Five accepted findings from the second adversarial round on the install-preset
phase, each fixed as a class and each pinned by a test that is red without it.
1. THE ENVIRONMENT COULD AUTHOR AN ENDPOINT-ONLY FACT. The two install-time
facts — `OUROBOROS_ONBOARDING_COMPLETED_AT` and
`OUROBOROS_SUBSCRIPTION_PRESET_VERSION` — were merge-skipped from the request
BODY and nowhere else, so the environment still spoke for them. `load_settings`
overlaid an environment timestamp and both probes landed: on a genuinely FRESH
install with subscriptions connected the endpoint answered
`preset.reason=not_install_time`, made ZERO daemon calls and closed the
onboarding window for good without installing anything; and an
environment-only preset marker was persisted to disk by a plain
`POST /api/settings`. Fixed at the class: `config.ENDPOINT_AUTHORED_SETTINGS`
is ONE named set that both the loader and the environment projection consult,
so these facts are never read from `os.environ` and never exported back to it,
and the generic save's skip-list reads the same set instead of repeating the
strings. The request-body protection is unchanged.
2. "SAVED" WAS A FIELD ON ONLY ONE SIDE OF THE BOUNDARY. Post-commit failures
correctly answer `saved:true`, but pre-commit failures answered a bare
`{"error": ...}` — the generic seam's catch, every malformed-input refusal on
both surfaces, and the single-decision owner endpoints' validation. Once one
side names the field, an envelope that omits it cannot be told from an old or
truncated response. `owner_settings.unsaved_error` is now the one pre-commit
refusal shape and always carries `saved:false`; every refusal on every owner
settings-write surface goes through it. The test named
`..._reported_as_unsaved` checked only that the file was absent — the one
thing the client cannot see — and now asserts the response's own claim.
3. ONE OF THE "SIX GUARDED OWNER ENDPOINTS" WAS NOT ONE. `owner_write_guard` only
translates exceptions, and the capability-evidence acknowledgement never calls
`_owner_write_settings`: it writes its own route-fingerprinted ledger. Under a
genuinely held lock the five settings writers refused typed
`503 settings_locked` while it recorded its acknowledgement and answered 200.
The decorator was the wrong claim, so the claim went rather than the lock
widening to cover an unrelated ledger — that would have made the decoration
true at the price of coupling a capability ack to whether some settings save
is in flight. Membership in the seam is now defined as calling
`_owner_write_settings`, the count is FIVE in code and prose, and the lock
refusal is tested parametrically across all five.
4. THE WIRE PROSE OVERSTATED A SUCCESSFUL COMPLETION. `contracts.py` and
`api_client.js` both said the preset marker lands with every successful
completion; D-4 and the implementation deliberately allow ordinary successes
with `not_requested`, `skipped_by_owner` or `not_install_time`, where no marker
lands. Both now say what is true: settings, runtime mode, the fresh-install
safety default and the completion fact land atomically; preset data and its
marker ride the same write only