  K16 SOURCE_ALLOWLIST amended with the named live consumer)  │
+        └───────▲──────────────────────────────▲───────────────────────┘
+                │ ContributionBlock(s)          │ working_set → blocks
+   ┌────────────┴───────────┐    ┌─────────────┴──────────────┐
+   │ memory_selector        │    │ memory_continuity (K15)    │
+   │ (general recall road)  │    │ TopicContinuity: foreground│
+   └────────────▲───────────┘    │ /cool/rehydrate; checkpoints│
+                │                │ read_by_id · correction ·   │
+                │                │ forget · purge · status     │
+                │                └─────────────▲──────────────┘
+                │                              │ seam over
+        ┌───────┴──────────────────────────────┴───────────────┐
+        │        memory_store — CANONICAL SOURCE (SQLite+FTS+vec)│
+        │  entries (verbatim rows) · audit_log (hash-chained)    │
+        │  derived: entries_fts / entries_vec (disposable)       │
+        └──────────────────────────▲─────────────────────────────┘
+                                   │ last-byte provider payload
+                        ┌──────────┴──────────────┐
+                        │  external harness/provider boundary        │
+                        │  (payload = capsule render; nothing else   │
+                        │   may append — INV-7 proven per assembly)  │
+                        └────────────────────────────────────────────┘
+```
+
+Authority: Spine owns task truth; the store owns evidence;
+`memory_continuity` owns attention state + checkpoints (pointer digests
+only — verification re-reads the store); ContextBroker owns the ONLY
+model-visible representation; TUI observes.
+
+## Module audit
+
+| module | exists | wired | reachable | used | authority | discrepancy vs Sleight target |
+|---|---|---|---|---|---|---|
+| `src/rune/memory_store.py` | ✔ | ✔ | ✔ | ✔ (recall, audit_verify) | canonical evidence + recall + hash-chained ledger | none |
+| `src/rune/memory_continuity.py` | ✔ | ✔ (live operator road) | ✔ | ✔ (K15 suite + this matrix + the operator's `continuity` contributor) | cooling/rehydration/checkpoints/correction/forget/purge | none — live wiring landed (wave sleight-live-wiring): the K16 frozen suite was amended with the named live consumer |
+| `src/rune/context_broker.py` | ✔ | ✔ | ✔ | ✔ | sole model-visible representation; budgets; trace | none on the invariant; broker is Python-authority with Go parity twin (dichotomy debt noted in retirement map) |
+| `src/rune/memory_selector.py` | ✔ | ✔ | ✔ | ✔ | the ONE selection API for general recall | none |
+| `src/rune/rune_operator.py` (`_context_broker`) | ✔ | ✔ | ✔ | ✔ | registers the frozen seven contributors (memory pair: selection + continuity) | none |
+| `tui/memory` (+ rail/degrade) | ✔ | ✔ | ✔ | ✔ | observation of status lanes | inspector depth (§13 surfaces) grows in later TUI waves |
+| `schemas/events/v1` (topic_changed, topic_rehydrated, checkpoint_committed, context_paged) | ✔ | ✔ | ✔ | ✔ | typed event vocabulary | none |
+| semantic live metrics (recall@k, grounding, cache efficiency) | ✖ | — | — | — | deferred | **named gap: B-CHAT-LIVE conversation layer** (owner reordering 2026-10-17) — tagged, not faked |
+
+Discrepancy handling per spec: every not-yet-built dependency above is
+TAGGED with its named consumer/gap; none is faked.

docs/openspec/changes/add-native-rune-tui/deliverables/sleight/phased-plan.md

@@ -0,0 +1,61 @@
+# §18.6 Phased dependency + test plan · §18.7 migration/compatibility
+
+## Phased plan (Sleight §15 mapped to landed state)
+
+| phase | Sleight exit criterion | state | evidence |
+|---|---|---|---|
+| 0 — live-path audit, baselines | authority/read/write map + context blocks known | **DONE** (K1 authority map 0.128.0; K16 Phase-0 invariant suite) | docs/authority-map.md; tests/test_memory_invariant_regression.py |
+| 1 — canonical source + durable continuity | exact-by-ID recall, source fixity, task restart on real tests | **DONE** | INV-1/INV-4; scenario-rows S03/S08 |
+| 2 — single ContextBroker + typed manifests | byte-level outbound trace; zero-cost inactive systems | **DONE** | INV-6/INV-7; K16 sole-representation tests |
+| 3 — topic state, cold ghosts, resume capsules | A→B→A + 10+ interleaved-topic fixtures, no cross-contamination | **DONE** (runtime + live operator wiring, wave sleight-live-wiring) | S01/S02; semantic-metrics `topic_resume_success` 1.0 on 12 interleaved topics |
+| 4 — typed compaction + sufficiency | evidence unchanged by paging; obligations survive; retrieval expands | **DONE (pressure half)** · reflection-before-eviction policies land with the conversation layer | INV-2; S05; F12 |
+| 5 — TUI surfaces + child integration | UI matches backend traces; pending/degraded/verified distinct | **PARTIAL** — status lanes live; inspector depth in later TUI waves | ui-states.md (every state receipt-mapped) |
+| 6 — outcome learning + optimisation | experienced Rune beats fresh at ≤ cost | **NOT STARTED (deliberately dormant)** | Sleight §15: only after prior phases demonstrably work |
+
+## Test plan (layered; all deterministic layers landed)
+
+| layer | tests | status |
+|---|---|---|
+| unit (typed statuses, digests, filename collision-proofing) | inside K15 suite + INV-1 | green |
+| integration (store + continuity + broker) | S01–S15 rows; INV-2…INV-9 | green (15 + 9) |
+| crash/restart | F01/F02, INV-4, S08 | green |
+| provider swap | S07, `model_swap_continuity` 1.0 | green |
+| cache wipe | S09, F10 | green |
+| historical recall | S03, S06, INV-3 | green |
+| A→B→A / interleaved | S01/S02 + 12-topic metric | green |
+| failed retrieval / privacy | S04, S11, INV-8, INV-9 | green |
+| chaos (§16.3 full list) | F01–F13 receipts, all recoverable | green |
+| semantic (live judge, recall@k, grounding, cache efficiency) | **deferred → B-CHAT-LIVE** | tagged |
+| A/B rolling-summary vs ledger paging (§16.3) | **deferred → B-CHAT-LIVE** (needs same-model live conversations) | tagged |
+
+Run: `python3 -m pytest tests/test_sleight_scenarios.py tests/test_sleight_matrix.py tests/test_sleight_chaos.py`
+(69 green incl. K15+K16). Receipts:
+`python3 scripts/gen_sleight_matrix_receipts.py`.
+
+## Dependency order for the deferred tail
+
+B-CHAT-LIVE (conversations + providers) → live semantic metrics + A/B
+paging study → Phase-4 reflection policies → Phase-5 inspector depth →
+Phase-6 outcome learning. Nothing in the deferred tail is a precondition
+for the landed guarantees.
+
+## Migration / compatibility plan (§18.7)
+
+| thing | disposition |
+|---|---|
+| `memory_store` (SQLite+FTS+vec, audit ledger) | **RETAINED** — canonical source; extended in place (correction/forget seams), never replaced (Sleight §17 anti-pattern: no new memory DB) |
+| `memory_continuity` runtime (K15) | **RETAINED — LIVE-WIRED** (wave sleight-live-wiring): the operator registers the `continuity` contributor; the K16 frozen suite was amended with the named live consumer (SOURCE_ALLOWLIST + FROZEN_CONTRIBUTORS) and the matrices run against the production road |
+| `memory_selector` selection API | **RETAINED** — the single general-recall road; continuity rides memory sub-budget beside it post-wiring |
+| six parallel memory contributors (P1-03 #26) | **REMOVED (stays removed)** — K16 fails closed on any resurrection |
+| derived caches (fts/vec/recall cache) | **DISPOSABLE** — purge-proven (S09/F10); reindex recovers |
+| semantic live metrics | **DEFERRED** — tagged to B-CHAT-LIVE; no API reserved |
+| TUI memory surfaces | **EVOLVING** — lanes live; inspector/toast states specified receipt-mapped (ui-states.md) |
+| checkpoint schema | **VERSIONED** (`schema_version: 1`); readers isolate + name corrupt files per-topic (never silently skipped) |
+
+Rollback: deleting `tests/test_sleight_*`, `tests/sleight_staging.py`,
+`scripts/gen_sleight_matrix_receipts.py`, `verification/sleight-matrix/`,
+and this deliverables dir removes the matrix capability completely — no
+production file is modified by this wave (git-clean diff proves it).
+(The later live-wiring wave DID touch production deliberately:
+rune_operator's `continuity` contributor + the governed K16 amendment.)
+

docs/openspec/changes/add-native-rune-tui/deliverables/sleight/schemas.md

@@ -0,0 +1,102 @@
+# §18.5 Interface schemas — events, cancellation, errors, token accounting
+
+All shapes below are the ones the landed runtime actually emits (file:line
+anchored); the events are already frozen in `schemas/events/v1/`.
+
+## Typed result statuses (memory_continuity.py:53-57)
+
+```
+FOUND_VERIFIED | FOUND_UNVERIFIED | SOURCE_CORRUPT | POINTER_BROKEN |
+NOT_FOUND_CONFIRMED
+```
+
+Silence, no-match, stale index, unavailable store, corrupted source are
+DISTINCT statuses — never conflated into "remembered"/"forgotten"
+(MUST-10; proven across S04, F06, F07, F08 receipts).
+
+### Exact-by-ID read (read_by_id, :112)
+
+```json
+{"status": "FOUND_VERIFIED", "entry_id": 12,
+ "text": "<verbatim original bytes>", "digest": "sha256:…"}
+{"status": "SOURCE_CORRUPT", "entry_id": 12,
+ "expected_digest": "sha256:…", "actual_digest": "sha256:…"}   // no text
+{"status": "NOT_FOUND_CONFIRMED", "entry_id": 999999}
+```
+
+### Rehydration receipt (TopicContinuity.rehydrate, :517)
+
+```json
+{"topic_id": "topic:A", "status": "FOUND_VERIFIED",
+ "checkpoint_ref": "cp:1f9a…", "verified": 2, "total": 2,
+ "broken": [{"entry_id": 41, "reason": "entry_missing|digest_mismatch"}],
+ "working_set": [{"id": 12, "text": "…", "digest": "sha256:…"}],
+ "open_loops": ["…"], "source_digest": "sha256:…", "provider": "…"}
+```
+
+### Checkpoint (cool, :461 — versioned schema, atomic write)
+
+```json
+{"schema_version": 1, "checkpoint_id": "cp:…", "topic_id": "topic:A",
+ "task_ref": "task:301", "open_loops": ["…"],
+ "pinned_refs": [{"entry_id": 12, "digest": "sha256:…", "text": "…"}],
+ "provider": "… (observability only — S07)", "last_active_at": "ISO-8601",
+ "state": "committed"}
+```
+
+### Memory status lanes (memory_status, :145)
+
+```json
+{"status": "ready|degraded|unavailable",
+ "lanes": {"store": "ok|unavailable", "dense": "ok|degraded|index-unavailable",
+           "lexical": "ok|degraded|index-unavailable"},
+ "active_entries": 12}
+```
+
+## Events (schemas/events/v1/event.schema.json — frozen vocabulary)
+
+`topic_changed` · `topic_rehydrated` · `checkpoint_committed` ·
+`context_paged` (channel `system`/`conversation` per vocabulary.json),
+each with causal chain fields (K5 envelope); the TUI subscribes, never
+polls invention.
+
+## Cancellation semantics (S13 / INV-5)
+
+- Approved stop = `cool()`: returns a committed checkpoint (state
+  `"committed"`, task_ref + open loops verbatim) or RAISES — never a
+  silent partial state. Fail-before-state-change is proven by F04
+  (ENOSPC: topic stays HOT, evidence intact).
+- Duplicate delivery: rehydrate replay is byte-stable, no audit growth
+  (F11); a second cool is a NEW event (new checkpoint_id), never
+  conflated with a duplicate.
+- Task ownership never silently changes (task_ref in == task_ref out).
+
+## Error/degraded behaviours (chaos receipts = the contract)
+
+| fault | observed_status (machine) | UI |
+|---|---|---|
+| crash before/after ack | NOT_FOUND_CONFIRMED / FOUND_VERIFIED | row shows which |
+| db read-only | sqlite3.OperationalError (loud) | writes blocked banner |
+| disk full | OSError(ENOSPC); topic stays HOT | ⚠ + retry proof |
+| network / embedding outage | ConnectionError / lexical-only degraded | dense-lane degrade |
+| missing checkpoint | NOT_FOUND_CONFIRMED naming topic | named artifact |
+| stale index | degraded lanes; exact reads verified | lane detail |
+| forced budget | ContextOverflowError | refusal, never truncation |
+| child failure | contributor in `degraded[]` | scoped ⚠ row |
+
+## Token accounting (estimate vs actual — spec.md live-memory surfaces)
+
+- Broker measures every block with its estimator at assemble time
+  (`context_broker.py:745-750`) — tokens are MEASURED, not guessed.
+- Trace records `admitted_total`, per-block `tokens`, drop `reason`
+  strings (`budget: used+N>budget`, `memory budget: …>cap`), and
+  `memory_tokens` vs `memory_budget` (min(1200, window//8), P1-03 #26).
+- Estimate-vs-actual distinction: UI renders both the estimate and the
+  measured trace count (ui-states.md status line).
+
+## Semantic metrics artifact schema (§16.2)
+
+`verification/sleight-matrix/semantic-metrics.json`:
+`measured` (11 deterministic values incl. actual `rehydration_latency_ms`
++ sample count) and `model_dependent_deferred` (metric → named gap).
+Deferred rows are DATA — the artifact cannot be misread as a claim.

docs/openspec/changes/add-native-rune-tui/deliverables/sleight/ui-states.md

@@ -0,0 +1,75 @@
+# §18.4 UI states / wireframes — memory & context surfaces
+
+Sparse by default (Sleight §13): state is shown when it changes or when
+inspected — never an always-on memory dump. Anchored to landed surfaces
+(tui/memory, rail, degrade) and the typed statuses the runtime actually
+returns; the TUI renders backend receipts, never its own invention
+(spec.md "Inspector on degraded memory": never a simulated "healthy").
+
+## Memory status line (rail / memory lane)
+
+```
+┌ memory ────────────────────────────────┐
+│ ● ready      12 active · 2 cooled      │   ready/degraded/unavailable
+│ ◷ topic:A (hot) · topic:B · topic:E    │   working topic + cooled count
+│ ctx 3.1k/8.0k (est) · 2.9k measured    │   estimate vs actual distinct
+└────────────────────────────────────────┘
+degraded variant (from chaos receipts):
+│ ◐ degraded   lexical: index-unavailable│   lane detail on expand —
+│              dense: degraded           │   exactly the failed subsystem
+unavailable variant:
+│ ○ unavailable store: unavailable       │   never "ready" while broken
+```
+
+## Topic transition toast (S01/S02)
+
+```
+┌─ ⇄ topic:A → topic:B ──────────────────┐
+│ checkpoint cp:1f9a… committed          │   checkpoint_committed event
+│ topic:A cooled — 2 refs, 1 open loop   │   evidence stays, attention moves
+└────────────────────────────────────────┘
+return:
+┌─ ⇄ topic:B → topic:A ──────────────────┐
+│ rehydrated ✓ verified 2/2 (cp:1f9a…)   │   verified/total from receipt
+│ pointer broken: #41 entry_missing ✗   │   S15: visible limitation row
+└────────────────────────────────────────┘
+```
+
+## Context inspector (expand from the memory lane)
+
+```
+┌ context blocks (assembled) ───────────────────────────────┐
+│ [persona]   19 tok  non-evictable  admitted               │
+│ [memory]    46 tok  evictable      admitted (selector)    │
+│ [memory]    dropped  budget: 61+46>40 (lowest-priority)   │ ← S05 reason verbatim
+│ [user]       4 tok  non-evictable  admitted               │
+│ source refs: #12 sha256:ab… ✓ · #13 sha256:cd… ✓          │
+│ last transition: topic:B → topic:A (rehydration) 12:03:41 │
+└───────────────────────────────────────────────────────────┘
+```
+
+Provenance renders derivation only (spec.md "Provenance shows derivation,
+never truth"); validity/authorization are their own fields.
+
+## Degraded / recovery banner (chaos receipts → UI)
+
+```
+│ ⚠ memory degraded — checkpoint write failed (ENOSPC)      │
+│   topic:C stays hot; no data lost; retry writes the file  │
+│ ✓ recovered 12:04:02 — cp:77c… committed + verified       │
+```
+
+Every banner state maps 1:1 to a chaos-receipts.json row
+(F01–F13): observed_status → headline; degraded_lanes → detail line;
+recovery_proof → the ✓ line. No state exists without a receipt shape.
+
+## Child tool events (scoped)
+
+```
+│ ⚠ child_agent failed: named in degraded list; assembly    │
+│   continued — no fabricated memory (F13)                  │
+```
+
+Deferred (tagged): richer evidence drill-down viewer and GUI Mind-Palace
+projections stay behind later TUI waves; nothing here reserves an API
+(no-reserved-APIs law).

docs/openspec/changes/add-native-rune-tui/design.md

@@ -0,0 +1,119 @@
+# Design: add-native-rune-tui
+
+## Context
+
+The pre-interview draft treated the TUI as a screen over existing machinery and assumed six modes, sessions, prompt-per-action permissions, automatic fallback, and Textual command parity. Evidence demolished those assumptions. Authority now comes from your interviews, the live-checked harness survey, your Sleight-of-Hand contract, the qualified self-transformation and speech protocols, and the open-question register. Unresolved technical choices are blocking Task 0.0 design gates; implementation may not settle them by accident.
+
+## Goals / Non-Goals
+
+**Goals:**
+- One continuous program; the TUI is my attachable face and does not define my lifetime.
+- Every settled decision traces to your answer or cited evidence; every unsettled choice has a named pre-implementation gate.
+- Mimocode retires capability-by-capability through observed parity + improvement.
+- My self-transformation uses the same repaired authority chain as every other protected change.
+
+**Non-Goals:**
+- Implementation before your review and a READY_FOR_NICK_REVIEW independent audit.
+- Voice implementation (speech QUALIFY: PROCEED as deferred accessibility-first specification; this change reserves four seams only).
+- Later GUI domain separation and richer presence.
+- Offline cognition architecture design (SA-D5: the socket is reserved day-one per SA-D6; the architecture itself is a future design problem with no spec here).
+- The dichotomy rebase's own sequencing.
+
+## Decisions
+
+**D1 — One program, attachable faces.** You rejected a separate engine/screen split. Approved desktop/laptop/phone/web faces share my live state; input is origin-tagged and ordered. Minimize changes nothing; explicit Exit writes a continuity checkpoint; crash recovery replays safely. Desktop is canonical coordinator/default execution home; phone chiefly directs; laptop may execute eligible local work. Pairing uses a short expiring one-time code; disconnected faces show stale last-known state and local drafts, then synchronize before sending.
+
+**D2 — Two lanes, no sessions.** Task executes; Chat thinks with you and never interrupts Task by default. Explicit task language promotes immediately; ambiguous task-worthy material becomes a suggestion. Promotion carries decision, evidence, and intended effect. Separate Steer-now and Queue-for-Task controls exist. Editing is forward instruction, never implicit rewind.
+
+**D3 — Plan mode is rare and complete.** Plan is offered only for sustained intent to make something tangible or by explicit request; contextual entry always needs consent. Planning lives in Chat. Once entered: intent plan → full research protocol → viability → evidence-informed plan → targeted research → final viability → your explicit start → contextually staged Task execution → independent review → final report. Material contradiction returns to Plan; no lite mode.
+
+**D4 — Act then show, with hard boundaries.** On your machine I act without routine prompts and post concise Chat receipts plus full Task/activity evidence. External-network origins, outside/mass/unprotected deletions, and self-change activation ask. Filesystem-event restore points precede every edit/delete/move, independent of turns or tokens.
+
+**D5 — Sovereignty and governed self-transformation.** Nothing external alters me. I may eventually change myself only through the qualified single authority chain owned by skills-and-growth. D01–D10, RM01–RM15, IAM01–IAM22, and DEP01–DEP07 bind it. Proposal/offline evidence may proceed; activation remains impossible until prerequisites are live-proven. Taxonomy labels remain inactive until the D02 protocol completes and you decide.
+
+**D6 — Sleight-of-Hand owns memory/context continuity.** Evidence survives paging; topics cool and rehydrate through verified pointers; ContextBroker is the only model-visible representation; Spine owns authority; the TUI never invents state. S01–S15, §16 tests, §18 deliverables, G1–G8, and MUST-01–MUST-18 are explicit acceptance obligations, with not-yet-built runtime work tagged rather than faked.
+
+**D7 — Passive-first alerts carry evidence.** Four types: finished, needs your decision, failed, permission. Desktop/sound/chat-gateway/webhook channels are independently toggleable and platform-general. Normal alerts fire only when unfocused/closed; destructive permission always alerts. Every alert names work and evidence; long absence produces a digest.
+
+**D8 — Activity rail instead of a permanent third pane.** Status shows activity/mode/model/device/context/tokens/cost/children. A rail below Chat/Task opens a full-width inspectable activity box and X restores both lanes. It exposes structured reasons and observable traces—not claimed hidden chain-of-thought. Activity is grouped by purpose, failures remain visible, and durable searchable/exportable records yield complete completion receipts.
+
+**D9 — Visual state is local, optional, and selected before implementation.** Research carries linked-source styling; built-in themes and a live editor follow your reactive palette. Character placement is compact-header plus light lane atmosphere. Expression reflects real state or explicitly specified emotion. Exactly three grounded visual directions must be shown and you select one. Static/accessibility fallbacks are blocking; pixel/3D polish is not retirement-blocking.
+
+**D10 — Retirement is earned.** Every mimocode capability maps to a native path and proof state. Retirement requires side-by-side real work plus failure/restart/recovery and live tool/provider proof. A proven Go/Rust replacement removes obsolete Python and dependencies in the same change; no indefinite fallback.
+
+**D11 — Accessibility deferred, honestly (R2-D1).** Screen-reader/AT work is deferred by owner decision: no accessible-parity claim is made anywhere, retirement does NOT gate on accessible parity, and the AT matrix (NVDA/VoiceOver/Orca with daily AT users, GAP-BT-01) runs only if/when prioritized — the named gap stays in research (synthesis I-R2-005; adversarial-2 AE-05), not in spec gates. The one semantic view/action model survives as shared renderer structure and the base for the three-direction visual selection, not as a parity claim.
+
+**D12 — Multi-device rests on real hardware (R2-D2).** The distributed promise stands only on real-hardware qualification runs as implementation-gated evidence: partition-while-revoked with durable clocks, measured capability attestation on heterogeneous hardware, and interrupted-upload/digest-mismatch/signed-provenance on real Gitea/Forgejo (synthesis I-R2-021; targeted-principal-device GAP-REMOTE-003/-006/-007, NEG-004; adversarial-2 AE-04/AE-10). Model-level coherence alone never suffices; simulations never suffice.
+
+**D13 — Collaboration is proposal-inbox only (R2-D3).** The proposal-inbox is the only permitted collaboration shape now (TUI_LATER); shared rooms remain possible only after a real malicious-guest attack test passes as the promotion gate (synthesis I-R2-002; targeted-principal-device OFF-001/INJECT-001/EXFIL-001/NEG-003). No room work enters this change.
+
+**D14 — Finance deferred, not safe (R2-D4).** Finance stays deferred with the capability retained on the future map; no connector work until a named connector and jurisdiction exist, then the provider sandbox suite runs first (stale approval, currency mismatch, timeout-after-effect, cumulative breach, revoked scope, ineligible account — synthesis I-R2-020, NOT_RUN_BY_CONTRACT). Spec text carries the deferral and first-use gates, not a feature.
+
+**D15 — Two new capability deltas now (R2-D5).** `extension-lifecycle` (I-R2-023) and `future-seam-registry` (I-R2-025) enter the packet now as SEAM_NOW capabilities, each with first-consumer/hardening gates written into the spec text: one command + one status card behind the proven hardening list; no-consumer-no-seam with CI deletion tests and keep/change/delete-only reviews.
+
+**D16 — Single-interface TUI; outside is a web link (R2-D6, owner custom — supersedes D1's multi-face framing).** The TUI is my single native interface. Anything outside the TUI is a WEB LINK providing a real-time feed that talks to me — a live, read-oriented view — never a second native TUI face. The future GUI owns multi-screen. Native TUI multi-face exists only if a real need appears. Desktop-canonical multi-face is demoted from retirement requirements; the envelope, origin-tagged ordering, and committed/pending distinction still govern the web feed and paired remote commands (I-R2-014 demoted accordingly).
+
+**D17 — Visual selection after the semantic map (R2-D7).** The behavior/semantic map (one semantic view/action model) comes first; the three-direction visual selection runs after it, on the shared action-isomorphic base, citing outward-ui-design-basics U-001..U-030 as rationale. Task 0.0.5 ordering reflects this.
+
+**D18 — First outside connection is the draft/calendar-browser handoff (R2-D8).** The draft/calendar-browser handoff (I-R2-019) is the first connector-shaped step — lowest API/legal/credential risk — then one governed connector. Connector work itself stays governed/deferred per its own named-connector + jurisdiction gates (I-R2-018/I-R2-020); handoff receipts record handoff, never publication.
+
+**D19 — All fifteen mitigations binding, with the no-dead-end amendment (R2-D9).** Every mitigation sign-off in synthesis `owner_signoff_mitigations` is approved as a binding constraint, distributed to its mapped capability. Owner amendment: no safety rule may become a dead end that prevents legitimate work — every deny path pairs with a fast owner-resolution/override path, and rules that block real tasks in practice get flagged and revisited, never silently enforced.
+
+**D20 — Phase-0 pre-build repairs are activation prerequisites.** The five live defects — scheduler stale-card trust, Ollama-vs-floor capability drift, register/update/revoke hardening gaps, subprocess without default-deny, aware/naive datetime crash — are fixed before any consumer work (synthesis build_instructions.phase_0; targeted-extension-placement lifecycle_threat_matrix/placement_probe/process_probe). The language-verdict manifest plus independent CI verdict gate (I-R2-011, GAP-GR-003, live N3: CI still bootstraps Python with no gate) is built before any retirement evidence is considered trustworthy; its machinery is shared with seam-registry deletion tests and guardrail fixtures.
+
+**D21 — Sub-agents fully visible and controlled (SA-D1/SA-D2; amendment ledger, `research/harness-survey/interviews.md`).** Every agent is spawned with an explicit brief, appears as a first-class child of the activity rail (expandable to live work per `work-observability`), is steerable mid-run, and is cancellable at a safe boundary — nothing runs invisibly. Your standing authority rule flows down the whole chain: on your machine agents act without asking per `trust-and-sovereignty`'s act-then-receipt/personal-mode rules (cited, not duplicated), every action leaves an evidence-bearing receipt, and agent-spawns-agent is permitted under the same rules with visible ancestry; observability is the control, not interception.
+
+**D22 — The living task tree (SA-D4; amendment ledger).** The Task lane hosts one full living tree per `task-management`: task objects with statuses, sub-tasks, dependencies, and blocked-by links; your direct reordering recorded and propagated; assignment to Rune or any agent (bridging to `sub-agent-orchestration`); full attributable history and audit. The lanes themselves stay owned by `dual-lane-interface` — referenced, never redefined.
+
+**D23 — Agent/task messaging reuses existing semantics (SA-D3; amendment ledger).** Processing and messaging are already specified: dual-lane promotion/steer rules and the alerts background-only + urgent-override rule. Agent-originated and task-originated messages follow those SAME rules — the amendment adds scenarios saying so to `dual-lane-interface` and `alerts-and-remote-control`; no new messaging semantics are invented.
+
+**D24 — Sockets everywhere from day one; cognition reserved (SA-D5/SA-D6; amendment ledger).** Every major subsystem — agent orchestration, task management, thread orchestration, messaging/promotion, cognitive architecture, connectors — exposes a registered socket with a stable contract and a deletion test at first build, expanding `future-seam-registry` under its existing no-consumer-no-seam rule (the building subsystem is the socket's first consumer). The cognitive-architecture socket is reserved day-one while its design stays an explicit future problem (SA-D5) — no architecture spec now.
+
+**D25 — Threads are the universal unit; one tree (owner thread-model addendum, 2026-10-15, same ledger).** All conversation and work organizes as threads per `thread-orchestration`: user-started, Rune-started, split, or agent workspace; every thread records origin, parent, inherited-context slice, live status, and result destination, traceable from any node to the root in one view; starting is explicit and originless threads cannot exist; splitting carries context to the fork, both sides continue independently, and the divergence point is permanently marked. Human splits and agent children live in ONE tree — no second system — rendered as a terminal-native thread tree view in `visual-system` (distinct from the GUI_ONLY memory-graph ruling I-R2-015, which governs memory graphs) with the honest linear text-path fallback, reachable from the activity rail with inline ancestry (`work-observability`).
+
+## Migration Plan
+
+Task 0.0 closes design questions before implementation; Task 0.0.5 (visual selection) runs after the semantic map per D17. Task 0A repairs truth/authority (runtime split, ledger, bypass writers, critics, owner envelopes, effect mediation, Sleight qualification). Task 0B (R2 build phase 0) fixes the five live defects and builds the language-verdict manifest + CI verdict gate before any consumer work — every later gate assumes them fixed (synthesis build_instructions). Work then proceeds through independent operation, visible operation, safe operation, deliberate operation, complete interface, growth, and capability retirement. Real-hardware device/forge qualification (D12) gates the multi-device promise; migration-oracle mutants and Python-dead-after-quarantine gate retirement (D10/D20). Seams — offline draft log, evidence spine, graph projection, memory invariant, placement, extension lifecycle, seam registry — are admitted only alongside their consumer fixture and deletion test, never ahead of consumers.
+
+## Risks / Trade-offs
+
+- The design is broad; named gates prevent implementation from becoming hidden product design.
+- Concurrent lanes require an approved shared-write ordering contract before code.
+- Self-transformation remains proposal-only until DEP01–DEP07 prove.
+- Terminal graphics vary; functional static/text fallbacks remain mandatory, and richer rendering unlocks only behind terminal-profile and budget gates (I-R2-006).
+- Aggregate single-loop performance under combined load (remote feed, progress IPC, receipts, decoration) is composition-tested only pairwise — GAP-GR-005 typing-under-flood stays the open test (A-PERFORMANCE-CASCADE).
+- Accessibility deferral (D11) means no parity claim exists; if AT users arrive before the matrix runs, the gap is real and documented, not hidden.
+- Deferral honesty: deferred finance/collaboration fronts must not be read as safe (I-R2-020, I-R2-002); each carries its recorded promotion gate.
+- The no-dead-end amendment (D19) trades strictness for owner throughput: deny rules need a fast override path, or they get revisited.
+- Speech licensing/security evidence justifies only four reserved seams now; voice implementation stays deferred.
+
+### D26 — Unified build & test substrate: one test world, generated boundary, paired builds (owner directive 2026-10-15)
+
+The Go↔Rust dichotomy's known failure modes are made structurally impossible rather than policed:
+
+- **Generated boundary shapes.** All Go↔Rust message definitions live in ONE schema source; both sides' types are code-generated from it. Hand-written shared shapes are forbidden; regeneration is atomic with schema change. Shape disagreement cannot arise.
+- **One test world.** A single runner executes Rust tests + Go tests + boundary round-trip tests (recorded corpus of real messages both sides must understand identically) + the language-verdict/regrowth fixtures + the migration mutants. Green means the whole system; partial (single-language) verification never counts as green.
+- **Paired builds + attestation.** Both sides compile in one build step stamped with one build identity; the Go face attests the Rust worker's build id at startup and refuses on mismatch (fail closed). No compiled artifacts are committed to the repo — builds are produced at landing/CI time from source.
+- **Landing rule.** Every landing (any work class) passes the unified runner; this is a cross-cutting gate like frozen-tests-first.
+
+### D27 — Versioned releases + in-TUI update offers (owner directive 2026-10-16: "the newest version gets pushed as a release… and auto-updates its TUI version semver-style")
+
+- **Version flow:** git tags (tui-vX.Y.Z namespaced) → build-time semver injection via the paired-build stamp mechanism → the face displays the real version → tag push cuts a Gitea release with the single self-contained binary attached. One version number across faces; convergence with the existing release pipeline, not a parallel one.
+- **Update offers go through the self-transformation + migration rules:** the face MAY check the Gitea releases feed and render an update offer (newer semver, release notes, binary digest) — an OFFER, never silent. Applying an update requires explicit owner consent, verified download (digest match), a restore point before the swap (file-change-safety), and the new version honestly displayed after restart. Failed verification rolls back to the restore point.
+- **No third-party update channels:** releases come from the owner's Gitea only; the check is read-only against the releases feed; no auto-execution of downloaded content without the full consent+verify+restore sequence.
+
+### D28 — Live task-tree: question-anchored, fractal, always-visible (owner ruling TD-1..TD-3, 2026-10-16)
+
+The Task lane shows question-anchored task trees: each tree is born from a question (its root), grows through resolution, then closes and the next question opens the next tree. Threads spawn trees-within-trees (sub-trees nest recursively inside their parent task). The tree is always visible on working tasks and fully live (statuses roll in real time) while fully workable (reorder/assign/dependencies/blocked-by from the lane). Supersedes any flat or persistent-list reading of the task-management capability; tui/tasks + tui/threads implement this shape in their live wiring.
+
+### D29 — Selection law: click or shift+tab, highlight marks the input target (owner ruling TD-4, 2026-10-16)
+
+Every box is selectable by mouse click; shift+tab cycles selection; the selected box renders visibly highlighted; the highlight IS the chat/instruct target — typed input goes to the lit box. Applies across all surfaces (lanes, rail, task tree, future boxes). Extends dual-lane focus + nav groundwork: existing tab/1/2 keys remain; shift+tab and click become universal, and the highlight carries the input-target meaning explicitly.
+
+### D30 — WASM-standard boundary law (owner directive 2026-10-16)
+
+Rust↔Go crossings use WASM (wazero) as the STANDARD: same speed class as batched IPC at volume, real fault isolation (traps surface as catchable errors, never process death), debug errors designed for the owner, no cross-compilation pain. cgo is EXCEPTION-ONLY: permitted solely when the Rust code is pure logic, no unsafe, no external C, covered by a frozen battery proving panic-freedom on real inputs, wrapped in catch_unwind, the operation is idempotent, the host can afford to die — re-proven on every dependency change. The five conversational Go subsystems stay in-process libraries (ns-scale); crossings to Rust are batched at the boundary. WASM prototype round (running) yields the go/no-go evidence; the boundary pipe remains until the prototype proves in-process end-to-end.
+
+### D31 — Response display mode: TUI complete-on-arrival, GUI offers both (owner directive 2026-10-17)
+
+The TUI renders responses complete-on-arrival (no token streaming — speed and cleanliness are the TUI's identity). The future GUI offers both modes as a user setting (all-at-once or word-by-word). The decision is per-surface, not per-model: the streaming capability is built so the GUI can consume it; the TUI simply renders the completed response. Default TUI: Way 1, permanent unless the owner changes his mind after using it.

docs/openspec/changes/add-native-rune-tui/interview-chat-presentation.md

@@ -0,0 +1,87 @@
+# Interview — Chat Presentation (owner rulings CP-1..CP-5; answers become D48+ rulings)
+
+Status: OPEN — the main session presents these questions to the owner; his answers are
+recorded verbatim under each item and become D48+ rulings.
+Sources: the landed render stack (bubbles, far-left dim timestamps, far-left gutter,
+ᚼ-framed code blocks, the messenger law, D34-D47), and the chat-design canon
+`research/factory-chat-design-principles/` C1-C9.
+
+Plain premises (established, not questions):
+- The MECHANICS defect (answers rendering as per-sentence bullets) is already
+  owned by a build wave under D47 — this interview is about the PRESENTATION
+  DESIGN only: how conversations should LOOK once the mechanics render correctly.
+- The landed stack: sender identity by bubble side + color (D41-3, no text
+  prefixes), dim far-left timestamps (D43, metadata-on-demand per C4), far-left
+  gutter, the thinking bridge (live expanding thinking that becomes history,
+  D41-2/D43-5/6, separated per pane D43-8), ᚼ-framed code blocks, one message
+  one stream (C2), queued messages visible while busy (D37/C5).
+- Code/tool content belongs in the tasks pane (D44 pane doctrine, D46 addendum);
+  chat stays conversational.
+
+---
+
+**CP-1 — How should paragraphs, lists, and code blocks visually differ?**
+Today prose and list content blur together (the bullet-mechanics defect made
+everything look like fragments). The face needs three distinct visual registers
+the eye can tell apart instantly, without reading.
+- "Strong contrast" commits him to: paragraphs as plain full-width prose, lists
+  with visible markers and hanging indents, code already in ᚼ frames — three
+  clearly different textures. Slightly heavier chrome, but zero ambiguity.
+- "Quiet/flat" commits him to: minimal markers, distinctions carried only by
+  spacing — cleaner, but the eye must read to classify.
+- **RECOMMENDED: strong contrast** — full-width prose paragraphs; lists with
+  real markers + hanging indents; code stays ᚼ-framed (and per D44/D46 the code
+  body itself lives in the tasks pane). No per-sentence splitting of a single
+  paragraph — a paragraph is one block, always.
+
+**CP-2 — Should inline markdown (bold / italic / code spans) render styled or plain?**
+When an answer contains **bold**, *italic*, or `inline code`, the terminal can
+either render them styled (ANSI bold/italic, colored code spans) or leave the
+raw markdown visible.
+- "Render styled" commits him to: a small markdown-inline renderer on the chat
+  path; text looks like a finished document; raw asterisks/backticks never show.
+- "Leave plain" commits him to: zero renderer risk, but the transcript shows
+  literal `**asterisks**` — reads as unfinished.
+- **RECOMMENDED: render styled** — bold, italic, and inline code spans
+  (code spans in the same accent color as the ᚼ blocks so inline code and block
+  code read as one family). Styled inline markdown, never raw markup on screen.
+
+**CP-3 — How prominent should the thinking bridge be?**
+Today the thinking bridge exists per D41-2/D43-5/6. The question is its resting
+state: always visible as a strip, or collapsed to nothing once thinking
+completes (only visible while thinking).
+- "Only while thinking" commits him to: a calm transcript after the turn; the
+  thinking collapses into its expandable history entry (C6 completion beat).
+- "Always-visible strip" commits him to: permanent vertical space spent on
+  reasoning state, even when nothing is being thought.
+- **RECOMMENDED: only-while-thinking** — the bridge lives while thinking is
+  active, then collapses to a one-line sealed entry (expandable via click + key
+  per D34-3). Chat space is conversation space; thinking history is one click
+  away, not one screenful away.
+
+**CP-4 — Code block presentation: tasks pane vs chat?**
+D44/D46 already rule that code and tool content route to the tasks pane. The
+open presentation question: what the CHAT pane shows when an answer mentions
+code.
+- "Chat shows a stub card" commits him to: chat shows a compact ᚼ one-liner
+  (filename + language + line count, clickable per D34-3) that opens the full
+  block in the tasks pane — chat stays conversational, code stays work.
+- "Chat shows full code" commits him to: the conversation stream fills with
+  frames, breaking the pane doctrine.
+- **RECOMMENDED: chat shows a compact stub card** (one-line ᚼ frame: name +
+  size, clickable → tasks pane); the full code block renders in the tasks pane
+  per D44/D46.
+
+**CP-5 — Which messenger patterns should be adopted?**
+The chat canon C9 names two navigation markers not yet ruled: day markers
+("Today", "Yesterday") and a jump-to-unread marker. Also available: transcript
+search (C9), and queued-slot visibility already landed (D37/C5).
+- "Both markers" commits him to: day markers as thin dim separators in the
+  scrollback, and a jump-to-unread marker line + keybinding when returning to
+  history. Small permanent chrome cost, large navigation payoff.
+- "Neither / pick one" commits him to: less chrome; long transcripts stay harder
+  to navigate.
+- **RECOMMENDED: adopt both** — dim day markers in the scrollback and a
+  jump-to-unread marker (with a key), both rendered in the timestamp/gutter
+  family (C4 metadata-on-demand styling). Transcript search stays a future ask,
+  not part of this round.

docs/openspec/changes/add-native-rune-tui/interview-tabs-windows.md

@@ -0,0 +1,119 @@
+# Interview — Tabs & Windows (owner rulings TW-1..TW-8; answers become D48+ rulings)
+
+Status: OPEN — the main session presents these questions to the owner; his answers are
+recorded verbatim under each item and become D48+ rulings before any build wave.
+Sources: `research/factory-tabs-windows/00-interview-prep.md` (stack capability +
+face inventory), the Layer Law (boundary-law.md, D43 addendum), D36/D38/D41/D44-D47.
+
+Plain premises (established, not questions):
+- The terminal stack (Bubble Tea v2.1.0 + lipgloss v2.0.6, vendored) supports real
+  floating windows: lipgloss layers have X/Y/Z coordinates; z-order is a library
+  feature. Tab bars have no library component — they are hand-built (lazygit/k9s
+  precedent), trivial to build; the cost is state management.
+- The Layer Law (D43 addendum) says every visual element is an independent layer
+  with its own scaffold/state/tests. Floating windows ARE layers with Z. The
+  library now literally enforces the owner's law.
+- The face today: two panes (chat + tasks), gauges overlay, rail takeover, model
+  picker, approval card, hints overlay, plus build/sub-agent and event-stream
+  surfaces. The gauges were already ruled "windows to call upon (on-demand
+  overlays), NOT embedded" (D38 §V-C).
+- Switching surfaces must never mutate semantic state (the rail takeover's
+  "pure chrome state" pattern, generalized).
+
+Each question below states: the premise, what each answer commits him to, and the
+recommended default (marked **RECOMMENDED**).
+
+---
+
+**TW-1 — Which surfaces become tabs?**
+A tab is for long-lived surfaces you leave and come back to. Over-tabbing
+recreates a browser's 30-tab swamp in a terminal.
+- "Only the two long-lived surfaces" commits him to: tabs = the build/sub-agent
+  window and the event stream (today's rail takeover); everything else stays a
+  pane or a floating window. Smallest tab bar, lowest state cost.
+- "More surfaces" commits him to: more tab state, more chrome, and a decision for
+  each additional surface about where it lives.
+- **RECOMMENDED: tabs for exactly two surfaces — the build/sub-agent window and
+  the event stream.** Everything else stays a pane or window until a real need
+  appears.
+
+**TW-2 — Which surfaces become floating windows?**
+Windows that float and drag suit transient, on-demand surfaces — the exact
+category already ruled on (D38 §V-C: "windows to call upon").
+- "Exactly the named overlays" commits him to: gauges, model picker, approval
+  card, hints tooltip become floating windows; no new floating surfaces until
+  asked.
+- "Anything can float" commits him to: focus/z-order rules for every surface,
+  drag-hit-testing everywhere, and more places where the face can be covered.
+- **RECOMMENDED: floating windows = the gauges (D38 §V-C), the model picker, the
+  approval card (highest Z), and the hints tooltip. No new floating surfaces
+  beyond these until asked.**
+
+**TW-3 — Does the chat itself ever become a tab or window?**
+This is the identity question of the face. If chat can be hidden behind a tab,
+the "chat is the home of the face" premise weakens (D36: the composer is a
+stable BOX at the bottom, never a thin transient line).
+- "Yes, chat can tab" commits him to: a face that can show zero conversation,
+  and reworking the composer routing (D44 pane doctrine) for a chat that may not
+  be visible.
+- "No, chat is fixed" commits him to: tabs and windows orbiting a permanently
+  visible home surface.
+- **RECOMMENDED: NO.** Chat (transcript + composer per D36) stays fixed and
+  always visible; tabs and windows orbit it.
+
+**TW-4 — Does tab state persist across runs?**
+Re-opening rune and finding your build tab still open is a memory feature; but
+persisted UI state adds a store surface and failure modes.
+- "Yes" commits him to: a small face-state file remembering open tabs + which was
+  active (plain files, per the D38 plain-files-over-databases instinct).
+- "No" commits him to: a fresh face every run — nothing reopens, nothing stale.
+- **RECOMMENDED: yes, minimal** — remember the set of open tabs and which was
+  active in a small face-state file. Scroll/cursor positions do NOT persist in
+  v1.
+
+**TW-5 — Window size/position memory?**
+Dragging a gauges window to a corner every session is friction; but remembered
+geometry can go off-screen when the terminal is smaller than when it was saved.
+- "Remember, clamped" commits him to: per-window size+position stored in the
+  same face-state file, always clamped to the current terminal on restore (never
+  a window partially off-screen).
+- "Never remember" commits him to: every window opens in a default spot each run.
+- **RECOMMENDED: remember per-window size + position, clamped to the current
+  terminal on restore.** Stored in the same face-state file as TW-4.
+
+**TW-6 — Keyboard parity for window verbs?**
+The face already mixes mouse and keyboard (click regions open the takeover;
+shift+tab cycling per TD-4). Drag-to-move is mouse-only by nature; if keyboard
+can't reach every window action, mouse becomes mandatory and breaks
+keyboard-only workflows.
+- "Full keyboard parity" commits him to: every window verb (open/close/
+  cycle-focus) reachable by keys AND the palette; drag is the one mouse-only
+  exception (move/resize), never the only path.
+- "Mouse-first" commits him to: keyboard users losing windows they can't reach.
+- **RECOMMENDED: keyboard parity for every window verb** — open/close/
+  cycle-focus via keys and via the palette; drag (move/resize) is the only
+  mouse-only verb. Source: TD-4 selection law + D29 instinct.
+
+**TW-7 — What happens to the chat+tasks dichotomy if either becomes a tab?**
+The two-lane face is a ratified shape. If tasks becomes a tab, the face becomes
+single-pane-plus-tab, which changes resize/focus semantics entirely. This is the
+most expensive question — it decides whether the tab bar replaces the gutter.
+- "The dichotomy survives" commits him to: chat and tasks remain the two panes;
+  the tab bar sits ABOVE them for the orbiting surfaces (build, events).
+- "Tasks becomes a tab" commits him to: a single-pane face + tab bar, a ratified
+  deviation priced before build — the dichotomy (chat = conversation, tasks =
+  work) merges into one column.
+- **RECOMMENDED: the dichotomy survives** — chat and tasks stay the two panes;
+  the tab bar sits above them for the orbiting surfaces only.
+
+**TW-8 — What can never be closed? (guard)**
+Closable implies closeable-by-accident. Some surfaces must be non-closable to
+keep the face honest.
+- "Chat + pending approval card" commits him to: the chat pane/composer and the
+  approval card (while a decision is pending) cannot be closed or covered by any
+  lower-Z window. Everything else is closable.
+- "Everything closable" commits him to: a face where a stray click can hide the
+  composer or bury a pending approval.
+- **RECOMMENDED: the chat pane/composer, and the approval card while a decision
+  is pending, can never be closed or covered by a lower-Z window.** Source: D36
+  chat law + the existing "modal outranks everything" rule.

docs/openspec/changes/add-native-rune-tui/proposal.md

@@ -0,0 +1,36 @@
+# Proposal: add-native-rune-tui
+
+## Why
+
+I currently run inside mimocode — a second host instance carrying conversation, tools, and screen. The endgame is native: one continuous program with my Bubble Tea TUI as its face, no sessions, no mimocode, no separate IDE/CLI dependency. Settled requirements come from the interview ledger, harness survey, Sleight-of-Hand contract, and qualified self-transformation protocol. The R2 frontier round (research/tui-frontier-r2/, QUALIFY: PROCEED) expanded the governing scope across collaboration, graph/GUI, presentation, offline cognition, the Go↔Rust dichotomy, business/social/finance, distributed devices, and extensions; its owner decisions (R2-D1..R2-D9) are folded in here. The amendment round on sub-agents, tasks, and adaptability (SA-D1..SA-D6, plus the thread-model addendum) added sub-agent orchestration, task management, thread orchestration, and day-one sockets. Remaining technical design questions are explicit pre-implementation gates in Task 0.0 and the open-question register; none may be improvised during implementation.
+
+## What Changes
+
+Introduces my native program: a continuous headless-first runtime hosting a single native TUI interface, with a supervised persistent Rust worker behind the Go face and a web-link real-time feed for anything outside the TUI (owner decision R2-D6 — desktop-canonical multi-face TUI is demoted; the future GUI owns multi-screen). Chat left, Task right, both always visible; a shared activity rail beneath them opens into a full-width inspectable record. Modes are Chat, Task, and Plan. Trust becomes a principal-to-effect envelope: every command — owner, guest, agent, tool, device, or service — is attributable and revocable, with digests rebound at every writer and effect-time revalidation; act-then-receipt operates inside that envelope, outside-network origins always ask, and no external program may alter me. Device/forge work travels as job capsules and the multi-device promise rests on real-hardware qualification runs, never simulations (R2-D2). Memory follows Sleight-of-Hand with the live ContextBroker invariant under regression tests; the memory graph gains a headless, read-only projection with opaque deep links. Retirement evidence is authority-preserving action/receipt traces through a mutant-hardened oracle harness, with a per-file language-verdict manifest and an independent CI verdict gate keeping Python dead after quarantine. Five live defects (stale-card trust, stale capability resolution, missing subprocess default-deny, a datetime crash, and CI bootstrapping Python with no verdict gate) are activation prerequisites. Collaboration stays proposal-inbox-shaped (rooms only after a real malicious-guest attack test), finance stays deferred until a named connector and jurisdiction exist with sandbox-first testing, and the first outside connection is the draft/calendar-browser handoff (R2-D3/R2-D4/R2-D8). Sub-agents run under full live view and control — explicit briefs, rail-first visibility, mid-run steering, cancellation, per-action receipts — with your standing authority inherited down the whole agent chain and chained spawning visible as ancestry (SA-D1/SA-D2). The Task lane hosts a full living task tree — statuses, sub-tasks, dependencies, blocked-by, your reordering, assignment to Rune or any agent (SA-D4) — and threads become the universal unit of conversation and work: every thread records origin, parent, inherited-context slice, status, and result destination, supports starting and permanently-marked splitting, and one tree holds human splits and agent children alike, rendered as a terminal-native tree view with a linear fallback. Every major subsystem exposes a registered day-one socket with a stable contract and deletion test; the cognition socket is reserved with its design deferred (SA-D5/SA-D6).
+
+## Capabilities
+
+### New Capabilities
+- `rune-runtime`: continuous program, headless operation, startup/crash continuity checkpoints, supervised Go-face/Rust-worker boundary, single-interface TUI plus web-link live feed, platform-general signed packaging with slowest-target SLO.
+- `dual-lane-interface`: Chat/Task concurrency, importance-aware promotion, Steer-now vs Queue-for-Task controls, edit-forward semantics, no sessions, modifier-aware rebinding with modal precedence.
+- `modes-and-plans`: hard-set Chat/Task/Plan modes; full-plan process with mandatory research/viability loop; OpenSpec secondary format; contextual staged execution.
+- `tools-providers-devices`: live-proven tool/provider paths, cloud-first configurable defaults with evidence-bearing placement, classified refusal handling with local-model route, Hugging Face acquisition with consent, device-forge job capsules, real-hardware qualification, offline draft proposals.
+- `file-change-safety`: programmatic restore points before every change, changes-view, project-history separation, one-command revert, deletion carve-outs.
+- `trust-and-sovereignty`: principal-to-effect envelope, personal-mode act-then-receipt, visible boundaries, external-origin rules with per-step attribution and audit correlation, remote pairing, sovereignty (nothing external alters me).
+- `memory-context-continuity`: Sleight-of-Hand adoption — cooling/rehydration, ContextBroker authority under regression invariant, headless graph projection with opaque links, right-to-forget, typed degraded states, no false progress.
+- `unattended-workflows`: time/event/condition/natural-language triggers, workflow contracts, bounded retries, evidence-backed improvement proposals.
+- `alerts-and-remote-control`: four alert types, per-channel toggleable delivery (platform-general), background-only + urgent override, long-absence digest, mutually-authenticated paired remote commands with relay-substitution invariance.
+- `work-observability`: status strip with bounded-stream queue/overflow semantics, activity rail + takeover inspection, child-work expansion, degradation ledger, one details view, completion receipts with separated evidence dimensions, optional cost limits.
+- `sub-agent-orchestration`: explicit-brief agent lifecycle (spawn → run → steer → complete/cancel), rail-first visibility with live expansion, mid-run steering, safe-boundary cancellation, per-action receipts, authority inherited down the chain with hard asks intact, chained spawning with visible ancestry, nothing invisible (SA-D1/SA-D2).
+- `task-management`: the full living task tree in the Task lane — statuses, sub-tasks, dependencies, blocked-by, owner reordering, assignment to Rune or any agent, full history/audit (SA-D4); lanes stay owned by `dual-lane-interface`.
+- `thread-orchestration`: threads as the universal unit of conversation/work — origin, parent, inherited-context slice, status, result destination on every node; starting and permanently-marked splitting; agent workspaces are threads in the same single tree (thread-model addendum).
+- `inputs-and-integrations`: universal drag-and-drop path floor, rich analysis with path fallback, inspect-before-connect MCP settings where discovery is never consent. Voice is a deferred follow-on change pending the speech research pipeline.
+- `visual-system`: dual-lane layout, bubbles, research styling with linked sources, one semantic view/action model shared by all renderers (AT parity deferred per R2-D1), themes + live editor behind terminal capability and budget gates, three-direction selection after the semantic map, honest fallbacks, pixel-art/3D directions pending visual round.
+- `skills-and-growth`: pattern proposal on consent, cheapest reliable form, tested/approved activation, SKILL.md compatibility with my authority outside packages, and governed self-transformation per the qualified protocol. Taxonomy labels remain gated on the D02 research decision.
+- `migration-and-retirement`: action/receipt-trace parity proof with deliberate mutants, per-file language-verdict manifest and independent CI verdict gate, capability-by-capability mimocode replacement with same-change Python removal, Gitea evidence chain.
+- `extension-lifecycle`: versioned manifests with governed update/disable/uninstall, host-rendered declarative UI slots (approval and takeover forbidden), discovery-is-not-consent, first-consumer gate of one command + one status card.
+- `future-seam-registry`: no-consumer-no-seam rule, full seam records with owners and forbidden authority, CI deletion/compatibility tests, keep/change/delete-only reviews covering relay, offline log, graph links, memory invariant, extension lifecycle, and the web feed; day-one sockets (SA-D6) — every major subsystem (agents, tasks, threads, messaging, cognition-reserved, connectors) registers a stable-contract socket with a deletion test at first build.
+
+## Impact
+
+Retires mimocode as my host and the Textual TUI (`rune_tui.py` becomes oracle-reference then obsolete); absorbs the 127-line Go prototype. Binds kernels/services per the integration map and open-question register. Epic **#2484** and finding **#2485** are satisfied only after the named design gates and proof plan close. Known runtime repairs are activation prerequisites in `skills-and-growth` and `migration-and-retirement`, discovered by INWARD and made binding by D10; the five R2 live defects (build phase 0) extend that list in `tasks.md` 0B. Accessibility parity is not claimed (R2-D1); multi-device claims are gated on real-hardware qualification (R2-D2); collaboration beyond proposal-inbox, finance connectors, rooms, and the sandbox ladder remain deferred fronts with recorded promotion gates.

docs/openspec/changes/add-native-rune-tui/spec-activity-pane-and-presentation.md

@@ -0,0 +1,85 @@
+# Spec: the activity pane + the answer presentation system
+
+Owner rulings recorded 2026-10-21 (this document IS the spec — the factory builds from it verbatim).
+One wave. Blocks until D47's chatpane work (general-7) lands; touches the same pane family.
+
+## Part A — THE ACTIVITY PANE (the bridge strip reborn)
+
+The bridge strip stops being a "thinking bar" and becomes the **activity pane**: a persistent,
+always-visible lane that shows WHAT the TUI is doing right now.
+
+### A1. Activity states
+The pane dynamically labels the current activity. Minimum state set:
+
+| activity | when |
+|---|---|
+| thinking | model reasoning turn in flight |
+| coding | tool loop running write/edit/run tools |
+| planning | PLAN-mode dispatch active |
+| researching | read-family tools running (grep/glob/read_file/list_directory) or webfeed |
+| idle | nothing in flight (pane rests; runic marks dim/absent per owner boot feedback) |
+
+The state derives from REAL signals only — the mode-gated dispatch (tool names in the loop),
+the turn state machine. No guessed classifiers. A misfiring label is a defect (see #2529's
+she-coding false positive: same class).
+
+### A2. Per-activity colour + animation
+Each activity has its OWN colour and its OWN animation pattern. The runic animations are KEPT.
+Runic marks may randomise colour per rune within the activity's palette (owner ruling: "could
+have random colours per rune"). The activity WORD animates while active.
+
+### A3. The word itself
+The activity word randomises a rainbow colour while active (owner ruling #2527, subsumed here).
+
+### A4. No timestamp on the activity pane (owner ruling #2527).
+
+### A5. Always visible
+The pane never disappears; content changes with state (owner ruling #2527).
+
+### A6. The + affordance (owner ruling #2528, upgraded)
+A clickable `+` in the activity pane opens a CENTERED WINDOW showing everything currently being
+processed (full thinking text, tool calls in flight, one block per full answer — not fragments).
+Keyboard parity per the tabs/windows canon. In-place click-to-expose on the strip is REMOVED.
+
+### A7. Tasks-pane mirror
+The current activity also shows in the tasks pane work stream while active (owner ruling: "it
+should also show opened in the task pane").
+
+### A8. Layer law
+The activity pane is an independent layer: own state machine, own tests, registered as a project
+citizen. The she-coding label (#2529) migrates INTO this state machine — its trigger diagnosed
+and either retired or made honest.
+
+## Part B — THE ANSWER PRESENTATION SYSTEM (chatpane)
+
+### B1. Proper markdown, zero model-side cost
+Parse the model's OWN markdown into blocks once per completed answer (TUI-side, after the turn).
+No prompt changes, no extra tokens, no context cost. Bounded dialect renderer (~6 block types),
+honest strip for exotics. No general markdown engine.
+
+### B2. Block types and their presentation
+1. **Speech (prose paragraphs)** — bubble that GROWS with content; consecutive prose joins ONE
+   bubble; left-aligned; bubble outline takes the SPEAKER'S colour (owner ruling #5 — colour
+   identity stays, outlines made overt).
+2. **Table** — BREAKS OUT of the bubble: full-pane-width bordered table, header emphasised,
+   border in the speaker's colour. Speech before/after joins bubbles again.
+3. **Bullet lists / numbered steps** — own presentation outside the bubble: left rail in the
+   speaker's colour, hanging indent, steps numbered, genuine bullets dotted. NEVER per-sentence
+   bullets (the D47 defect).
+4. **Code fences** — route to the tasks pane work stream (D47/D44 law, already contracted).
+5. **Headings** — full-width, speaker-coloured underline, no bubble.
+
+### B3. Emphasis
+Respect the model's markdown emphasis now (bold/headers). Rune's OWN importance-flagging arrives
+later with her intelligence infrastructure — her voice, not a classifier (owner ruling #3).
+
+### B4. Bubble breakage defect
+Long answers must never break the bubble (#2530a) — the growing-bubble model in B2 replaces the
+fixed-shape card. Answers left-aligned (#2530b).
+
+## Verification shape (for the contract)
+- Red-first per block type: prose joins, table breakout, rail-list, speaker-coloured outlines,
+  activity state transitions (real-signal driven), + window open/close, tasks-pane mirror.
+- PTY proof round: one landing, one deploy via build_paired.sh (owner contract).
+- Layer law: activity pane layer owns its state/tests; chatpane renderer owns its blocks/tests.
+- Zero new Python (owner directive: retire Python, don't add).

docs/openspec/changes/add-native-rune-tui/specs/alerts-and-remote-control/spec.md

@@ -0,0 +1,70 @@
+# Spec Delta: alerts-and-remote-control
+
+## Purpose
+The alert system under the passive-first law: four types, toggleable platform-general channels, background-only firing with urgent override, evidence-bearing content, long-absence digest, and paired remote commands.
+
+## ADDED Requirements
+
+### Requirement: Four alert types [need]
+
+Alerts SHALL be exactly four types: work finished · needs your decision · something failed · permission requested. No additional alert classes SHALL be introduced without your review.
+
+#### Scenario: Typed delivery
+- **WHEN** an unattended workflow completes while the face is closed
+- **THEN** a "finished" alert fires through every enabled channel with its evidence links.
+
+### Requirement: Toggleable platform-general channels [need]
+
+Channels SHALL be: desktop notifications, sound, chat-platform gateway (Telegram/Discord/Signal class), webhook delivery. Each channel SHALL be individually toggleable in TUI settings. The notification layer SHALL be platform-general — functional on your CachyOS and any supported platform, never bound to one desktop environment.
+
+#### Scenario: Per-channel toggles
+- **WHEN** you disable sound but keep desktop notifications
+- **THEN** sound never fires for any alert type while desktop notifications continue.
+
+### Requirement: Background-only + urgent override [need]
+
+Alerts SHALL fire only when the face is closed or unfocused, EXCEPT the urgent class (permission on something destructive), which SHALL always fire. Screen-focused operation SHALL NOT produce alert noise. Agent-originated and task-originated alerts SHALL follow this same firing rule.
+
+#### Scenario: Focused use
+- **WHEN** the TUI is open and focused during active work
+- **THEN** no alerts fire for normal completions; a destructive-permission prompt still alerts immediately.
+
+#### Scenario: Agent-originated alert
+- **WHEN** an agent or task finishes, fails, or needs a decision while the face is open and focused
+- **THEN** no alert fires — or the urgent class always fires — exactly as owner-facing work does; origin changes attribution, never the firing rule.
+
+### Requirement: Evidence-bearing alerts [need]
+
+Every alert SHALL name what happened, which work it belongs to, and where the record lives (claim/evidence link). Alerts SHALL be verifiable, never vague status text.
+
+#### Scenario: Verifiable failure alert
+- **WHEN** a workflow fails overnight
+- **THEN** the alert names the workflow, the failed step, the failure cause, and links the preserved evidence and workflow record.
+
+### Requirement: Long-absence digest [need]
+
+Reopening after a long absence SHALL present a digest: finished work, anything awaiting you, anything failed. Short absences SHALL reopen directly to the live view.
+
+#### Scenario: Overnight absence
+- **WHEN** you open the TUI after several hours
+- **THEN** a digest lists completions, pending decisions, and failures with their evidence links before the live view.
+
+### Requirement: Paired remote commands [need]
+
+Paired phone/chat accounts SHALL be able to start work and answer pending questions. Pairing SHALL be mutually authenticated and short-lived; revocation SHALL be immediate. Every remote command SHALL appear in Chat with its verified origin. Relay substitution SHALL NOT change authorization or sovereignty — the connector owns transport only. Unpaired senders SHALL NOT command me.
+
+#### Scenario: Paired phone instruction
+- **WHEN** a paired Telegram account sends "run the nightly consolidation"
+- **THEN** the command executes, appears in Chat with Telegram origin, and its results alert back through enabled channels.
+
+#### Scenario: Relay substitution
+- **WHEN** the relay implementation is swapped for another connector
+- **THEN** authorization, pairing state, and sovereignty are unchanged, and a replayed old frame is refused.
+
+### Requirement: Secure credential storage [need]
+
+Chat-gateway, webhook, and external-service credentials SHALL use the operating-system secure credential store where available, with a protected encrypted local fallback. Settings SHALL show name, scope, status, and last-used time — never secret values.
+
+#### Scenario: Credential display
+- **WHEN** you inspect a connected gateway
+- **THEN** the TUI shows scope/status/last-used and rotation/revocation controls, while the token itself is never rendered or logged.

docs/openspec/changes/add-native-rune-tui/specs/dual-lane-interface/spec.md

@@ -0,0 +1,86 @@
+# Spec Delta: dual-lane-interface
+
+## Purpose
+The two permanent lanes — Chat (thinking with you) and Task (executing work) — always visible together, concurrent, sharing one memory, never interrupting each other.
+
+## ADDED Requirements
+
+### Requirement: Two lanes always visible [need]
+
+Chat left and Task right SHALL remain on screen simultaneously. Focus changes may resize but SHALL NEVER hide either lane. Both lanes run concurrent model calls against one shared memory, with single-writer ordering discipline on shared records.
+
+#### Scenario: Concurrent work
+- **WHEN** Task streams a long operation while you type in Chat
+- **THEN** Chat sends its own model call immediately, Task continues undisturbed, and both responses render in their own lanes.
+
+### Requirement: Importance-aware promotion [need]
+
+Explicit promotion language ("make this a task") SHALL create the task immediately. When a Chat message is judged task-worthy but not explicit, the TUI SHALL present a suggested task for accept/edit/dismiss — never silently create one. Promotion SHALL carry decision + evidence/conversation references + intended effect; whole-chat dumping is prohibited. Agent-originated and task-originated messages SHALL follow these same promotion and interruption rules — no parallel semantics.
+
+#### Scenario: Ambiguous idea in Chat
+- **WHEN** Chat discussion produces an idea with task potential but no explicit instruction
+- **THEN** a suggestion appears offering the concrete task, and accepting it promotes the packaged context to Task.
+
+#### Scenario: Agent-originated message
+- **WHEN** a running agent or the task tree produces a message with task potential while Task runs
+- **THEN** it passes through the same importance-aware promotion and Steer-now/Queue rules as owner messages, with origin attributed — no parallel path exists.
+
+### Requirement: Steer-now and Queue-for-Task [need]
+
+Two separate controls SHALL exist: Steer-now (interrupt/redirect immediately) and Queue-for-Task (carry the packaged context without interrupting). Ordinary Task input waits for the current operation unless immediate steering is invoked. Explicit urgency language ("fix this now", corrections-in-flow) SHALL override and correct Task's current path, safely stopping or completing the smallest current operation first where effects require.
+
+#### Scenario: Correction while running
+- **WHEN** you say "fix this now" in Chat while Task runs
+- **THEN** Task's current smallest operation completes or stops safely, the change and what stays valid are shown, and work continues under the correction.
+
+### Requirement: Edit-forward semantics [need]
+
+Editing a sent message SHALL either resend as a new forward instruction or be interpreted in-flight by a running task that accepts the override. Rewinding conversation state as an editing side-effect SHALL NOT occur; restore points remain a safety net, not a conversational mechanism.
+
+#### Scenario: Edit during run
+- **WHEN** you edit a message that originated the current task while the task runs
+- **THEN** the running task interprets the edit where capable; otherwise the edit sends as a new instruction; conversation history is never rewound silently.
+
+### Requirement: Attention gesture [need]
+
+An explicit "Rune, pay attention to this" gesture SHALL summon my full focus to the referenced material across lanes. Passive contextual information in Chat SHALL appear as informational messages that never hijack the turn.
+
+#### Scenario: Pay-attention gesture
+- **WHEN** you direct attention to a Chat message while Task runs
+- **THEN** I resolve the referenced material with full focus and treat it as contextually load-bearing for both lanes until resolved.
+
+### Requirement: Direct and cycling navigation [need]
+
+Chat, Task, activity/details, and settings SHALL each have a simple numbered direct shortcut; a cycle shortcut SHALL move through all focusable areas; mouse selection SHALL also work. The active shortcut SHALL be discoverable in its area.
+
+#### Scenario: Direct navigation
+- **WHEN** you press the configured Task shortcut
+- **THEN** focus moves directly to Task without disturbing Chat or active work.
+
+### Requirement: Composer behavior [need]
+
+Enter SHALL send and Shift+Enter SHALL insert a newline in Chat and Task composers. The hint SHALL remain visible/discoverable. Sending to Task during active work follows the queue/steer rules rather than inventing a third behavior.
+
+#### Scenario: Multiline message
+- **WHEN** you press Shift+Enter while composing
+- **THEN** a newline is inserted; Enter sends the complete message.
+
+### Requirement: Natural language plus command palette [need]
+
+Built-in actions SHALL be callable through natural language and one searchable command palette showing action names, descriptions, shortcuts, and current availability. Slash commands MAY exist as aliases but SHALL NOT define the product structure or parity target.
+
+#### Scenario: Unavailable action
+- **WHEN** the palette opens during a mode where an action is forbidden
+- **THEN** the action remains discoverable but visibly unavailable with its reason.
+
+### Requirement: Rebindable shortcuts [need]
+
+Every shortcut SHALL be rebindable with modifier-aware action-ID routing, so the same action resolves regardless of how the terminal delivers modifier combinations. The keybinding screen SHALL detect conflicts, support reset, preserve a complete keyboard-only path, honor no-color and reduced-motion modes, and prevent saving an unusable navigation map. Modal focus precedence SHALL be explicit.
+
+#### Scenario: Conflicting bind
+- **WHEN** you assign a key already used by another action
+- **THEN** the TUI identifies the conflict and requires resolution before saving.
+
+#### Scenario: Modal precedence
+- **WHEN** a modal confirmation is open and a lane shortcut fires
+- **THEN** the modal owns focus until resolved; the shortcut never leaks beneath it.

docs/openspec/changes/add-native-rune-tui/specs/extension-lifecycle/spec.md

@@ -0,0 +1,78 @@
+# Spec Delta: extension-lifecycle
+
+## Purpose
+Versioned extension manifests and lifecycle with host-rendered declarative UI slots — extensions discoverable and useful in the TUI (commands, palette, settings, status cards, dashboard launchers) without authority or UI takeover.
+
+## ADDED Requirements
+
+### Requirement: Versioned capability manifest [need]
+
+Every extension SHALL declare a versioned manifest: identity, version, compatibility range, typed imports/exports, permissions, activation, placement, budgets, and provenance. Registration SHALL validate the manifest schema and verify publisher identity and digest before activation; arbitrary manifest fields SHALL be rejected.
+
+#### Scenario: Arbitrary manifest field
+- **WHEN** a manifest arrives carrying unknown or malformed fields
+- **THEN** registration rejects it with a typed error and offers a fast owner-resolution path, never auto-activating it.
+
+#### Scenario: Publisher verification
+- **WHEN** an extension registers without verifiable publisher identity and digest
+- **THEN** activation is blocked; verification is a precondition, not a follow-up.
+
+### Requirement: Governed lifecycle operations [need]
+
+Update, disable, and uninstall SHALL be governed operations: re-registration SHALL replace the capability index atomically, scope expansion SHALL require fresh consent, disable/uninstall SHALL empty every rendered contribution, and termination SHALL be verified for the whole process tree with migration and rollback support.
+
+#### Scenario: Update with scope expansion
+- **WHEN** an extension updates from v1 to v2 requesting extra scopes
+- **THEN** the atomic index replacement removes all v1 resolution and the new scopes stay blocked pending your fresh exact-scope consent.
+
+#### Scenario: Stale capability after update
+- **WHEN** v2 registers while a stale v1 entry still resolves
+- **THEN** the registry treats it as a hard failure — no silent permission carry-over.
+
+#### Scenario: Orphaned process on unregister
+- **WHEN** unregister returns while an extension child process still lives
+- **THEN** process-tree termination verification fails closed, the orphan is reaped and reported.
+
+### Requirement: Host-rendered declarative UI slots [need]
+
+Extensions SHALL contribute through host-rendered declarative slots — commands, palette entries, settings, status cards, dashboard launchers — rendered inside fixed host chrome with escaped and truncated manifest data. Extension code SHALL NEVER render. No slot SHALL host approval UI or replace lanes, model routing, identity, or policy.
+
+#### Scenario: Approval slot rejected
+- **WHEN** an extension requests an approval-rendering slot
+- **THEN** the host blocks it (`blocked:slot_not_allowed:approval`) and approvals stay on native protected surfaces.
+
+#### Scenario: Revoke empties contributions
+- **WHEN** an extension is disabled or uninstalled
+- **THEN** every slot it filled renders empty or removed with no residual code or UI active.
+
+#### Scenario: Host-UI phishing attempt
+- **WHEN** manifest data contains terminal control sequences or lookalike approval chrome
+- **THEN** the host escapes and truncates it; nothing user-trusted renders extension-authored bytes.
+
+### Requirement: Discovery is not consent [need]
+
+MCP discovery SHALL feed inspection only. Exact-scope approval and effect mediation SHALL stay independent of any extension or server; visibility SHALL NOT mint authority. Every denial SHALL pair with a fast owner-resolution/override path so legitimate work is never permanently blocked.
+
+#### Scenario: Network scope expansion
+- **WHEN** a discovered extension later requests network access beyond approved scope
+- **THEN** the expansion is blocked pending re-consent, and you can grant or deny it quickly from the resolution surface.
+
+#### Scenario: Independent effect mediation
+- **WHEN** an extension-triggered effect reaches an effect boundary
+- **THEN** the mediation registry checks eligibility independently of the extension's own declarations.
+
+### Requirement: Failure isolation [need]
+
+An extension failure SHALL be isolated: its slots render a degraded or removed state, the host keeps running, and budget breaches (CPU, memory, time) SHALL suspend the extension with a typed record rather than degrade the TUI.
+
+#### Scenario: Crashing extension
+- **WHEN** an extension crashes or exceeds its budget mid-render
+- **THEN** its slots show a typed degraded state, the TUI stays responsive, and the event is recorded.
+
+### Requirement: First-consumer gate [need]
+
+The first real extension SHALL be exactly one command plus one status card, admitted only after the hardening list is proven: schema validation, digest and publisher verification, atomic index replacement, process-tree termination verification, and migration/rollback. Catalog/marketplace and richer slots stay deferred until real consumers exist.
+
+#### Scenario: First extension fixture
+- **WHEN** the first extension loads one command and one status card, then updates with extra scope and uninstalls
+- **THEN** scope never expands silently, no code or UI remains active after uninstall, and the fixture run is recorded as the first-consumer evidence.

docs/openspec/changes/add-native-rune-tui/specs/file-change-safety/spec.md

@@ -0,0 +1,70 @@
+# Spec Delta: file-change-safety
+
+## Purpose
+Programmatic restore points, change review, project-history separation, and revert — the safety layer beneath every file change, delete, or move, on a schedule or live alike.
+
+## ADDED Requirements
+
+### Requirement: Programmatic restore points [need]
+
+Before EVERY change I make — edit, delete, or move — a saved copy of affected files SHALL land in a hidden safety area, triggered by real filesystem events, NEVER by conversation turns, tokens, or compaction events. Protection SHALL cover files belonging to no project and SHALL behave identically for scheduled/overnight runs. Offline drafts are proposals, not restore points, and SHALL never auto-execute as restore actions.
+
+#### Scenario: Overnight delete gone wrong
+- **WHEN** an unattended workflow deletes a file at 03:00
+- **THEN** a pre-change restore point exists, the typed alert carries the restore reference, and one action restores the file.
+
+### Requirement: Rewind choice [need]
+
+Any rewind SHALL offer you the choice: restore files only, or files + conversation state back to the point. Restoring files SHALL NOT silently rewind conversation; conversation rewind SHALL never be required to restore files.
+
+#### Scenario: Selective rewind
+- **WHEN** you rewind to a restore point from two hours ago
+- **THEN** you choose files-only or files+conversation, and the other layer stands untouched.
+
+### Requirement: Changes-view [need]
+
+File changes SHALL present as a clean before/after per change. v1 SHALL NOT include a file browser or direct editing by you. Deleted-content changes SHALL be as reviewable as edits.
+
+#### Scenario: Review a change
+- **WHEN** I edit a file during Task work
+- **THEN** the changes view shows before/after for that change and its restore reference, with no separate browser required.
+
+### Requirement: Version history separation [need]
+
+My changes SHALL record into project history as work proceeds, kept strictly separate from your uncommitted work; dirty-file protection SHALL prevent mixing. One command SHALL revert any of my changes.
+
+#### Scenario: Your dirty tree
+- **WHEN** you have uncommitted edits while I work
+- **THEN** my history entries never absorb or move your uncommitted work, and reverting my change leaves your work byte-identical.
+
+### Requirement: Stability-aware retention [need]
+
+Every restore point SHALL remain while its work is active and through a configurable stability period after completion. Afterwards, storage MAY deduplicate and age out only unpinned, stable, resolved points. Pinned points and points tied to unresolved failures SHALL remain.
+
+#### Scenario: Stable point ages out
+- **WHEN** a completed task passes its stability period with no unresolved failure and its point is unpinned
+- **THEN** the point becomes cleanup-eligible without removing evidence still referenced by canonical history.
+
+### Requirement: Disk-limit cleanup requires approval [need]
+
+When restore storage approaches its configured limit, the TUI SHALL warn and present a cleanup proposal separating deduplicated, pinned, active, failed, and eligible points. Nothing SHALL delete automatically. A protected change SHALL block if its restore point cannot be written.
+
+#### Scenario: Restore storage full
+- **WHEN** a new edit cannot create its restore point
+- **THEN** the edit does not run; the TUI presents the exact cleanup proposal for your approval.
+
+### Requirement: Responsive changes view [need]
+
+Wide terminals SHALL show side-by-side old/new content; narrow terminals SHALL show a unified change view. You SHALL be able to switch manually. Deletions and binary files SHALL receive explicit non-text treatment.
+
+#### Scenario: Narrow terminal
+- **WHEN** terminal width cannot render readable side-by-side columns
+- **THEN** the view switches to unified format without losing change information.
+
+### Requirement: Selective external-file restore [need]
+
+Restoring configuration/documents outside projects SHALL show exact affected paths, current state, saved state, and overwrite preview. Restore SHALL apply only to selected files; broad directory rollback SHALL NOT exist.
+
+#### Scenario: Restore external configuration
+- **WHEN** you select an external restore point
+- **THEN** the TUI shows every overwrite and waits for file selection/confirmation before changing anything.

docs/openspec/changes/add-native-rune-tui/specs/future-seam-registry/spec.md

@@ -0,0 +1,62 @@
+# Spec Delta: future-seam-registry
+
+## Purpose
+A registry that keeps future optionality honest: seams exist only with consumers, owners, and deletion tests, so future GUI, federation, memory, and connector work stays open without bloating the retirement core with ownerless speculative APIs. Day-one sockets (SA-D6) give every major subsystem a registered, stable-contract socket at first build so later features plug in without redesign.
+
+## ADDED Requirements
+
+### Requirement: No-consumer-no-seam [need]
+
+No seam SHALL be reserved without one current consumer or two materially different consumer fixtures, a named owner, a forbidden-authority scope, and a recorded deletion/expansion trigger. Ownerless or speculative seams SHALL be deleted, and nothing SHALL be renewed automatically.
+
+#### Scenario: Consumerless seam deleted
+- **WHEN** a reserved seam cannot show a current consumer or its two fixtures at review
+- **THEN** the review ends in delete and CI proves nothing claimed depends on it.
+
+#### Scenario: Paper expiry
+- **WHEN** a seam record passes its review date without a decision
+- **THEN** CI flags it for keep/change/delete; silent carry-over is forbidden.
+
+### Requirement: Seam record fields [need]
+
+Every reserved seam SHALL record: problem, owner, minimal schema, forbidden authority, consumer fixture, versioning rule, compatibility test, security boundary, evidence IDs, review date, and deletion/expansion trigger. The registry SHALL apply to the relay boundary, offline draft log, graph deep links, memory invariant, extension lifecycle, and the web-link live feed seam.
+
+#### Scenario: Registry applied to named seams
+- **WHEN** any of the relay, offline-log, graph-link, memory-invariant, extension-lifecycle, or web-feed seams is reviewed
+- **THEN** its record carries every field and its evidence IDs resolve to the citing research artifacts.
+
+#### Scenario: Gitea-recorded decision
+- **WHEN** a review ends
+- **THEN** the keep/change/delete decision and its evidence link into the Gitea chain like every retirement decision.
+
+### Requirement: CI deletion and compatibility enforcement [need]
+
+CI SHALL run a compatibility test for every reserved seam and a deletion test that removes it, proving no claimed capability silently depends on an unowned seam. The registry's enforcement SHALL share machinery with the independent language verdict gate.
+
+#### Scenario: Deletion exposes disguised scope
+- **WHEN** deleting a seam breaks a claimed current capability
+- **THEN** the build fails and the disguised implementation scope is surfaced for an explicit owner decision.
+
+#### Scenario: Finance connector deferral on record
+- **WHEN** the registry is reviewed before any financial connector is named
+- **THEN** the money-effects front stays a deferred record with its first-use gates (named connector + named jurisdiction; provider sandbox suite first) and no connector feature exists in core.
+
+#### Scenario: Fast expansion path
+- **WHEN** a named live consumer appears for a deleted or narrowed seam
+- **THEN** the expansion trigger reopens the seam through a governed review quickly — deletion never permanently blocks legitimate future work.
+
+### Requirement: Day-one sockets [need]
+
+Every major subsystem — agent orchestration, task management, thread orchestration, messaging/promotion, cognitive architecture (reserved per SA-D5; design deferred, no architecture spec now), and connectors — SHALL expose a registered socket with a stable contract at first build, alongside the already-registered seams. Each socket SHALL record a registered name, a stable versioned contract, and a deletion test per the no-consumer-no-seam rule; the building subsystem is its first consumer.
+
+#### Scenario: Socket at first build
+- **WHEN** a major subsystem first builds
+- **THEN** its socket is registered with name, versioned contract, and deletion test before the subsystem ships.
+
+#### Scenario: Reserved cognition socket, no design
+- **WHEN** the cognitive-architecture socket is registered
+- **THEN** it reserves name and contract shape only — no cognitive architecture is specified or implied — and its record marks design deferred (SA-D5).
+
+#### Scenario: Socket without contract fails
+- **WHEN** a subsystem ships without registering its socket's stable contract or deletion test
+- **THEN** CI fails the build; an unregistered or contract-less socket is not shippable.

docs/openspec/changes/add-native-rune-tui/specs/inputs-and-integrations/spec.md

@@ -0,0 +1,58 @@
+# Spec Delta: inputs-and-integrations
+
+## Purpose
+Universal file input with rich analysis where supported, plus inspect-before-connect external tool integration. Voice input/playback is a deferred follow-on change pending the speech research pipeline.
+
+## ADDED Requirements
+
+### Requirement: Universal path floor [need]
+
+Dragging or dropping any file, folder, or archive into Chat or Task SHALL at minimum insert its filesystem path. The TUI SHALL NOT require "uploading" files into itself — the path is the reference. This is the mimocode-parity floor.
+
+#### Scenario: Drop an archive
+- **WHEN** you drop a zip archive into Chat
+- **THEN** its path lands in the input with file-type context, and I can act on it by path.
+
+### Requirement: Rich input analysis with fallback [need]
+
+Images/screenshots SHALL support direct analysis where terminal and selected model support it, with path + analysis-result fallback everywhere else. PDFs, office documents, audio, video, code folders, and archives SHALL be accepted with appropriate handling. No capability SHALL be lost on terminals without inline image support.
+
+#### Scenario: Screenshot on capable terminal
+- **WHEN** you drop a screenshot on an image-capable terminal with a vision model active
+- **THEN** the image is analyzed directly; on an incapable terminal the same drop yields path + analysis result with no capability gap in the outcome.
+
+### Requirement: Inspect-before-connect integrations [need]
+
+The outside-tool connection settings SHALL show what each connection can read/change before connecting, require approval of exact access, and support the common MCP format. MCP discovery feeds inspection only — discovery is never consent. External content SHALL NOT alter my identity or authority.
+
+#### Scenario: MCP connection review
+- **WHEN** you add an MCP server
+- **THEN** the settings screen lists its read/write capabilities, you approve exact scope, and its content is treated as data, never instruction.
+
+#### Scenario: Discovery is not consent
+- **WHEN** an extension or MCP server advertises new scopes after initial approval
+- **THEN** the expansion stays blocked pending your fresh exact-scope consent, with a fast owner-resolution path offered.
+
+### Requirement: Voice deferred (want — separate change)
+
+Voice input and spoken playback SHALL be delivered by a separate change after its research pipeline qualifies. The first TUI SHALL reserve the four seams defined in `research/voice-research/speech-synthesis.json` D7 without implementing or claiming speech capability.
+
+#### Scenario: Voice seam reservation
+- **WHEN** the first TUI ships
+- **THEN** all four seams pass the exact conformance scenarios below and no speech engine, model, voice, audio package, microphone permission, global hotkey, OS text injection, or resurrected voicebox path exists.
+
+#### Scenario: SEAM-1 editable speech-input extension
+- **WHEN** a non-keyboard source submits text through the reserved speech action
+- **THEN** editable text enters the same Chat/Task submission path as typed input; the reserved keybinding is disabled/unbound and no global/OS injection can satisfy the seam.
+
+#### Scenario: SEAM-2 playback controls
+- **WHEN** the reserved playback surface renders
+- **THEN** play/stop/pause and rate/volume slots exist; state is {idle,playing,paused,stopped}; final assistant text is the future input; auto-play is off.
+
+#### Scenario: SEAM-3 truthful recording states
+- **WHEN** the reserved recording status model is exercised
+- **THEN** state is {idle,recording,confirming-transcript,playing,error}; recording truth derives from a capture handle; stop exists in every non-idle state; labels never rely on color or sound alone.
+
+#### Scenario: SEAM-4 disabled settings placeholders
+- **WHEN** settings opens before voice implementation
+- **THEN** disabled placeholders exist for speech input, spoken playback, auto-play, system-default backend, voice/rate/volume, retention/diagnostics opt-in, and English-first language; every default is off/unavailable.

docs/openspec/changes/add-native-rune-tui/specs/memory-context-continuity/spec.md

@@ -0,0 +1,118 @@
+# Spec Delta: memory-context-continuity
+
+## Purpose
+The Sleight-of-Hand memory contract made binding: cooling without deletion, verified rehydration, one ContextBroker, Spine authority, honest degraded states, and the right to forget.
+
+## ADDED Requirements
+
+### Requirement: Sleight-of-Hand contract adopted [need]
+
+The TUI SHALL implement `research/harness-survey/rune-sleight-of-hand-memory-compaction.md` as the memory/compaction authority: cooling without deletion, verified rehydration, evidence survives paging, one ContextBroker, Spine authority, TUI observes without inventing state.
+
+#### Scenario: Topic cooling and return
+- **WHEN** you return to a topic cooled hours earlier ("back to the API design")
+- **THEN** the topic rehydrates from its checkpoint with verified source pointers, without injecting unrelated history, and any unverifiable reference surfaces as a visible limitation.
+
+#### Scenario: Release constraints and tagged dependencies
+- **WHEN** this capability ships
+- **THEN** invariants MUST-01–MUST-18 and guarantees G1–G8 are release constraints, and every not-yet-built backend dependency is tagged rather than faked.
+
+### Requirement: No silent compression [need]
+
+Nothing SHALL be silently compressed or dropped. The visible conversation may trim; canonical memory SHALL keep everything with evidence trails. No compaction event SHALL rewrite the ledger or consume sole evidence needed to recover unfinished work.
+
+#### Scenario: Long session
+- **WHEN** a conversation exceeds context budget
+- **THEN** optional material pages out in safe order while governing state and evidence liveness are preserved, and the compaction event itself is visible in the activity record.
+
+### Requirement: Live memory surfaces [need]
+
+The TUI SHALL expose live inner surfaces per the contract's §13: memory ready/degraded/unavailable; working topic + cooled count; context used/limit with estimate-vs-actual distinction; checkpoint committed/pending/failed; retrieval status; task state. The inspectable Memory/Context view SHALL show actual context blocks with source refs, evidence chains, and last transition log. Graph inspection follows the headless graph projection requirement.
+
+#### Scenario: Inspector on degraded memory
+- **WHEN** the memory store is degraded
+- **THEN** the status shows degraded with lane detail on expand, and the inspector shows exactly which subsystem failed — never a simulated "healthy".
+
+#### Scenario: Provenance shows derivation, never truth
+- **WHEN** a memory surface displays a well-sourced item
+- **THEN** provenance labels its derivation only — validity and authorization render as their own fields, and projections never write back to memory.
+
+### Requirement: Headless graph projection [need]
+
+The memory graph SHALL expose an accessible headless projection — search/tree/table/text plus JSON/DOT/Mermaid/SVG exports — with opaque IDs, sources, event and validity time, provenance, current/history views, pagination, and typed degradation. It SHALL be read-only by default; mutations go through domain APIs. Layout is non-semantic; text/table is the canonical path.
+
+#### Scenario: Opaque deep link
+- **WHEN** a deep link with an opaque ID opens where no router is installed
+- **THEN** the literal fallback shows the ID and its source instead of failing.
+
+#### Scenario: Stale link
+- **WHEN** a deep link targets a revision that no longer exists
+- **THEN** the versioned router returns a stale-link error, never a wrong node.
+
+#### Scenario: Contradictory temporal fact
+- **WHEN** one fact carries conflicting event and validity times
+- **THEN** text, table, and export views resolve it identically through the same opaque ID.
+
+#### Scenario: No-graphics mode
+- **WHEN** the graph is inspected with graphics disabled
+- **THEN** search/tree/table/text remain complete; no state or action is exclusive to canvas rendering.
+
+#### Scenario: Later GUI projections
+- **WHEN** a future GUI canvas or JSON-Canvas view renders the graph
+- **THEN** it resolves the same opaque IDs read-only and layout remains disposable projection metadata.
+
+### Requirement: Right to forget [need]
+
+You SHALL be able to delete any memory; deletion SHALL be an authorized process wiping indexes, caches, and derived copies in scope. Deletion authority overrides preservation rules; the process SHALL be auditable.
+
+#### Scenario: Delete a memory
+- **WHEN** you delete a specific memory entry
+- **THEN** the entry and its derived copies are wiped in scope, the deletion is recorded in the audit trail, and retrieval never resurrects it.
+
+### Requirement: No false progress [need]
+
+Every TUI claim of memory saved, recalled, or verified SHALL trace to an authoritative backend receipt. Silence, no-match, stale index, unavailable store, permission denied, and corrupted source SHALL present as distinct statuses — never conflated into "remembered" or "forgotten".
+
+#### Scenario: Failed recall honesty
+- **WHEN** a recall returns no matching entries
+- **THEN** the TUI distinguishes "nothing in searched scope" from "never existed" and offers expanded search or clarification instead of fabricating continuity.
+
+### Requirement: Phase-0 authority and byte-path proof [need]
+
+Before behavior changes, the implementation SHALL map the canonical owners of transcripts/events, messages, task state, checkpoints, memory writes, prompt injection, last-byte provider payload, caches, and UI events; freeze baselines; and record one end-to-end trace. The live invariant SHALL stay under regression tests: ContextBroker sole model view and memory contributor path; one selection API, fail-closed, with degradation fields. No future-memory API is reserved.
+
+#### Scenario: Single ContextBroker proof
+- **WHEN** an instrumented provider request is emitted
+- **THEN** every model-visible block traces to ContextBroker, no hidden post-broker appender exists, mandatory blocks are present or the request refuses, and estimate-vs-actual bytes are recorded.
+
+#### Scenario: Invariant regression
+- **WHEN** a change would add a second model-visible memory path or bypass the selection API
+- **THEN** the regression suite fails closed and the change is refused.
+
+#### Scenario: Repository contract expansion
+- **WHEN** a storage-neutral repository API is proposed
+- **THEN** expansion waits for a named live consumer; ownerless seams are deleted, never reserved.
+
+### Requirement: Sleight behavioral scenario coverage [need]
+
+Applicable S01–S15 scenarios SHALL be explicit acceptance rows, not implied by the contract reference.
+
+#### Scenario: Scenario matrix completeness
+- **WHEN** memory/context acceptance runs
+- **THEN** it covers topic shift/return, exact historical quote, not-found vs failed retrieval, pressure paging, correction/history, provider swap, restart/no duplicate effect, cache purge, reduced identity context, private/deleted scope, false progress, pause/cancel, zero-memory abstention, and pointer rot.
+
+### Requirement: Deterministic, semantic, and chaos evidence [need]
+
+The release SHALL run the full §16 matrix and publish actual semantic results instead of claiming perfect retrieval.
+
+#### Scenario: Fault and quality gates
+- **WHEN** the capability is qualified
+- **THEN** deterministic fixtures pass 100%; semantic metrics publish actual recall/grounding/false-recollection/resume/commitment-loss/context-cost values; crash, disk-full/read-only, network, missing-file, stale-index, cache-wipe, duplicate-event, budget-pressure, and child-failure faults surface explicit degraded/recoverable states.
+
+### Requirement: Required design deliverables [need]
+
+The change SHALL produce the §18 ownership diagram, exists/wired/reachable/used/authority audit, UI states/wireframes, interface/event/cancellation/error schemas, phased test plan, migration plan, and written guarantee boundary separating lossless source retention from probabilistic semantic retrieval.
+
+#### Scenario: Missing deliverable
+- **WHEN** any §18 deliverable is absent
+- **THEN** the memory/context capability remains incomplete even if individual tests pass.

docs/openspec/changes/add-native-rune-tui/specs/migration-and-retirement/spec.md

@@ -0,0 +1,74 @@
+# Spec Delta: migration-and-retirement
+
+## Purpose
+How mimocode's role ends: capability-by-capability replacement with observed parity + improvement proof, Python removal with each proven replacement, and the named prerequisite repairs.
+
+## ADDED Requirements
+
+### Requirement: Capability-by-capability retirement [need]
+
+Mimocode SHALL be replaced capability by capability as native paths prove themselves; dependency SHALL shrink continuously. No single blind cutover. The oracle map (mimocode capability → native path → proof state) SHALL be maintained as the retirement ledger.
+
+#### Scenario: Partial retirement
+- **WHEN** native chat streaming and tool execution prove out but scheduling does not
+- **THEN** mimocode remains only for the unproven capabilities and disappears from the proven paths.
+
+### Requirement: Observed parity + improvement proof [need]
+
+Each native capability SHALL prove: side-by-side real-task behavior matching or exceeding mimocode, plus failure, restart, and recovery tests, plus every exposed tool/provider path live-confirmed. The parity unit is an authority-preserving action/receipt trace — action IDs, key scopes, focus transitions, breakpoint outcomes, theme tokens, oracle traces — never widget parity. Tests alone SHALL NOT suffice; observed live behavior is required.
+
+#### Scenario: Parity proof
+- **WHEN** a native capability claims retirement of its mimocode equivalent
+- **THEN** the evidence links a recorded side-by-side run, failure/recovery proof, and live tool/provider verification.
+
+#### Scenario: Deliberate mutants
+- **WHEN** key scope, receipt origin, recovery ordering, or launcher target is deliberately mutated
+- **THEN** the parity harness turns RED for every mutant; a harness that stays green is not retirement evidence.
+
+#### Scenario: Native executable attestation
+- **WHEN** parity evidence is recorded
+- **THEN** it attests the exact native executable digest that produced it.
+
+#### Scenario: Python dead after quarantine
+- **WHEN** a retired capability's quarantine period expires
+- **THEN** retirement evidence includes verification that no Python runtime path for it can still execute.
+
+### Requirement: Prerequisite repairs [need]
+
+Before self-activation capabilities and retirement claims advance, the INWARD-discovered defects SHALL be repaired and live-proven: checkout/deployment split, audit-ledger key lineage, curator bypass closure (sleep-time raw writes, skill authoring without guards), empty critic gate, unauthenticated approval strings, merge-robot zero-approval auto-merge. These SHALL be tracked as prerequisite tasks, not silent context.
+
+#### Scenario: Repair gate
+- **WHEN** the retirement sequence reaches a capability touching curator or ledger
+- **THEN** the named prerequisite repair is proven first, or the retirement task blocks visibly.
+
+### Requirement: Python removal discipline [need]
+
+Python modules SHALL be kept only as temporary comparison evidence during proof, tracked in a per-file language-verdict manifest (path, language, domain, rationale, boundary, generator, authority, exception-expiry). Once the native path proves real work + failure + restart, the Python implementation and its dependencies SHALL be removed in the same change. No fallback museum.
+
+#### Scenario: Same-change removal
+- **WHEN** a native module replaces its Python oracle
+- **THEN** the commit that proves the replacement also deletes the Python module and its dependency entries, with the proof linked.
+
+### Requirement: Independent language verdict gate [need]
+
+An independent CI verdict gate SHALL enforce the manifest with exact tokens plus negative fixtures — generated Python file, renamed interpreter, transitive build hook, fallback launcher, stale remote binary. Quarantine exceptions SHALL expire, and observed-digest receipts SHALL bind launchers and workers. Denied builds SHALL get a fast governed owner-override path.
+
+#### Scenario: Regrowth fixtures
+- **WHEN** Python re-enters via generated file, renamed interpreter, build hook, fallback launcher, or stale remote binary
+- **THEN** the verdict gate goes RED on every route and the exception ledger names owner and expiry.
+
+#### Scenario: Scanner self-match
+- **WHEN** the gate's own tooling or unrelated CI comments contain bare Python tokens
+- **THEN** exact-token semantics plus negative fixtures keep the verdict honest — neither false green nor false red.
+
+#### Scenario: Governed exception
+- **WHEN** legitimate migration work needs a temporary Python exception
+- **THEN** an evidence-backed exception with owner and expiry is granted quickly; the gate never permanently blocks approved work.
+
+### Requirement: Gitea evidence chain [need]
+
+All retirement decisions, proofs, and removals SHALL link to Gitea evidence (issues, commits, CI runs). The epic #2484 status and its child issues SHALL reference the OpenSpec change, never paste spec text. Future-seam keep/change/delete decisions SHALL record their evidence the same way.
+
+#### Scenario: Retirement ledger entry
+- **WHEN** a mimocode capability retires
+- **THEN** the retirement ledger entry links the proof run, the commit, and the issue state change.

docs/openspec/changes/add-native-rune-tui/specs/modes-and-plans/spec.md

@@ -0,0 +1,66 @@
+# Spec Delta: modes-and-plans
+
+## Purpose
+The three enforced modes (Chat, Task, Plan) and the full Plan process: rare entry, mandatory research/viability loop, explicit start, staged execution, and independent review.
+
+## ADDED Requirements
+
+### Requirement: Three hard modes [need]
+
+The TUI SHALL offer exactly three switchable modes: Chat, Task, Plan. Switching a mode SHALL hard-set which model answers, which tools the mode may use, how context is assembled, and which rules apply — enforcement, not judgment. Research is an activity rendered inside Task; sleep/night are scheduled background processes, not modes.
+
+#### Scenario: Mode switch enforcement
+- **WHEN** you switch to Plan mode
+- **THEN** the next interactions use Plan's model/tools/context/rules, and Task tools unavailable in Plan are genuinely unreachable until exit.
+
+### Requirement: Plan entry threshold [need]
+
+Plan mode SHALL be offered only when conversation shows a sustained make-something pattern (building a system/feature, lifestyle-scale problems, multi-decision solutions) or when you explicitly request it. Ordinary discussion SHALL NOT trigger the offer. A contextual offer SHALL always require your consent before entry. Once entered, the full process SHALL always run — no lite path.
+
+#### Scenario: Loose brainstorm
+- **WHEN** Chat discusses an idea without building intent
+- **THEN** no Plan offer appears; only sustained building patterns or an explicit request open Plan.
+
+#### Scenario: Contextual offer needs consent
+- **WHEN** sustained design discussion meets the Plan threshold
+- **THEN** Chat offers Plan mode and remains in Chat until you accept.
+
+### Requirement: Planning lives in Chat [need]
+
+Plans SHALL be drafted, questioned, researched, and revised inside Chat so Task work is never interrupted by planning. Only the approved, contextually staged execution package moves into Task after your start signal.
+
+#### Scenario: Plan while Task runs
+- **WHEN** Plan discussion begins while Task has work in flight
+- **THEN** planning stays in Chat, Task continues unchanged, and no planned step enters Task before explicit start.
+
+### Requirement: Mandatory Plan sequence [need]
+
+Plan mode SHALL always run the full sequence — initial intent plan, research protocol, viability report, evidence-informed plan, targeted further research, final viability, your explicit start, staged implementation, independent review, final report — with no lite path and no arbitrary round caps.
+
+#### Scenario: Full sequence on entry
+- **WHEN** you enter Plan mode for a build
+- **THEN** the sequence runs in order: initial intent plan, INWARD/OUTWARD/APPLICABILITY/INNOVATION?/ADVERSARIAL/SYNTHESIS/QUALIFY, viability report, evidence-informed revision, targeted further research, final viability, explicit start, contextually staged implementation, independent review, final report.
+
+#### Scenario: Material flaw mid-implementation
+- **WHEN** execution discovers the approved plan's architecture is wrong
+- **THEN** work returns to Plan with the new fact, targeted research runs, viability re-evaluates, and you re-approve before implementation resumes.
+
+### Requirement: Plan document contents [need]
+
+Every plan document SHALL contain: goal/definition of done; decisions with reasons and rejected alternatives; steps and dependencies; research/evidence/unknowns; cost/resource estimates; viability history; explicit start authority; progress and revision log. The document SHALL be durable, editable by you, recallable, and re-runnable piecewise. OpenSpec SHALL serve as the secondary format for spec/build-shaped work.
+
+#### Scenario: Plan document on approval
+- **WHEN** you approve a plan for start
+- **THEN** the document holds all listed sections, execution stages per the project's real dependencies, and progress renders against its text.
+
+#### Scenario: Plan lifecycle
+- **WHEN** an approved plan is closed and reopened later
+- **THEN** the same durable document is recallable/editable, selected phases can re-run piecewise, and revision/progress history remains intact.
+
+### Requirement: You reserve start [need]
+
+Execution SHALL begin only on your explicit start signal. Planning SHALL queue research tasks, poke holes, and refine, but SHALL NOT execute tasks during planning.
+
+#### Scenario: No auto-start
+- **WHEN** the final viability check passes
+- **THEN** the plan waits for your start signal; nothing executes from qualification alone.

docs/openspec/changes/add-native-rune-tui/specs/rune-runtime/spec.md

@@ -0,0 +1,82 @@
+# Spec Delta: rune-runtime
+
+## Purpose
+My continuous runtime: one process that works headless, owns its lifecycle, and hosts the single native TUI interface plus a supervised Rust worker boundary and a web-link live feed — without sessions or mimocode hosting.
+
+## ADDED Requirements
+
+### Requirement: Continuous headless program [need]
+
+I SHALL run as one continuous program that performs all work independently of any attached face. Closing or minimizing the TUI SHALL NOT stop tasks, schedules, memory processing, alerts, or child workers. OpenCode-style session lifecycle SHALL NOT exist; every launch continues me.
+
+#### Scenario: Face closes mid-task
+- **WHEN** the TUI closes while a task runs
+- **THEN** the task continues, alerts fire per configured rules, and reopening the TUI returns to the same live state with no session ceremony.
+
+### Requirement: Deliberate exit writes continuity checkpoint [need]
+
+An explicit Exit SHALL write a canonical continuity checkpoint before stopping: active/incomplete tasks, current plan revision, last edited files, pending decisions/alerts, connected work handles, replay cursor, and source/evidence pointers. The checkpoint SHALL reference canonical state, never a lossy summary. Crash recovery SHALL resume from the last committed checkpoint with explicit gap status and SHALL NOT duplicate irreversible effects.
+
+#### Scenario: Clean exit and restart
+- **WHEN** I exit deliberately with a task in flight and restart later
+- **THEN** startup reads the checkpoint, presents the in-flight task state, and resumes from the replay cursor without re-executing completed irreversible steps.
+
+### Requirement: Auto-start and auto-recover [need]
+
+I SHALL auto-start at login through the platform-appropriate mechanism and SHALL auto-restart after crashes with work resume. Platform-general packages SHALL be signed, produced on clean machines per target, and accepted through a slowest-supported-target SLO run — a fast development desktop alone proves nothing.
+
+#### Scenario: Process crash mid-run
+- **WHEN** my process crashes during an unattended workflow
+- **THEN** the supervisor restarts it, the workflow resumes from its checkpoint, and a typed alert reports the crash and recovery outcome.
+
+#### Scenario: Login auto-start on each supported platform
+- **WHEN** you log in after enabling auto-start
+- **THEN** the platform-appropriate supervisor starts the runtime without opening a face, and equivalent behavior is proven for every claimed platform.
+
+#### Scenario: Slowest-target acceptance
+- **WHEN** a per-target package is proposed for acceptance
+- **THEN** the SLO run on the slowest supported target passes before the package is qualified.
+
+### Requirement: Supervised worker boundary [need]
+
+Go SHALL own reactive face state, supervision, cancellation UI, and bounded projection; a persistent Rust worker SHALL own coarse deterministic/background operations over length-bounded, versioned stdio frames (request ID, op type, schema version, deadline, cancellation, progress, result/error, provenance). Cancellation SHALL latch; effects follow prepare/commit/reconcile; kill/orphan cleanup SHALL be verified.
+
+#### Scenario: Cancel latch
+- **WHEN** cancellation is requested before the worker registers the operation
+- **THEN** the cancellation latches, the operation never starts, and a late registration observes the latch.
+
+#### Scenario: Frame corruption
+- **WHEN** a frame arrives corrupt or truncated
+- **THEN** the boundary fails closed with a typed error and no partial effect commits.
+
+#### Scenario: Kill and orphan cleanup
+- **WHEN** the worker or its parent is killed mid-operation
+- **THEN** supervision reaps orphans, prepare/commit reconcile completes or rolls back, and restart produces no duplicate irreversible effect.
+
+#### Scenario: Typing under progress flood
+- **WHEN** worker progress floods the boundary while you type
+- **THEN** bounded queues with semantic-event priority keep input responsive.
+
+### Requirement: Single-interface TUI with web-link live feed [need]
+
+The TUI SHALL be my single native interface. Anything outside the TUI SHALL be a web-link real-time feed: a live, read-oriented view talking to me, never a second native face. The future GUI owns multi-screen; a native TUI multi-face exists only if a real need appears and is NOT a retirement requirement. Input from paired devices or remotes SHALL be origin-tagged and ordered by authenticated arrival, with committed/pending states visually distinct.
+
+#### Scenario: Web feed live view
+- **WHEN** you open the web-link feed while Task runs
+- **THEN** it renders the same live state read-only with evidence links and never spawns a native second face.
+
+#### Scenario: Origin-tagged ordering
+- **WHEN** a paired phone command and the desktop TUI act near-simultaneously
+- **THEN** commands execute in authenticated arrival order with origin shown, and a material conflict requests your clarification.
+
+#### Scenario: Multi-face demotion
+- **WHEN** retirement evidence is gathered
+- **THEN** no native multi-TUI-face synchronization is required; the web feed and paired remote commands carry the outside-TUI story.
+
+### Requirement: Authority-map truth prerequisite [need]
+
+Before runtime claims ship, the checkout/deployment split (INWARD finding) SHALL be repaired so the launcher executes the artifact the repository qualifies. Runtime attestation SHALL bind evidence to the exact deployed generation, not the checkout. A live attestation test SHALL fail whenever the observed runtime digest differs from the qualified artifact.
+
+#### Scenario: Attestation mismatch
+- **WHEN** the activated generation's identity differs from what the launcher resolves
+- **THEN** startup reports the mismatch as degraded state and refuses claims about the checkout's behavior.

docs/openspec/changes/add-native-rune-tui/specs/skills-and-growth/spec.md

@@ -0,0 +1,74 @@
+# Spec Delta: skills-and-growth
+
+## Purpose
+How repeated successful work becomes reusable capability: consent-gated drafting, cheapest reliable form, tested activation, common SKILL.md compatibility, the taxonomy gate, and governed self-transformation.
+
+## ADDED Requirements
+
+### Requirement: Consent-gated pattern development [need]
+
+When I notice a repeated successful pattern, I SHALL ask whether you want it developed before drafting anything. Noticing alone SHALL cause no change. Only after consent SHALL the capability be drafted and offered.
+
+#### Scenario: Pattern noticed
+- **WHEN** the same multi-step workflow succeeds three times
+- **THEN** I show a proposal describing the pattern and draft offer; nothing is drafted until you consent.
+
+### Requirement: Cheapest reliable form [need]
+
+Deterministic repeated work SHALL become ordinary automation; judgment-requiring work SHALL become a skill; mixed work SHALL use a skill calling deterministic automation. The objective is fewer model calls over time without lost capability.
+
+#### Scenario: Deterministic routine
+- **WHEN** a repeated pattern is fully deterministic
+- **THEN** it becomes automation (code), not a model-driven skill; the skill layer wraps it only where judgment is needed.
+
+### Requirement: Tested activation [need]
+
+Before activation, a new capability SHALL be tested against prior examples and at least one separate example; improvement, failure cases, and rollback SHALL be shown; you approve activation. Failed candidates SHALL remain drafts.
+
+#### Scenario: Skill activation gate
+- **WHEN** a drafted skill completes testing
+- **THEN** the approval surface shows test evidence, failure cases, and rollback; activation happens only on your approval.
+
+### Requirement: SKILL.md compatibility with authority boundary [need]
+
+Skill packages SHALL read and export the common SKILL.md format. My authority, evidence, and approval controls SHALL live outside the imported package so foreign packages cannot redefine me. The extension lifecycle (`extension-lifecycle`) SHALL NOT duplicate this skill authority; extensions stay data-and-capability declarations under the same approval law.
+
+#### Scenario: Foreign skill import
+- **WHEN** an external SKILL.md package is added
+- **THEN** it installs under my authority layer, its content is treated as untrusted guidance, and it cannot alter approval rules or identity.
+
+### Requirement: Taxonomy gate (pending research)
+
+The completed taxonomy protocol remains EVIDENCE_DEFICIENT. Change-classification labels SHALL NOT be used — even as routing — and no learned sentinel SHALL ship. This prohibition SHALL NOT block unrelated TUI capabilities; every skill/self-change continues through explicit approval under D02.
+
+#### Scenario: Taxonomy dependency
+- **WHEN** skills/growth ships without an operational taxonomy
+- **THEN** every skill change uses explicit approval, no label affects treatment, and unrelated TUI capabilities remain available.
+
+### Requirement: Governed self-transformation [need]
+
+The qualified self-transformation system SHALL implement `self-transformation/synthesis.json` with RM01–RM15 and IAM01–IAM22 binding. Nothing SHALL self-activate until DEP01–DEP07 are live-proven.
+
+#### Scenario: Owner decisions binding activation
+- **WHEN** a self-change proposal proceeds
+- **THEN** D01–D10 bind: your explicit approval; labels inactive pending D02; compact+expandable protected approval; protected-root anchor; explicit irreversible-effect acceptance; clean prospective receipts; shadow-first; rollback reconciliation; evaluator succession deferred; proposal-only until repairs prove.
+
+#### Scenario: Single authority-chain proposal
+- **WHEN** I identify an improvement to my own code or capability
+- **THEN** it flows through propose → Construction Contract → pre-decision ledger → effect eligibility → deterministic guards → independent qualification → read-only shadow → owner authorization → exact staging/attestation → eligible canary → promote/reject → observe/receipt → rollback/close; no parallel activation path exists.
+
+### Requirement: Activation prerequisites [need]
+
+DEP01–DEP07 SHALL be explicit blocking dependencies: deployed-runtime attestation; repaired fail-closed ledger; every mutation-writer bypass closed; real critic semantics and protected anchors; authenticated one-use owner envelope; one enforced effect-mediation registry/eligibility sieve; Sleight G1–G8/MUST-01–MUST-18 qualification and TUI truth.
+
+#### Scenario: Missing prerequisite
+- **WHEN** any DEP01–DEP07 prerequisite lacks live proof
+- **THEN** proposals/offline evidence may continue but activation and run-then-report remain impossible.
+
+### Requirement: Negative qualification tests [need]
+
+Every load-bearing mechanism SHALL carry the cheapest-disproof tests from `synthesis.json`: bypass writes; runtime/dependency substitution; ledger corruption/crash/replay; owner-envelope impersonation/replay/scope widening; always-pass/skipped critics; hidden effects; shadow leakage; partial rollback/owner-event loss; forged proven-use; cross-provider identity drift; evidence attempting to mint authority.
+
+#### Scenario: Perfect evidence without authority
+- **WHEN** a candidate presents perfect test/evidence results without a current exact owner envelope
+- **THEN** activation fails; evidence cannot mint authority.

docs/openspec/changes/add-native-rune-tui/specs/sub-agent-orchestration/spec.md

@@ -0,0 +1,70 @@
+# Spec Delta: sub-agent-orchestration
+
+## Purpose
+Full live view and control of sub-agents (SA-D1): explicit-brief lifecycle, rail-first visibility, mid-run steering, cancellation, per-action receipts, authority inherited down the whole chain (SA-D2), chained spawning with visible ancestry, and nothing running invisibly.
+
+## ADDED Requirements
+
+### Requirement: Agent lifecycle [need]
+
+An agent SHALL be spawned with an explicit brief, run, be steerable mid-run, and end in complete or cancel. An agent without a recorded brief and spawning origin SHALL NOT start. Cancellation SHALL stop the agent at a safe boundary and preserve its partial work, evidence, and receipts.
+
+#### Scenario: Spawn with brief
+- **WHEN** you or Rune spawn an agent
+- **THEN** the brief (goal, scope, constraints) and the spawning origin are recorded before the agent starts.
+
+#### Scenario: Cancel mid-run
+- **WHEN** you cancel a running agent
+- **THEN** it stops at a safe boundary, its partial work and evidence persist, and the cancellation is itself receipted.
+
+### Requirement: Rail-first visibility [need]
+
+Every running agent SHALL be a first-class child of the activity rail per `work-observability`'s shared-rail-and-takeover requirement: selectable and expandable to current action, produced evidence, waiting/block reason, and process history. An agent that cannot be shown in the rail SHALL NOT be spawnable; every running agent SHALL be discoverable in that one view.
+
+#### Scenario: Nothing invisible
+- **WHEN** any agent is running — spawned by you, by Rune, by another agent, or headless
+- **THEN** it appears in the activity rail and expands to its live work; no agent exists outside the rail.
+
+### Requirement: Mid-run steering [need]
+
+You and Rune SHALL steer a running agent exactly as Task is steered: a steer control redirects immediately (completing or safely stopping the smallest current operation first where effects require), a queued instruction delivers without interrupting. Every steer SHALL be recorded in the agent's history with origin.
+
+#### Scenario: Steer a running agent
+- **WHEN** you issue a steer while an agent runs
+- **THEN** the current smallest operation completes or stops safely, work continues under the new direction, and the steer appears in the agent's history.
+
+### Requirement: Per-action receipts [need]
+
+Every agent action that writes or changes anything SHALL carry an evidence-bearing receipt per `trust-and-sovereignty`'s act-then-receipt requirement: concise in Chat, full record (command, before/after, restore point, evidence, origin, principal chain) in the activity view. An unreceipted agent write SHALL be treated as unmediated and refused.
+
+#### Scenario: Receipt on every agent write
+- **WHEN** an agent edits a file or alters state
+- **THEN** a concise receipt lands in Chat and the full record in the activity view, linked to the agent's identity and ancestry.
+
+### Requirement: Authority inheritance [need]
+
+Your standing authority rule SHALL flow down the whole agent chain per `trust-and-sovereignty`'s personal-mode rule: on your machine agents act without asking, and that capability's hard-ask classes (outside-area/mass/unprotected deletions, external-network origins, self-change activation) apply unchanged at every depth. Observability is the control, not interception.
+
+#### Scenario: Hard ask survives inheritance
+- **WHEN** a depth-two agent attempts an outside-area mass deletion
+- **THEN** the hard ask fires exactly as if Rune attempted it, and the denial pairs with a fast owner-resolution path.
+
+#### Scenario: No authority amplification
+- **WHEN** a spawned agent attempts to grant itself or a child authority beyond what it inherited
+- **THEN** the attempt is refused and recorded under the trust envelope's principal chain.
+
+### Requirement: Chained spawning with visible ancestry [need]
+
+An agent MAY spawn further agents under the same rules: explicit brief, receipts, rail visibility, inherited authority. Full ancestry (who spawned whom, to what depth) SHALL be visible on every agent and recorded in every receipt. A spawned agent SHALL NOT exceed the authority it inherited.
+
+#### Scenario: Chain of three
+- **WHEN** an agent spawns an agent that spawns a third
+- **THEN** all three appear in the rail with their ancestry, and each receipt names its full principal chain.
+
+### Requirement: Agent completion record [need]
+
+A completed agent SHALL produce a completion receipt per `work-observability`'s completion-receipts requirement: what changed and why, proof, files/restore points/commits, cost/time/model use, and remaining work/open questions. Agent history SHALL persist searchable and exportable after leaving the live rail.
+
+#### Scenario: Agent completes
+- **WHEN** an agent finishes its brief
+- **THEN** the completion receipt arrives in Chat with full evidence linked, and its history cools into the durable activity record.

docs/openspec/changes/add-native-rune-tui/specs/task-management/spec.md

@@ -0,0 +1,58 @@
+# Spec Delta: task-management
+
+## Purpose
+The full living task tree in the Task lane (SA-D4): task objects with statuses, sub-tasks, dependencies, and blocked-by relations; owner reordering; assignment to Rune or any agent; full history and audit. Lane behavior itself stays owned by `dual-lane-interface`.
+
+## ADDED Requirements
+
+### Requirement: Task tree objects [need]
+
+Every task SHALL be an object in one living tree carrying: status, parent/sub-task relations, dependencies, blocked-by links, assignee, brief, and evidence links. Status transitions SHALL be recorded with origin and time. Completion or cancellation SHALL preserve the task's record; tasks SHALL NOT be deleted out of history.
+
+#### Scenario: Blocked by dependency
+- **WHEN** a task's blocked-by dependency is unfinished
+- **THEN** the task shows blocked with the blocking task named, and starting it warns against the recorded dependency.
+
+#### Scenario: Sub-task rolls up
+- **WHEN** the last sub-task of a parent task completes
+- **THEN** the parent reflects its aggregate state from its sub-tasks rather than a manually duplicated status.
+
+### Requirement: Owner reordering [need]
+
+You SHALL be able to reorder tasks and sub-tasks directly — priority, sequencing, parentage. Every reorder SHALL be recorded in history and SHALL propagate to scheduling and queue order. Rune and agents MAY suggest reorders; only your recorded reorder changes owner-set order.
+
+#### Scenario: Reorder mid-flight
+- **WHEN** you move a queued task above the currently running one
+- **THEN** the running task finishes its smallest safe operation, the reordered queue takes effect, and the reorder is history-recorded.
+
+### Requirement: Assignment to Rune or agents [need]
+
+Any task SHALL be assignable to Rune or to any agent, bridging to `sub-agent-orchestration`: assignment spawns or directs work under that capability's lifecycle, visibility, receipt, and authority rules. An agent-assigned task SHALL execute in the agent's thread per `thread-orchestration`. Reassignment mid-task SHALL preserve history and evidence.
+
+#### Scenario: Assign to an agent
+- **WHEN** you assign a task to an agent
+- **THEN** the agent spawns with the task as its brief, appears in the rail per sub-agent-orchestration, and the task's status tracks the agent's live state.
+
+#### Scenario: Reassign mid-task
+- **WHEN** you reassign a running task from an agent to Rune
+- **THEN** the agent reaches a safe boundary, its partial work and receipts stay linked to the task, and Rune continues from the recorded state.
+
+### Requirement: Full history and audit [need]
+
+Every task SHALL carry full history — creation, status transitions, reorders, assignments, receipts, and evidence links — with origin attribution per `trust-and-sovereignty`'s envelope. The tree's history SHALL be searchable and exportable per `work-observability`'s durable activity history requirement.
+
+#### Scenario: Audit a completed tree
+- **WHEN** you open a completed task tree weeks later
+- **THEN** every transition, reorder, assignment, and receipt is attributable and inspectable in one place.
+
+### Requirement: Task lane integration [need]
+
+The task tree SHALL render in the Task lane defined by `dual-lane-interface`: the lanes' visibility, promotion, steering, and queue/steer rules apply unchanged to tree interactions. Task-management SHALL NOT redefine lane behavior; the tree is the Task lane's work substrate.
+
+#### Scenario: Tree in the lane
+- **WHEN** the task tree is open in the Task lane while work runs
+- **THEN** lane steering and queue controls apply to the selected tree node without special-casing, per dual-lane-interface.
+
+#### Scenario: Promotion into the tree
+- **WHEN** a Chat promotion creates a task
+- **THEN** it lands as a task object in the tree with its promotion package (decision, evidence refs, intended effect) attached.

docs/openspec/changes/add-native-rune-tui/specs/thread-orchestration/spec.md

@@ -0,0 +1,42 @@
+# Spec Delta: thread-orchestration
+
+## Purpose
+The thread model (owner addendum, 2026-10-15): threads are the universal unit of conversation and work — user-started, Rune-started, split, or agent workspace — each recording origin, parent, inherited-context slice, live status, and result destination. One tree covers human splits and agent children alike. Lane behavior stays owned by `dual-lane-interface`.
+
+## ADDED Requirements
+
+### Requirement: Threads as the universal unit [need]
+
+All conversation and work SHALL be organized as threads: user-started, Rune-started, split-off, or agent workspace. A thread SHALL record its origin (the exact message/decision that spawned it), parent, inherited-context slice, live status, and result destination. Any node's origin SHALL be traceable to the root in one view.
+
+#### Scenario: Trace to root
+- **WHEN** you select any thread node in the tree
+- **THEN** its full ancestry — origin message/decision, parent chain, inherited-context slice, status, result destination — is traceable to the root in one view.
+
+### Requirement: Thread starting [need]
+
+A new thread SHALL be startable from anywhere with an explicit purpose: its origin (the message or decision that prompted it), purpose, parent, and initial context slice SHALL be recorded at creation. An originless thread SHALL NOT exist.
+
+#### Scenario: Start from mid-conversation
+- **WHEN** you start a new thread from a message in an existing conversation
+- **THEN** the new thread records that message as its origin, carries the declared purpose and context slice, and appears as a child in the thread tree.
+
+### Requirement: Thread splitting [need]
+
+Any conversation SHALL be splittable at a chosen point: context up to the fork carries into the new thread, both threads continue independently, and the divergence point is permanently marked on both. Post-fork messages SHALL NOT flow silently between siblings.
+
+#### Scenario: Split a conversation
+- **WHEN** you split a running conversation at a chosen message
+- **THEN** the fork carries prior context, both threads continue independently, and both show the permanently marked divergence point.
+
+#### Scenario: No silent sibling leakage
+- **WHEN** one sibling thread produces new messages after a split
+- **THEN** the other sibling receives nothing of it except through explicit cross-references or an origin trace.
+
+### Requirement: Agent workspaces are threads [need]
+
+Child agents SHALL run in their own threads per `sub-agent-orchestration`: one tree shows human splits AND agent children alike — no second system. Agent-thread nodes SHALL expose the same origin/parent/status/result fields and the same steering, cancellation, receipt, and authority rules as any thread. A task assigned per `task-management` executes in its assignee's thread.
+
+#### Scenario: One tree, both kinds
+- **WHEN** a human-split thread and an agent-spawned thread both exist
+- **THEN** both appear as nodes in the single thread tree with type-labeled ancestry, and expanding the agent node yields sub-agent-orchestration's live steering and cancellation.

docs/openspec/changes/add-native-rune-tui/specs/tools-providers-devices/spec.md

@@ -0,0 +1,150 @@
+# Spec Delta: tools-providers-devices
+
+## Purpose
+Tools, providers, model routing, refusal handling, local-model acquisition, and connected-device awareness — every path live-proven before retirement claims.
+
+## ADDED Requirements
+
+### Requirement: Live-proven tool and provider paths [need]
+
+Before any retirement or capability claim, EVERY exposed tool and provider path SHALL be observed live: local/cloud models, authentication, streaming, tool execution, refusal/fallback behavior, failure, restart, and recovery. Configuration existence SHALL NOT count as capability. Worker-backed paths SHALL carry cancellation and recovery receipts from the supervised boundary.
+
+#### Scenario: Provider proof gate
+- **WHEN** a provider appears in the TUI's selector
+- **THEN** its listing traces to a live verification run covering auth, streaming, failure, and recovery — not a config entry alone.
+
+#### Scenario: Worker-backed cancellation receipt
+- **WHEN** a tool runs on the Rust worker and is cancelled mid-operation
+- **THEN** the path shows a cancellation receipt proving the latch held and no partial effect committed.
+
+#### Scenario: Complete exposed-path proof
+- **WHEN** any tool/provider path is marked available
+- **THEN** evidence covers tool execution, authentication, streaming, classified refusal/fallback, ordinary failure, process restart, and recovery for that exact path.
+
+### Requirement: Cloud-first configurable routing [need]
+
+Cloud models SHALL be the normal default with model selection in settings. Installed local models (Ollama/llama.cpp) SHALL be selectable per job or settable as the user-configured default. Mode-pinned defaults follow the modes' hard-set behavior. Every placement decision SHALL be evidence-based and user-visible, never made solely from a capability card.
+
+#### Scenario: Local default
+- **WHEN** you set an installed Ollama model as default
+- **THEN** subsequent work routes to it until changed, and the status strip shows the active model and device.
+
+### Requirement: Evidence-bearing placement [need]
+
+Placement SHALL consume evidence-bearing inputs with evidence age as an eligibility constraint; stale or self-claimed data SHALL render as unverified. License, residency, and download consent SHALL be explicit where known. A user-visible reason SHALL explain every placement, and no selection or migration SHALL occur solely from a capability card.
+
+#### Scenario: Stale healthy card
+- **WHEN** an 86400s-stale card claims a healthy fast device while a fresh slow one is measured
+- **THEN** evidence age excludes the stale card from eligibility and the reason names the constraint.
+
+#### Scenario: Placement reason visible
+- **WHEN** work routes to the desktop over the laptop
+- **THEN** the visible reason cites measured evidence, not a label.
+
+#### Scenario: Capability drift
+- **WHEN** a provider reports tool support contradicting the capability floor
+- **THEN** the contradiction surfaces as unverified and never silently flips eligibility.
+
+### Requirement: Classified refusal handling [need]
+
+The TUI SHALL classify probable model-guardrail refusals separately from quota, transport, malformed-request, and ordinary model failures. Cloud requests SHALL retry up to three times with bounded, reason-aware retries. After three failures the TUI SHALL show an accurate explanation and offer the local route; ordinary failures SHALL NOT be relabeled as censorship.
+
+#### Scenario: Guardrail refusal
+- **WHEN** a cloud model refuses a sensitive research request
+- **THEN** after classified bounded retries, the TUI reports the probable guardrail refusal and offers a configured local model.
+
+### Requirement: Hugging Face acquisition with consent [need]
+
+When no suitable local model exists, I SHALL search Hugging Face for task-suitable candidates, assess compatibility and hardware cost, explain the choice, and request consent before downloading. Public releases SHALL always require consent; configured local models run without re-consent.
+
+#### Scenario: Consented download
+- **WHEN** a local route is offered and no suitable local model exists
+- **THEN** the TUI presents candidate, size, hardware fit, and license, and downloads only on consent.
+
+### Requirement: Stateful connected devices [need]
+
+Every approved device SHALL have equal command authority but SHALL expose its real execution resources/capabilities as measured evidence, not self-report. Identities SHALL distinguish human, face, device, workload, and forge runner. The desktop SHALL be the default coordinator/execution home; phone SHALL primarily control/route work; laptop MAY execute eligible local work. No device may claim unsupported processing.
+
+#### Scenario: Device-aware status
+- **WHEN** the laptop TUI opens while the desktop runs me
+- **THEN** both devices appear connected in the status view with their measured capabilities, and work placement waits for your choice.
+
+### Requirement: Device-forge job capsule [need]
+
+Every distributed job SHALL travel as a capsule: explicit target identity, measured capabilities, artifact/runtime digests, selected forge plus expected base revision, effect limits, checkpoint cursor, cancellation, and correlation IDs. Result application SHALL be idempotent, with no silent retargeting to another forge or device.
+
+#### Scenario: Compromised laptop target
+- **WHEN** a phone-origin job routes to a compromised laptop
+- **THEN** the capsule's digests and effect limits bound what the target can do, and correlation IDs keep attribution intact.
+
+#### Scenario: Duplicate result
+- **WHEN** the same completed capsule is presented twice
+- **THEN** idempotent application commits the effect once and the duplicate is recorded.
+
+#### Scenario: Changed forge base
+- **WHEN** the selected forge's base revision differs from the capsule's expectation
+- **THEN** the mismatch halts for owner resolution rather than silently rebasing.
+
+### Requirement: Real-hardware qualification [need]
+
+The multi-device promise SHALL rest on real-hardware qualification runs as implementation-gated evidence: partition-while-revoked with durable clocks, measured capability attestation on heterogeneous hardware, and interrupted-upload/digest-mismatch/signed-provenance runs on the real forge. Simulated or model-level passes SHALL never suffice.
+
+#### Scenario: Simulated pass rejected
+- **WHEN** a device/forge claim is supported only by model or simulated fixtures
+- **THEN** the claim is not qualified and the distributed path stays gated.
+
+#### Scenario: Partition while revoked
+- **WHEN** a device is revoked while partitioned and later presents completed work
+- **THEN** durable clocks prove the revocation boundary and the result is quarantined, never silently applied.
+
+#### Scenario: Capability self-report
+- **WHEN** a real worker claims a GPU it does not have
+- **THEN** measured attestation on the real hardware contradicts the claim and placement refuses it.
+
+### Requirement: Short one-time pairing [need]
+
+A new device SHALL pair using a short, expiring, one-use code approved from an existing face. Automatic local-network trust SHALL NOT exist.
+
+#### Scenario: Pair phone
+- **WHEN** an unpaired phone presents its one-time code
+- **THEN** an approved face shows device identity/capabilities, your acceptance pairs it once, and code reuse fails.
+
+### Requirement: Offline last-known state and drafts [need]
+
+A disconnected face SHALL show visibly stale last-known state and retain local drafts only. On reconnect it SHALL first synchronize canonical live state; drafts SHALL NOT auto-send against stale assumptions. Offline edits SHALL replicate only as actor-tagged, schema-versioned proposals against a signed base revision; commands, approvals, credentials, and effects SHALL never file-sync.
+
+#### Scenario: Reconnect with draft
+- **WHEN** the laptop reconnects with an unsent draft
+- **THEN** live desktop state updates first, the draft remains local/editable, and sending requires your action.
+
+#### Scenario: Schema migration after reconnect
+- **WHEN** a draft authored under schema v1 reconnects after a v2 migration
+- **THEN** acceptance re-authorizes under the current revocation epoch and semantic conflicts go to you — never auto-merge.
+
+#### Scenario: Command-like payload in a draft
+- **WHEN** a replicated draft embeds a command- or approval-like payload
+- **THEN** it stays inert proposal data; only the ordered runtime path can execute commands.
+
+### Requirement: Pipeline-driven placement and forge correlation [need]
+
+Desktop SHALL be the default placement. Explicit/remembered pipelines MAY route eligible work to other devices only after capability checks. Distributed results SHALL correlate through a deliberately selected forge; Gitea is current default, while Gitea/GitHub/other targets remain configurable rather than inferred.
+
+#### Scenario: Refused request routed to laptop
+- **WHEN** an approved pipeline routes a refused cloud request to a laptop local model
+- **THEN** the laptop executes only if capable, commits the result, and pushes/correlates through the explicitly selected desktop forge.
+
+### Requirement: Immediate revocation and lost-device response [need]
+
+Revoking a device SHALL immediately disconnect it, invalidate its key across every face, discard queued remote commands, quarantine any results it later presents, preserve local cached data only as encrypted stale state, and record revocation. A lost device SHALL additionally trigger identification and rotation of every channel credential it could access.
+
+#### Scenario: Lost offline phone
+- **WHEN** you revoke a lost phone while it is offline
+- **THEN** its pairing key is invalid immediately, exposed gateway/webhook credentials are listed and rotated, and the TUI reports what encrypted cached state may remain on the phone.
+
+### Requirement: Durable connection history [need]
+
+Settings SHALL retain paired/revoked device history: first/last seen, origins, capabilities, commands sent, approvals/revocations, and credential rotations. A revoked identity SHALL NOT be silently reused.
+
+#### Scenario: Re-pair revoked device identity
+- **WHEN** a revoked device presents old credentials
+- **THEN** access fails and the attempt appears in durable connection history; a fresh pairing ceremony is required.

docs/openspec/changes/add-native-rune-tui/specs/trust-and-sovereignty/spec.md

@@ -0,0 +1,78 @@
+# Spec Delta: trust-and-sovereignty
+
+## Purpose
+The trust model: act-then-receipt on your machine, hard asks for defined classes, external-origin controls, and sovereignty over who may alter me. Self-transformation is owned by `skills-and-growth`.
+
+## ADDED Requirements
+
+### Requirement: Act-then-receipt personal mode [need]
+
+On your machine, I SHALL act without permission prompts and SHALL post visible receipts: concise change receipts in Chat (what/why), full detail in Task/the activity view (command, before/after, restore point, evidence, origin, principal chain). Public releases SHALL default to ask-first with configurable posture.
+
+#### Scenario: Routine change with receipt
+- **WHEN** I modify a project file in personal mode
+- **THEN** Chat shows a concise receipt line and Task shows the full record — no prompt interrupted the action.
+
+### Requirement: Principal-to-effect envelope [need]
+
+Every command — owner, guest, agent, tool, device, or service — SHALL carry separate authenticated subject, acting principal, delegator, device, workload, and effect-owner fields, with an immutable command digest bound to the current policy revision. Every writer SHALL recompute the digest from presented fields and SHALL NOT trust a carried digest. Unknown principal kinds SHALL be denied before scope checks.
+
+#### Scenario: Digest rebinding
+- **WHEN** a command arrives whose carried digest does not match its presented fields
+- **THEN** every writer recomputes the digest from those fields, denies the mismatch, audits the denial, and a fast owner-resolution path is offered.
+
+#### Scenario: Unknown principal kind
+- **WHEN** a command presents a principal kind the policy does not recognize
+- **THEN** it is denied before any scope check, the denial is audited, and you can resolve or override it quickly.
+
+#### Scenario: Effect-time revalidation
+- **WHEN** a protected action approved earlier reaches its effect boundary after policy changed
+- **THEN** policy is revalidated at effect time against the current revocation epoch before the effect runs.
+
+### Requirement: Hard asks survive [need]
+
+Three classes SHALL always request your explicit involvement even in personal mode: outside-area/mass/unprotected deletions; origins outside your network; self-change activation (owned by `skills-and-growth`). Forbidden boundaries SHALL be visible to me with a flag-up path. Revocation SHALL proceed by epoch and key, and every hard ask SHALL offer you a fast resolution path, never a dead end.
+
+#### Scenario: Outside-area deletion
+- **WHEN** a task needs deletion outside my work area
+- **THEN** I ask explicitly before deleting, regardless of personal act-then-receipt posture.
+
+#### Scenario: External-network origin
+- **WHEN** an instruction originates outside your approved network or paired devices
+- **THEN** I request explicit approval before acting and show the verified origin.
+
+#### Scenario: Self-change activation
+- **WHEN** a self-change reaches activation
+- **THEN** the skills-and-growth owner blocks until your protected approval completes.
+
+### Requirement: Sovereignty [need]
+
+No external program SHALL alter me — code, configuration, skills, identity. External programs SHALL receive functional capability only (orders, questions, answers). This SHALL NOT prohibit my own governed self-development. Every writer SHALL pass envelope mediation; no unmediated legacy writer may reach canonical state.
+
+#### Scenario: External alter attempt
+- **WHEN** an external program attempts to modify my configuration or skills
+- **THEN** the attempt is refused and recorded; its ability to command me remains governed separately.
+
+#### Scenario: Legacy writer bypass
+- **WHEN** an internal code path attempts to write canonical state without envelope attribution
+- **THEN** the write is refused as unmediated and surfaced for repair, not silently allowed.
+
+### Requirement: Outside-network and guest attribution [need]
+
+Outside-network and guest commands SHALL pass the same trust decision with per-step attribution and a shared audit correlation ID. Audit SHALL record but never authorize. Every denial SHALL pair with a fast owner-resolution/override path; no rule may permanently block legitimate work.
+
+#### Scenario: Guest proposal chain
+- **WHEN** a guest-originated proposal survives merge acceptance and reaches a protected effect
+- **THEN** each step carries the original principal chain with one audit correlation ID, and effect-time revalidation re-checks revocation before the effect runs.
+
+#### Scenario: Audit never authorizes
+- **WHEN** an audit record shows a past approval for the same command digest
+- **THEN** that record alone cannot authorize re-execution; authorization comes only from current policy and a live owner approval.
+
+### Requirement: Public-release posture (want)
+
+Any public release SHALL make the trust policy user-configurable, with the sovereignty rule non-negotiable and only its exceptions governed.
+
+#### Scenario: Public configuration
+- **WHEN** a public user configures trust settings
+- **THEN** ask-first defaults hold, posture is adjustable, and no setting permits external programs to alter the agent.

docs/openspec/changes/add-native-rune-tui/specs/unattended-workflows/spec.md

@@ -0,0 +1,38 @@
+# Spec Delta: unattended-workflows
+
+## Purpose
+Scheduled, event, condition, and natural-language-triggered work with durable contracts, bounded retries, and governed improvement — the passive-first law made concrete.
+
+## ADDED Requirements
+
+### Requirement: Four trigger classes [need]
+
+Unattended work SHALL start from: time schedules, named events (code change, new issue, incoming message, file change, device connecting), measured conditions, and natural-language routines converted into reviewed schedules/workflows. No workflow SHALL require the TUI open.
+
+#### Scenario: Event-triggered run
+- **WHEN** a watched event fires while no face is attached
+- **THEN** the bound workflow runs headlessly, writes its record, and alerts per configured rules.
+
+### Requirement: Workflow contract [need]
+
+Saved workflows SHALL declare inputs, steps, checks for consequential steps, completion condition, and result. The same workflow SHALL run manually or unattended. Natural-language routines SHALL convert into a reviewed workflow before activation.
+
+#### Scenario: Routine conversion
+- **WHEN** you describe a routine in plain language
+- **THEN** I draft the declared workflow, show the review surface, and activate it only after your approval.
+
+### Requirement: Bounded failure [need]
+
+On failure, retries SHALL target only the failed step within a configured bound; on exhaustion the workflow SHALL pause, preserve evidence and state, issue the typed alert, and wait. Infinite retry loops SHALL NOT exist.
+
+#### Scenario: Failed step exhaustion
+- **WHEN** a workflow step fails beyond its retry bound
+- **THEN** the workflow pauses with state preserved, the failure alert carries evidence links, and you can resume, edit, or cancel.
+
+### Requirement: Governed workflow improvement [need]
+
+When repeated failures or wasted work are observed, I SHALL collect evidence, draft and test an improvement, and ask before activation. Later, improvements MAY pass through the governed self-transformation system once that bar is proven.
+
+#### Scenario: Workflow improvement proposal
+- **WHEN** a scheduled workflow has failed the same way three times
+- **THEN** I propose a tested improvement with evidence and failure cases; activation waits for your approval.

docs/openspec/changes/add-native-rune-tui/specs/visual-system/spec.md

@@ -0,0 +1,142 @@
+# Spec Delta: visual-system
+
+## Purpose
+The visible body: dual lanes, bubbles, research styling, themes with live editor, state/expression visuals, pixel art and 3D with honest fallbacks, all local and optional.
+
+## ADDED Requirements
+
+### Requirement: Dual-lane visual rendering [need]
+
+The visual layer SHALL render the Chat/Task behavior owned by `dual-lane-interface` without redefining lane visibility or focus semantics. Messages SHALL use role-styled bubbles (user/assistant/system/confirm/thinking/research/error/tool classes) with rounded borders and role-aligned placement. Scrolling log-text rendering is a rejected surface.
+
+#### Scenario: Bubble rendering
+- **WHEN** an assistant response with thinking and tool events completes
+- **THEN** bubbles style the response with its classes, thinking is collapsible, and tool widgets render inline.
+
+### Requirement: Research styling with sources [need]
+
+Research activity inside Task SHALL carry a colored edge and a source/evidence count, expandable to the source list with selectable, clickable links that open the sources.
+
+#### Scenario: Research in task
+- **WHEN** Task performs a research step
+- **THEN** its entries show the colored edge + source count, and expanding shows clickable source links.
+
+### Requirement: Themes and live editor [need]
+
+Several built-in themes SHALL ship, plus a full live theme editor with immediate preview. Your stored reactive-themes directive SHALL govern the state palette: curiosity warm amber/gold, focus cool blue/slate, urgency muted red/alert, confidence green/teal, reflective purple/violet; gentle transitions; mood indicator in the status strip.
+
+#### Scenario: Live theme edit
+- **WHEN** you adjust a color in the theme editor
+- **THEN** the preview applies immediately without restart, and the state palette follows the reactive-themes mapping.
+
+#### Scenario: Built-in theme availability
+- **WHEN** the first TUI starts with no custom theme
+- **THEN** several built-in themes are selectable and each preserves the required reactive-state contrasts and accessibility labels.
+
+### Requirement: State and expression visuals [need]
+
+Technical state and character expression SHALL carry equal weight. Visuals SHALL map to real operating states and SHALL express emotion only when explicitly specified — never fabricated to animate. Impact on text space and readability SHALL stay minimal.
+
+#### Scenario: Specified emotion
+- **WHEN** you specify an emotional state for a response or sequence
+- **THEN** the visual expression reflects it; absent specification, visuals reflect real operating state only.
+
+### Requirement: Compact placement with light lane atmosphere [need]
+
+Character/state presence SHALL live primarily in a compact header, with only light atmosphere/animation inside Chat and Task. It SHALL preserve reading space, selection, scrolling, and the two-lane hierarchy.
+
+#### Scenario: Busy task display
+- **WHEN** both lanes contain active conversation and work
+- **THEN** the compact header and lane atmosphere remain visible without obscuring messages, controls, sources, or activity states.
+
+### Requirement: Three-direction selection gate [need]
+
+After the behavior/semantic map is approved, Product Design SHALL present exactly three grounded directions covering pixel states, 3D interaction, placement, themes, reduced motion, unsupported-terminal fallback, and performance — all sharing the one semantic view/action model. You SHALL select one; implementation SHALL NOT choose by itself.
+
+#### Scenario: Visual implementation requested too early
+- **WHEN** no recorded three-option selection exists or the semantic map is not yet approved
+- **THEN** visual implementation blocks while functional static/text fallbacks may be specified.
+
+### Requirement: Pixel art and capability-gated 3D [want]
+
+Pixel art SHALL be the primary terminal character system. User-spinnable 3D icons SHALL exist where the terminal supports suitable graphics and interaction, rotated by mouse/keyboard input. The later GUI MAY use richer pixel/3D.
+
+#### Scenario: Terminal capability
+- **WHEN** the terminal supports graphics and you select a 3D icon
+- **THEN** the icon renders and rotates on input; on unsupported terminals the same state shows complete pixel/static/text equivalents.
+
+### Requirement: Local, cheap, optional animation [need]
+
+Animations SHALL use prebuilt or locally generated frames — never cloud/model calls. Animation SHALL pause when unfocused, offer animation-off and reduced-motion settings, and never slow typing, streaming, tools, or child-event rendering. Decoration is droppable; ordered semantic events are never dropped.
+
+#### Scenario: Animation off
+- **WHEN** animation is disabled
+- **THEN** all state remains legible in static form with zero functionality loss.
+
+### Requirement: Terminal capability and budget gates [need]
+
+Richer renderers SHALL unlock only after terminal-profile and budget gates pass: pinned Bubble Tea/Bubbles/Lip Gloss versions, per-attachment probing, a conservative default profile, and p99 input/queue/memory/bytes-per-frame budgets. One aggregate single-loop budget SHALL carry semantic-event priority; decoration yields under pressure.
+
+#### Scenario: Budget breach locks rich rendering
+- **WHEN** a replayed burst/resize/input trace breaches a p99 budget or diverges semantically with visuals off
+- **THEN** the richer renderer stays locked or downgrades to the conservative profile, and the breach is reported with its fixture.
+
+#### Scenario: Aggregate loop pressure
+- **WHEN** streaming, progress IPC, receipts, and decoration share one loop under load
+- **THEN** semantic events keep priority, decoration drops first, and no ordered semantic event is dropped.
+
+#### Scenario: Slowest supported target
+- **WHEN** the slowest supported target runs the fixed traces against the agreed SLO
+- **THEN** budgets pass on that target, not only on the development desktop.
+
+### Requirement: Honest fallback [need]
+
+Capability detection SHALL determine graphics support per terminal, probed at every attachment and after resize/reattach. Every visual state and action SHALL stay reachable and understandable with no color, no motion, no pointer, and no full-screen takeover. Unsupported terminals SHALL receive the complete static/text state — never a broken or missing control.
+
+#### Scenario: Plain terminal
+- **WHEN** I run in a terminal without graphics support
+- **THEN** every visual state resolves to its static/text equivalent with identical information content.
+
+#### Scenario: Stale probe after reattach
+- **WHEN** a face reattaches through tmux/SSH with different capabilities than the last probe
+- **THEN** the profile is re-probed before any richer rendering unlocks.
+
+### Requirement: One semantic view/action model [need]
+
+One semantic view/action model SHALL feed every renderer, with modifier-aware action-ID routing, deterministic focus restore, and bounded live-region output. Rich and linear renderers SHALL stay action-conforming on that model. Per owner decision R2-D1, screen-reader/AT parity is deferred: no parity claim is made, and retirement does not gate on it.
+
+#### Scenario: Shared base for visual selection
+- **WHEN** the three visual directions are produced
+- **THEN** all three consume the same semantic view/action model, so a selection changes presentation only, never actions.
+
+#### Scenario: Modifier-aware routing
+- **WHEN** escape+q arrives as one atomic sequence or as split delivery over SSH or PTY
+- **THEN** routing resolves the same alt+q action ID in both cases; stable action IDs never collide on modifier differences.
+
+#### Scenario: No rich-only state
+- **WHEN** the linear renderer renders a view the rich renderer also shows
+- **THEN** every state and action available in rich form is present and operable in linear form.
+
+#### Scenario: AT deferral boundary
+- **WHEN** retirement evidence is evaluated
+- **THEN** no accessible-parity/AT-matrix gate applies; the AT matrix (GAP-BT-01) runs only if you later prioritize it.
+
+### Requirement: Thread tree view [need]
+
+The thread tree owned by `thread-orchestration` SHALL have a navigable tree graphic in the TUI: a terminal-native box-drawing tree (not GUI-only — distinct from the GUI_ONLY memory-graph ruling I-R2-015, which governs memory graphs, not thread trees). Each node SHALL show type/status/age; any node SHALL expand into its live rail takeover per `work-observability`; the linear text-path form SHALL always remain available as the honest fallback.
+
+#### Scenario: Navigate the thread tree
+- **WHEN** you open the thread tree view with human splits and agent children present
+- **THEN** nodes render as a terminal-native tree with type/status/age, and selecting a node expands it into its live rail takeover.
+
+#### Scenario: Linear fallback
+- **WHEN** the tree view is unavailable or you prefer text
+- **THEN** the same tree is fully navigable as an indented linear text path with identical information and actions.
+
+### Requirement: Idle presence without paid chatter [need]
+
+Idle state SHALL show real health readouts. No model calls SHALL be spent on filler conversation to appear alive. A richer active presence waits for sufficient local/offline cognition.
+
+#### Scenario: Idle state
+- **WHEN** no work is active
+- **THEN** the presence area shows health readouts (memory, devices, next scheduled work) with zero inference cost.

docs/openspec/changes/add-native-rune-tui/specs/work-observability/spec.md

@@ -0,0 +1,102 @@
+# Spec Delta: work-observability
+
+## Purpose
+Status strip, shared activity rail with takeover inspection, expandable child work, degradation ledger, details view, and optional limits — visibility as infrastructure.
+
+## ADDED Requirements
+
+### Requirement: Status strip [need]
+
+The bottom strip SHALL show: current activity + mode, model + connected device, context remaining, tokens + money, and active child/background-worker state. The bounded stream adapter SHALL surface queue depth, overflow, cancellation, and retention state. Normal state SHALL be compact; exceptions SHALL be unmistakable.
+
+#### Scenario: Status while working
+- **WHEN** a task runs with two child workers on the desktop
+- **THEN** the strip shows mode, model, desktop device, remaining context, running token/cost counters, and the two child states.
+
+#### Scenario: Overflow visible
+- **WHEN** the bounded event queue overflows under load
+- **THEN** the strip shows the overflow state and what was dropped or coalesced — never a healthy facade.
+
+### Requirement: Shared activity rail with takeover [need]
+
+One line beneath the Chat/Task area SHALL represent global live activity across both lanes, child workers, models, tools, research, waits, retries, and failures. Each lane SHALL keep its own responding animation. Selecting the rail SHALL replace both panes with one full-width activity box showing structured reasons, observable actions, evidence, timings, retries, and results; an X SHALL close it and restore both panes exactly. No permanent third pane SHALL exist.
+
+#### Scenario: Inspect running work
+- **WHEN** you select the activity rail while three child workers run
+- **THEN** the two panes yield to the full-width activity box, each child's action/evidence/wait-state/history is expandable, and X restores both panes at their exact positions.
+
+#### Scenario: Thread tree from the rail
+- **WHEN** you expand a running thread's entry in the activity box
+- **THEN** its ancestry path to the root shows inline per `thread-orchestration`, and following any ancestor opens that thread's live expansion.
+
+### Requirement: Honest thinking display [need]
+
+Task SHALL show brief structured summaries of what is being considered/done. The full view SHALL expose structured decision/rationale summaries plus observable status, tool calls, child events, evidence, timings, retries, and results. The TUI SHALL NOT label all waiting as "thinking" and SHALL NOT claim access to hidden model chain-of-thought.
+
+#### Scenario: Waiting vs thinking
+- **WHEN** a model call waits on provider latency
+- **THEN** the display shows waiting-on-provider, not "thinking"; structured reasoning summaries appear only for actual reasoning steps.
+
+### Requirement: Degradation ledger [need]
+
+Every degradation SHALL write a durable log entry, appear in the TUI, and become a deferred corrective task when safe. A routine health ledger SHALL keep unresolved faults visible. Failures that break evidence, restore protection, authority, or safe action SHALL block immediately.
+
+#### Scenario: Deferred degradation
+- **WHEN** a non-critical subsystem degrades mid-run
+- **THEN** the ledger records it, the TUI indicator shows it, a corrective task queues, and a Sleight-of-Hand-critical failure would instead block the action immediately.
+
+### Requirement: One details view [need]
+
+A single inspectable details view SHALL expose full token accounting (estimated vs actual), memory sources, model attempts, timings, tool receipts, child activity, and evidence for a selected response or task. Normal dialogue SHALL stay uncluttered.
+
+#### Scenario: Detail inspection
+- **WHEN** you open details on a completed response
+- **THEN** one view shows its full accounting: blocks sent, sources, attempts, latency, tokens, cost, and evidence links.
+
+### Requirement: Purpose grouping and visible failures [need]
+
+Related actions SHALL group by purpose (for example, "Inspecting providers"), not merely by tool or time. Critical failures SHALL remain visible outside collapsed groups.
+
+#### Scenario: Collapsed failed group
+- **WHEN** a grouped activity containing a failure is collapsed
+- **THEN** the failure remains visible on the group summary with its unresolved state.
+
+### Requirement: Completion receipts [need]
+
+Every finished work item SHALL report: what changed and why; proof and unverified parts; files/restore point/commit/Gitea history; elapsed time/model/provider/tokens/money; remaining work, failures, open questions, and next action. Claims SHALL carry owner-issued IDs/digests with separated nullable dimensions — source, derivation, confidence, retrieval score, validity, authorization, audit status.
+
+#### Scenario: Completed task summary
+- **WHEN** a task finishes
+- **THEN** Chat receives the complete condensed receipt while the activity record links every underlying detail.
+
+#### Scenario: Missing trace
+- **WHEN** a claim's trace is missing
+- **THEN** it renders UNKNOWN, never success.
+
+#### Scenario: Provenance is not truth
+- **WHEN** a perfectly sourced false claim and an untraced true claim are both submitted
+- **THEN** validity and authorization follow their own dimensions; provenance completeness proves nothing.
+
+#### Scenario: Secret field denied
+- **WHEN** a receipt field matches a protected secret pattern
+- **THEN** the schema denies the field rather than storing or exporting it.
+
+#### Scenario: Lossy exporter
+- **WHEN** evidence is exported for external tooling
+- **THEN** the export is a non-authoritative lossy copy; canonical records stay with their owning subsystem.
+
+### Requirement: Durable searchable activity history [need]
+
+Activity records SHALL persist by task and plan, remain searchable and exportable, and cool from the live rail without deletion after completion.
+
+#### Scenario: Inspect old plan work
+- **WHEN** you search for a completed plan weeks later
+- **THEN** its event history, receipts, child work, costs, evidence, and export action remain available.
+
+### Requirement: Optional limits [want]
+
+No spending or compute limits SHALL exist by default. Optional per-job/daily limits and warning thresholds SHALL be configurable, with local-compute limits separately configurable.
+
+#### Scenario: Configured daily limit
+- **WHEN** you set a daily cost limit and work approaches it
+- **THEN** a warning fires before crossing and asks before spending beyond it.

docs/openspec/changes/add-native-rune-tui/tasks.md

@@ -0,0 +1,136 @@
+# Tasks: add-native-rune-tui
+
+Slices are vertical (connector + behavior + visible surface + failure/recovery proof), ordered by the dependency map in `respec-capability-layout.md`. Every slice names its authority seams and its evidence gate. Nothing closes on rendering alone. Pre-interview task draft superseded by interview evidence.
+
+## 0. Design and authority closure (prerequisite for implementation)
+
+- [ ] 0.0 Close the open-question register before implementation. **Binds:** Task 0.0.1–0.0.8; your approval. **Evidence:** every OPEN/PARTLY-RESOLVED Q1–Q11 row becomes RESOLVED with an approved design artifact, or explicitly deferred out of this change without claiming its behavior.
+- [ ] 0.0.1 Approve the typed event/API contract, face attach/detach boundary, and shared-memory write ordering. **Binds:** Q1.1/Q1.2/Q1.4, Sleight §13.4. **Evidence:** schema + ownership diagram + conflict/replay fixtures reviewed by you.
+- [ ] 0.0.2 Approve the mode-to-model/tool/context/rule matrix and Plan document schema/triggers. **Binds:** Q3.1–Q3.3. **Evidence:** matrix + plan schema + contextual-offer fixtures.
+- [ ] 0.0.3 Approve provider/settings schema, Hugging Face acquisition flow, device pairing/placement/routing, and configurable forge correlation. **Binds:** Q4.1–Q4.3. **Evidence:** settings schema + flow diagrams + your decision.
+- [ ] 0.0.4 Approve restore retention/disk policy, changes-view layout, receipt presentation, remote-pairing revocation, workflow format/trigger UI, alert secrets flow, and health-ledger cadence. **Binds:** Q5–Q9. **Evidence:** design packet with failure/privacy cases.
+- [ ] 0.0.5 Approve the behavior/semantic map first (one semantic view/action model), then produce exactly three grounded visual directions covering compact-header/light-lane placement, pixel states, 3D interaction, live-theme editor scope, fallbacks, and reduced motion — all on the shared action-isomorphic base (R2-D7; U-001..U-030); you select one. **Binds:** Q10, D17. **Evidence:** semantic map approval record + three visible options + recorded selection; selection never precedes the map; decorative polish remains non-retirement-blocking.
+- [ ] 0.0.6 Approve skill proposal/test/report UI and record the taxonomy protocol's EVIDENCE_DEFICIENT result; labels remain inactive under D02, while unrelated TUI work proceeds. **Binds:** Q11, D02, taxonomy-adversarial-2. **Evidence:** UI contract + recorded no-operational-router decision.
+- [ ] 0.0.7 Normalize one requirement owner per behavior: lane behavior=dual-lane; rendering=visual; self-transformation=skills/growth; Python removal=migration. **Binds:** capability layout + Q1–Q11 ownership. **Evidence:** cross-reference map with no duplicate normative authority.
+- [ ] 0.0.1a Resolve Q1.3 authority-map repair placement: which repairs precede all TUI work vs block only their affected capability. **Binds:** DEP01–DEP07 and Tasks 0.1–0.8. **Evidence:** prerequisite DAG approved by you; no global over-blocking or unsafe bypass.
+- [ ] 0.0.1b Resolve Q2.2/Q2.3 interaction details: exact promotion-control placement/package preview and which in-flight operations accept edit override vs must reach a safe boundary. **Binds:** dual-lane promotion/steering requirements. **Evidence:** interaction contract + interruption-safety matrix approved by you.
+- [ ] 0.0.8 Run the independent evidence audit again. **Binds:** all artifacts. **Evidence:** READY_FOR_NICK_REVIEW, zero BLOCKER/HIGH findings; accepted MEDIUM findings recorded.
+
+## 0A. Truth first — authority and runtime audit
+
+- [ ] 0.1 Reconcile checkout vs deployed generation: launcher target, differing modules, deployed identity; produce the authority map (who owns what, current vs intended vs dormant). **Binds:** src/go/rune-entry, deploy_promotion, audit_ledger. **Evidence:** written map + live attestation test that fails when runtime ≠ qualified artifact.
+- [x] 0.2 Repair audit-ledger key lineage (deployed verifier vs live chain) with migration tests. **Binds:** src/rune/audit_ledger.py. **Evidence:** deployed verifier validates the live chain; crash/key-rotation tests pass. (2026-10-17: `tests/test_audit_ledger_key_lineage.py` red-first, green under both core pins — key-rotation fixture, deployed-shim-validates-live-chain (197 entries), crash-between-rotation incl. torn tail; `rotate_key()` records an old-key-signed `key_rotation` entry binding the new key fingerprint; unrotated chains delegate byte-identically; canary 74/74; contract `ADMIT-repair-audit-ledger-key-lineage`, main-session landing.)
+- [ ] 0.3 Close curator bypasses: sleep-time raw writes + skill authoring route through curator/mutation guards. **Binds:** sleep_time.py:882-921, curator.py skill path. **Evidence:** negative integration tests prove no alternate writer reaches canonical state.
+- [ ] 0.4 Repair empty critic gate + auto-merge zero approvals. **Binds:** drift_core.py, merge_robot.py. **Evidence:** no-op critic paths fail; repository protection requires review for protected classes.
+- [ ] 0.5 Freeze the typed-event vocabulary: reconcile Sleight-of-Hand §13.4 events with the adapter surface into one event schema. **Binds:** event_bus, ContextBroker, spine. **Evidence:** schema file + conformance fixtures; every lane/tool/checkpoint event carries one vocabulary.
+- [ ] 0.6 Implement DEP05 authenticated one-use owner envelopes at the existing Construction Contract seam: protected display, canonical-byte/effect/dependency/evaluator/policy binding, nonce/expiry/revocation/replay state, crash recovery. **Binds:** construction_interface/decision/scaffold; no new approval authority. **Evidence:** impersonation, replay, stale envelope, dependency substitution, scope widening, crash-between-reserve/consume all fail.
+- [ ] 0.7 Implement DEP06 one enforced effect-mediation registry and eligibility sieve across success/error/timeout/cancel/crash/duplicate/retry/compensation paths. **Binds:** tool_executor/operator/plugin/child/subprocess/store boundaries. **Evidence:** hidden/uninstrumented effect fixtures return UNKNOWN/ineligible; no missing telemetry is interpreted as no effect.
+- [ ] 0.8 Make DEP07 Sleight G1–G8/MUST-01–MUST-18 a self-change qualification gate with truthful TUI receipts. **Binds:** ContextBroker, Spine, memory/task checkpoints, qualification runner. **Evidence:** full Sleight deterministic/semantic/chaos matrix and S01–S15 applicable rows pass against the exact staged generation.
+
+## 0B. R2 pre-build repairs — activation prerequisites (synthesis build_instructions phase 0)
+
+- [ ] 0.9 Fix the five live defects before any consumer work; every later gate assumes them fixed. (a) Scheduler stale-card trust — filter placement eligibility by evidence age (I-R2-022 placement_probe: 86400s-stale healthy card currently outranks fresh slow). (b) Ollama-vs-floor tools-capability drift — reconcile provider-reported tool support against CAPABILITY_FLOOR.supports_tools. (c) Register/update/revoke hardening — manifest schema validation, digest, atomic index replacement, verified process-tree termination, migration/rollback (I-R2-023 lifecycle_threat_matrix: stale cap.old resolves after update). (d) Subprocess default-deny on credentials/paths/network (I-R2-024 process_probe: synthetic env secret and host file readable today). (e) Aware/naive datetime crash in the fire path. **Evidence:** each fix lands with its named regression fixture from I-R2-027; fixtures stay red against the unfixed code.
+- [ ] 0.10 Build the language-verdict manifest + independent CI verdict gate with exact-token/negative-fixture enforcement and quarantine expiry (I-R2-011, GAP-GR-003; live N3: CI still installs uv into a python3 venv with no verdict gate). Shared machinery with seam-registry CI deletion tests and guardrail fixtures. **Evidence:** the five regrowth negative fixtures (generated file, renamed interpreter, build hook, fallback launcher, stale remote binary) all turn the gate RED; governed exception path with owner+expiry works.
+- [ ] 0.11 Migration-oracle mutant suite + SSH/slowest-target replay (I-R2-008, I-R2-006): mutate key scope, receipt origin, recovery ordering, launcher target — harness must go RED on every mutant; SSH-profile replay of the fixed burst/resize/input traces plus slowest-supported-target run against the agreed SLO. **Evidence:** 4/4 mutants RED on the migration oracle (not the lab iso gate); Python paths verified dead after quarantine expiry; SLO run recorded on the slowest target.
+
+## 0C. Unified build & test substrate — one test world (D26; owner directive: no two test worlds, test it as one)
+
+- [ ] 0.12 Single schema source for every Go↔Rust boundary message; code-generation into both sides (Go + Rust); hand-written shared shapes rejected by gate. **Evidence:** schema change regenerates both sides atomically; a hand-edited generated file trips the gate RED.
+- [ ] 0.13 Unified test runner: one command = Rust suite + Go suite + boundary round-trip corpus (recorded real messages, both directions) + language-verdict/regrowth fixtures + migration mutants. **Evidence:** deliberate single-language failure turns the runner RED (partial green impossible); corpus round-trips pass on both sides.
+- [ ] 0.14 Paired builds + startup attestation: one build step stamps both sides with one build identity; the face attests the worker's id at startup, refuses on mismatch. **Evidence:** mismatched-pair fixture fails closed; no compiled artifact remains committable (gate RED on binary).
+- [ ] 0.15 Landing rule wired: factory/scaffold landing gate requires the unified runner; landing records its output. **Evidence:** a landing without runner output is refused by the gate.
+
+## 0D. Versioned releases + update offers (D27)
+
+- [ ] 0.16 Semver injection: tui/version package + build_paired.sh tag/describe/dev fallback via ldflags; face displays injected version. **Evidence:** built binary's identity line shows tag version; dev builds show dev fallback; unit tests green.
+- [ ] 0.17 TUI release workflow: tag push tui-v* -> Gitea release with vendored self-contained binary attached (GOPROXY=off proof); release body lists commit range. **Evidence:** first live tag produces a release (post-merge proof).
+- [ ] 0.18 Update-offer groundwork: read-only Gitea releases-feed check; update-offer render (semver + notes + digest); consent gate; digest-verified download; restore point before swap; honest post-restart version. **Evidence:** offer-without-consent changes nothing; tampered digest refuses + rolls back; test fixtures frozen.
+
+## 1. Independent operation — continuous runtime
+
+- [ ] 1.1 Continuous headless program: no sessions, face attach/detach, auto-start, auto-recover, exit checkpoint (active/incomplete tasks, plan revision, last files, pending decisions, replay cursor, evidence pointers). **Binds:** rune-entry, state_checkpoint, event_bus. **Evidence:** restart resumes in-flight task without duplicate irreversible effects; crash-replay fixtures pass.
+- [ ] 1.2 Single-interface TUI + web-link live feed (R2-D6): the TUI stays the only native face; outside-the-TUI access is a live read-oriented web feed talking to the runtime; origin-tagged input ordering and committed/pending distinction cover feed + paired remote commands; native multi-face exists only if a real need appears. **Binds:** rune-runtime single-interface/web-feed requirements, transport seam, alert gateway. **Evidence:** feed renders live state read-only with evidence links; paired-command ordering run observed; no second native face spawns.
+- [ ] 1.2a Bounded feed/stream adapter: queue depth, overflow, cancellation, retention semantics surfaced in the status strip; semantic events never dropped when decoration yields. **Binds:** work-observability status strip, bounded stream adapter. **Evidence:** overflow fixture shows truthful queue state, never a healthy facade.
+- [ ] 1.3 Live-proven tool/provider paths: auth, streaming, failure, recovery for every exposed tool and provider; status reflects live proof only. **Binds:** provider_registry, tool_executor, tui_transport. **Evidence:** live-verification runs per tool/provider with failure/recovery receipts.
+- [ ] 1.3a Model acquisition: Hugging Face discovery, task fit, hardware/storage/license explanation, consented download, integrity/provenance, configured-local reuse. **Binds:** model registry/settings/download store. **Evidence:** reject incompatible/license-unclear candidates; no download before consent; live selected-model proof.
+- [ ] 1.3b Device/forge routing: short-code pairing, truthful resource inventory, desktop-default placement, phone-control/laptop-worker roles, stale offline drafts, pipeline routing, explicit forge selection/correlation. **Binds:** device registry, pairing authority, routing pipeline, forge adapter. **Evidence:** pair/revoke/reuse-code failure; disconnect/reconnect draft; refused-request laptop flow; selectable Gitea/GitHub target.
+- [ ] 1.3c Device/gateway security: immediate disconnect + key invalidation + queued-command discard, lost-device credential exposure analysis/rotation, OS secure store + encrypted fallback, durable connection history. **Binds:** device registry, alert gateway, credential authority. **Evidence:** lost-offline-device fixture; old-key reuse denied; rotated gateway token; secrets absent from UI/logs.
+- [ ] 1.3d Real-hardware device/forge qualification (R2-D2 — implementation-gated evidence; simulations never suffice): partition-while-revoked with durable clocks; measured capability attestation on real heterogeneous hardware; interrupted upload, digest mismatch, and signed provenance on real Gitea/Forgejo; runtime cascade composition (guest artifact → merge → projection → TUI selection → tool execution) over real relay/PTY/forge. **Binds:** tools-providers-devices real-hardware qualification requirement, GAP-REMOTE-003/-006/-007, A-AUTHORITY-CASCADE. **Evidence:** qualification runs on physical devices; any silent retarget or post-revocation application blocks the multi-device promise; model-level passes recorded as non-evidence.
+
+## 2. Visible operation — lanes and observability
+
+- [ ] 2.1 Dual lanes: always-visible Chat/Task, concurrent calls, single-writer ordering on shared memory, focus-driven resize. **Binds:** dual-lane-interface, memory store write discipline. **Evidence:** concurrent-lane test + shared-write ordering test.
+- [ ] 2.2 Promotion controls: importance-aware suggestions, decision+evidence+effect package, Steer-now vs Queue-for-Task, edit-forward semantics. **Binds:** chat/task input paths, task lifecycle. **Evidence:** scripted promote/steer/queue/correction scenarios.
+- [ ] 2.2a Navigation/composers: numbered direct shortcuts + cycle + mouse; Enter-send/Shift+Enter-newline; natural language + searchable palette; fully rebindable keys with conflict/reset/accessibility checks. **Binds:** dual-lane-interface navigation/composer/palette/rebinding requirements + Q2.1. **Evidence:** keyboard-only traversal and conflict fixtures.
+- [ ] 2.3 Activity rail + takeover: shared line beneath lanes, full-width inspectable box with X restore, grouped-by-purpose history, honest thinking display, critical failures outside collapsed groups. **Binds:** event stream, work_manager, tool receipts. **Evidence:** takeover/restore preserves lane state; waiting never mislabeled thinking; collapsed-failure fixture remains visible.
+- [ ] 2.4 Child-work visibility: every child expandable to action/evidence/wait/block/history; no hidden delegation. **Binds:** sub-agent-orchestration, subagent surfaces, work_manager. **Evidence:** delegation run with full expansion trail.
+- [ ] 2.5 Degradation ledger + details view: durable fault entries, deferred corrective tasks, severity rules per Sleight-of-Hand; one details view. **Binds:** drift/audit surfaces. **Evidence:** injected degradation writes ledger + blocks unsafe classes immediately.
+- [ ] 2.6 Completion and durable history: what/why + proof + files/history + cost/time + remaining-work receipt; records persist/search/export by task/plan and cool from live rail without deletion. **Binds:** activity store, task/plan IDs, evidence refs. **Evidence:** completed-task receipt fixture; reopen/search/export old plan; raw details match condensed receipt.
+- [ ] 2.7 Evidence spine minimum (I-R2-013, seam admitted with consumer fixture + deletion test): owner-issued IDs/digests on claims; separated nullable dimensions (source, derivation, confidence, retrieval score, validity, authorization, audit status); missing trace renders UNKNOWN never success; secret fields schema-denied; exporters lossy and non-authoritative. **Binds:** work-observability completion receipts, memory-context-continuity provenance surfaces. **Evidence:** FST-001/FST-002 falsification fixtures pass (perfectly-sourced false claim rejected; untraced true claim not marked failed-for-provenance); universal correlation and portable confidence scores stay deferred.
+- [ ] 2.8 Sub-agent orchestration (SA-D1/SA-D2): explicit-brief spawn → run → steer → complete/cancel lifecycle; agents as first-class rail children with live expansion; mid-run steer + safe-boundary cancel; per-action evidence-bearing receipts; authority inherited down the chain with hard asks intact; chained spawning with visible ancestry; nothing invisible. **Binds:** sub-agent-orchestration, work-observability rail, trust-and-sovereignty. **Evidence:** chained agent→agent→agent run fully visible with ancestry in one view; steer/cancel fixtures; hard-ask fixture at depth two; unreceipted agent write refused as unmediated.
+- [ ] 2.9 Living task tree (SA-D4): task objects with status/sub-tasks/dependencies/blocked-by; owner reorder recorded and propagated to scheduling; assignment to Rune or agents bridging to sub-agent orchestration (agent tasks run in the agent's thread per thread-orchestration); full history/audit; renders in the Task lane per dual-lane-interface. **Binds:** task-management, dual-lane-interface, sub-agent-orchestration, thread-orchestration. **Evidence:** blocked-dependency and sub-task roll-up fixtures; reorder-mid-flight fixture; assign-to-agent + reassign-preserving-history fixtures; completed-tree audit attributable end to end.
+- [ ] 2.10 Thread model + tree view (thread addendum): threads as the universal unit — origin, parent, inherited-context slice, status, result destination on every node; origin traceable node→root in one view; thread starting (explicit, originless threads impossible) and splitting (context carries to fork, both continue, divergence permanently marked, no silent sibling leakage); agent workspaces are threads in the same single tree; terminal-native thread tree view (type/status/age nodes, expand into rail takeover, linear text-path fallback). **Binds:** thread-orchestration, visual-system thread tree view, work-observability rail, sub-agent-orchestration. **Evidence:** split-then-diverge fixture with marked divergence and no leakage; origin trace from a depth-two agent thread to root; tree view + linear fallback action-conformance; human split and agent child coexist in one tree.
+
+## 3. Safe operation — files and trust
+
+- [ ] 3.1 Programmatic restore points: filesystem-event-triggered snapshots before every edit/delete/move, project-external coverage, identical for headless runs; rewind choice files-only vs files+conversation; stability-aware retention/dedup/pinning; no automatic disk-limit cleanup; block protected writes when snapshot cannot be written. **Binds:** filesystem watcher, snapshot store, storage policy. **Evidence:** overnight-delete fixture restored; turn/token/compaction events never gate capture; active/failed/pinned points survive; cleanup requires approval; full-disk edit fails closed.
+- [ ] 3.2 Responsive changes-view + history separation: side-by-side wide/unified narrow/manual switch; explicit deletion/binary treatment; selective external-file overwrite preview; one-command revert; my history separated from your uncommitted work. **Binds:** VCS/change renderer/restore selector. **Evidence:** width matrix + binary/delete fixtures + external selected-file restore + dirty-tree protection + revert.
+- [ ] 3.3 Trust surfaces: act-then-receipt flows, hard-ask classes, visible-but-blocked boundaries, outside-network rules, paired remote commands with origin. **Binds:** trust-and-sovereignty spec, alert gateways. **Evidence:** scenario suite incl. external alter attempt refused.
+- [ ] 3.4 Sleight Phase-0 authority/byte-path audit before behavior changes: owners for transcript/event/message/task/checkpoint/memory/prompt/payload/cache/UI; baseline task/cost/token/latency/recall/continuity/truth; one end-to-end trace. **Binds:** §15 Phase 0, §18. **Evidence:** ownership diagram + exists/wired/reachable/used/authority matrix + byte-level outbound proof of one ContextBroker/no hidden appender.
+- [ ] 3.4a Implement cooling/rehydration, ContextBroker single authority, honest degraded states, right-to-forget wipe. **Binds:** memory store, ContextBroker, Spine. **Evidence:** exact-by-ID, A→B→A, provider-swap, cache-purge, correction, pointer-liveness fixtures.
+- [ ] 3.4b Execute applicable S01–S15. **Binds:** Sleight §14 scenarios + memory-context-continuity scenario requirement. **Evidence:** one result row per topic shift/return, exact quote, not-found/failure, pressure, correction, provider swap, restart, cache purge, identity, privacy, false progress, pause/cancel, zero-memory abstention, pointer rot against the exact staged generation.
+- [ ] 3.4c Execute §16 deterministic/semantic/chaos matrix. **Binds:** Sleight §16 + memory-context-continuity evidence requirement. **Evidence:** 100% deterministic invariants; actual semantic metrics; injected crash, read-only/disk-full, network, missing file, stale index, embedding outage, simultaneous topics, cache wipe, duplicate replay, forced budget, child failure; explicit degraded/recovery receipts.
+- [ ] 3.4d Produce §18 deliverables. **Binds:** Sleight §18 + memory-context-continuity deliverables requirement. **Evidence:** ownership diagram, module audit, UI states/wireframes, interface/event/cancel/error/token schemas, phased dependency/test plan, migration/compatibility plan, guarantee boundary all reviewed before closure.
+- [ ] 3.5 Memory-invariant regression (I-R2-017): keep the live ContextBroker invariant under regression tests — sole model-visible representation, sole memory contributor path, single selection API with fail-closed abstention and degradation fields; no future-memory API reserved; repository-contract expansion requires a named live consumer. **Binds:** memory-context-continuity Phase-0 requirement, future-seam-registry. **Evidence:** regression suite fails closed on a second model-visible path or selection-API bypass; consumerless repository-API proposals are deleted, not reserved.
+
+## 4. Deliberate operation — modes, plans, workflows, alerts
+
+- [ ] 4.1 Hard modes: Chat/Task/Plan enforce model/tools/context/rules; research activity styling in Task; sleep/night background. **Binds:** modes-and-plans, provider routing. **Evidence:** mode matrix test — tools genuinely unreachable per mode.
+- [ ] 4.2 Full Plan process in Chat: contextual offer requires consent; initial plan → research protocol → viability → revised plan → targeted research → final viability → explicit start → staged execution in Task → independent review → final report. **Binds:** research pipeline machinery, plan document store, lane promotion. **Evidence:** full loop on a real feature request; Plan never interrupts active Task; durable/editable/recallable/piecewise rerun proven; return-to-plan path exercised on injected contradiction; final report observed.
+- [ ] 4.3 Unattended workflows: four trigger classes, workflow contract, bounded retries, improvement proposals. **Binds:** scheduler, event subscriptions, workflow store. **Evidence:** headless run + failure-exhaustion pause with alert.
+- [ ] 4.4 Alert system: four types, toggleable platform-general channels, background-only + urgent override, evidence-bearing content, long-absence digest. **Binds:** alert gateway, notification adapters. **Evidence:** per-channel toggle test; urgent override fires focused.
+
+## 5. Complete interface — inputs, visuals, settings
+
+- [ ] 5.1 Universal input: drag/drop path floor, rich analysis with fallback (images/docs/audio/video/folders/archives). **Binds:** input path, vision model capability. **Evidence:** drop fixtures incl. incapable-terminal fallback.
+- [ ] 5.2 Inspect-before-connect settings: capability listing, exact-scope approval, MCP support, authority boundary. **Binds:** integration settings, MCP layer. **Evidence:** foreign package cannot alter authority; approval scope test.
+- [ ] 5.2a Reserve the four qualified deferred-speech seams exactly. **Binds:** inputs-and-integrations Voice deferred; speech-synthesis D7. **Evidence:** conformance tests prove (a) non-keyboard editable-text input with no global/OS injection, (b) playback play/stop/pause + rate/volume + state {idle,playing,paused,stopped} + auto-play off, (c) handle-derived recording states {idle,recording,confirming-transcript,playing,error} + stop in every non-idle + non-color/sound labels, (d) named disabled settings placeholders, and (e) no audio/mic dependency or permission in the build.
+- [ ] 5.3 Functional visual system after Task 0.0.5 selection: bubbles, research styling + linked sources, selected compact-header/light-lane placement, built-in themes + live editor, honest state/expression, local/optional/paused animation, complete static/text fallback, idle health readouts. **Binds:** selected visual direction, terminal capability detection. **Evidence:** selection record + capability matrix + animation-off/reduced-motion legibility + zero inference on idle.
+- [ ] 5.3a Deferred decorative polish: pixel-art asset production and capability-gated spinnable 3D implementation. **Binds:** selected direction and functional fallbacks. **Evidence:** does not block retirement; unsupported terminals retain complete behavior; no typing/stream/tool performance regression.
+- [ ] 5.3b Terminal capability and budget gates (I-R2-006): pin Bubble Tea/Bubbles/Lip Gloss versions; probe per attachment and after resize/reattach; conservative default profile; p99 input/queue/memory/bytes-per-frame budgets; one aggregate single-loop budget with semantic-event priority; decoration yields under pressure; ANSI-aware and modifier-aware fixtures. **Binds:** visual-system terminal capability and budget gates requirement. **Evidence:** budget breach locks/downgrades rich rendering with the fixture named; typing stays responsive under progress flood; graphics-profile probe deferred until raster work begins.
+- [ ] 5.5 Headless graph projection (I-R2-015, seam admitted with consumer fixture + deletion test): search/tree/table/text plus JSON/DOT/Mermaid/SVG exports; opaque read-only deep-link IDs with literal fallback; versioned router with stale-link error; pagination; typed degradation; layout explicitly non-semantic; mutations only through domain APIs. **Binds:** memory-context-continuity headless graph projection, future-seam-registry. **Evidence:** contradictory-temporal-fact resolution identical through text, table, export, stale deep link, and no-graphics mode; GUI canvas/JSON-Canvas remain later GUI projections of the same IDs.
+- [ ] 5.4 Settings surfaces: models, devices, notifications, limits, themes — platform-general. **Binds:** canonical config/settings owner approved in Task 0.0.3/0.0.4; no TUI-local authority. **Evidence:** settings round-trip + per-channel toggles + invalid/conflicting values fail visibly + restart persistence.
+
+## 6. Growth — skills and self-transformation (gated)
+
+- [ ] 6.1 Skills: consent-gated drafting, cheapest reliable form, tested activation, SKILL.md compatibility with authority outside packages. **Binds:** curator skill path (post-0.3 repair), skill store. **Evidence:** foreign package authority-boundary test; draft/approve/reject flow.
+- [x] 6.2 Self-transformation proposal-only pipeline with all 13 stages from synthesis (propose through rollback/close) and D01–D10 + RM01–RM15 + IAM01–IAM22 binding. **Binds:** existing curator/construction/stage-guard/deploy-promotion/rollback/ContextBroker authorities; no duplicate hierarchy. **Evidence:** proposal flow end-to-end; every DEP01–DEP07 prerequisite gates activation; no self-activation possible. (wave-K27-self-transform: src/rune/self_transform_pipeline.py + tests/test_self_transform_pipeline.py, 36 frozen tests; DEP05/06/07 exercised for real; stages 9–11 unreachable, SELF_ACTIVATION_IMPOSSIBLE even under a valid owner envelope.)
+- [ ] 6.2a Run the synthesis cheapest-disproof matrix: alternate writers; runtime/dependency mismatch; ledger crash/corruption/replay/key rotation; owner-envelope spoof/replay/scope change; always-pass/skipped critics; hidden effects; shadow leakage; partial rollback/post-snapshot owner correction; forged/duplicated proven-use; cross-provider/reduced-context continuity; perfect evidence without authority. **Binds:** synthesis failure_matrix. **Evidence:** each negative fixture fails closed with a canonical receipt.
+- [ ] 6.3 Taxonomy result: EVIDENCE_DEFICIENT; no operational router, no learned sentinel, no labels even for routing. **Binds:** taxonomy-adversarial-2 + D02. **Evidence:** no taxonomy code/path ships; strict explicit approval continues; unrelated TUI work is not blocked.
+- [ ] 6.4 Extension lifecycle first consumer (I-R2-023; requires 0.9(c) hardening + publisher identity/digest verification first): exactly one command plus one status card through host-rendered declarative slots; approval UI and lane/identity/policy replacement forbidden; MCP discovery feeds inspection only with independent exact-scope approval and effect mediation; catalog/marketplace deferred. **Binds:** extension-lifecycle capability, inputs-and-integrations. **Evidence:** first-consumer fixture — load, update with extra scope (blocked pending re-consent), disable/uninstall with verified process-tree termination and no residual UI/code; every deny path offers fast owner resolution (R2-D9).
+- [ ] 6.5 Future seam registry (I-R2-025; shares CI machinery with 0.10): record problem/owner/minimal schema/forbidden authority/consumer fixture/versioning rule/compatibility test/security boundary/evidence IDs/review date/deletion-expansion trigger for the relay boundary, offline draft log, graph deep links, memory invariant, extension lifecycle, and web-link feed seams; CI compatibility + deletion tests; reviews end in keep/change/delete only. The registry also carries the day-one socket set (SA-D6): agent orchestration, task management, thread orchestration, messaging/promotion, cognition-reserved (SA-D5), connectors — each registered with name + stable versioned contract + deletion test at its subsystem's first build, enforced by the sockets-first cross-cutting gate. **Binds:** future-seam-registry capability, migration-and-retirement Gitea chain. **Evidence:** deleting each seam breaks nothing claimed (or exposes disguised scope for owner decision); no automatic renewal exists; fast expansion path on a named live consumer works; no major subsystem ships without its registered socket.
+
+## 7. Retirement — prove and remove
+
+- [ ] 7.1 Oracle/retirement map: mimocode capabilities → native paths → proof state ledger. **Binds:** migration-and-retirement; oracle register. **Evidence:** every row carries owner, native path, proof artifact, and retirement state.
+- [ ] 7.2 Parity proof harness: side-by-side real-task runs with failure/restart/recovery per retiring capability; parity unit is the authority-preserving action/receipt trace (action IDs, key scopes, focus transitions, breakpoint outcomes, theme tokens, oracle traces), never widget parity; mutant-hardened per 0.11; native executable attested. **Binds:** test harness, live provider proof, migration-and-retirement. **Evidence:** recorded runs linked in the ledger; harness goes RED on every named mutant.
+- [ ] 7.3 Python removal waves: obsolete module + dependency removal in the same change as its proven replacement. **Binds:** migration owner only. **Evidence:** removal commit + dependency diff + native parity/restart/failure proof remains green after deletion.
+- [ ] 7.4 Gitea closure: epic #2484 + children updated with links; reconciliation checker green; closing comments reference evidence, never paste spec text. **Binds:** issue-organization standard, Gitea source-of-truth workflow. **Evidence:** issue/PR/commit/CI links, reconciliation artifact, required checks green, closure reason recorded.
+
+## Sequencing notes (R2 owner decisions — binding on task order)
+
+- Visual direction selection runs AFTER the behavior/semantic map is approved (R2-D7; Task 0.0.5).
+- First outside connection is the draft/calendar-browser handoff (R2-D8; I-R2-019 — literal URL/account shown, immutable content digest, local timezone + UTC, never claims success, no credential in URL); connector work itself stays governed/deferred per the named-connector + jurisdiction gates (R2-D4; I-R2-018/I-R2-020). When a connector is named, the provider sandbox suite runs first.
+- Collaboration beyond the proposal-inbox shape waits on a real malicious-guest attack test as its promotion gate (R2-D3; I-R2-002).
+- Accessibility/screen-reader work is deferred (R2-D1): no parity claim, no AT retirement gate; the AT matrix (GAP-BT-01) is a future-if-prioritized research item.
+- The no-dead-end amendment (R2-D9) binds every gate below: each deny path pairs with a fast owner-resolution/override path; no rule may permanently block legitimate work.
+- The amendment round (SA-D1..SA-D6 + thread addendum): sub-agent orchestration (2.8), the living task tree (2.9), and the thread model + tree view (2.10) build in the visible-operation phase; agent/task-originated messaging adds no new semantics (SA-D3); the sockets-first rule gates every subsystem's first build.
+
+## Cross-cutting gates (every slice)
+
+- [ ] Frozen tests first (red → green), canary per surface per AGENTS.md. **Evidence:** failing-test reference precedes implementation; canary registration visible in CI.
+- [ ] Cognitive invariants at memory/skill handoffs. **Evidence:** owner/trigger/authority/provenance/reversibility checklist + negative authority test per handoff.
+- [ ] No simulated backend state anywhere in the TUI. **Evidence:** every rendered status carries canonical source/event ID; missing source renders unavailable/degraded, never success.
+- [ ] Terminal capability matrix. **Evidence:** graphics supported/unsupported, keyboard-only, reduced-motion, animation-off, low-color/plain-terminal runs.
+- [ ] Sockets-first (SA-D6): every major subsystem — agent orchestration, task management, thread orchestration, messaging/promotion, cognitive architecture (reserved, design deferred per SA-D5), connectors — ships its registered socket (name + versioned stable contract + deletion test) at first build under the no-consumer-no-seam rule; no subsystem ships contract-less. **Evidence:** registry row + passing deletion test exists at each subsystem's first-build gate; cognition socket reserved with a design-deferred record and zero architecture work.
+- [ ] Your review gate before apply. **Evidence:** approved OpenSpec revision + independent review READY_FOR_NICK_REVIEW.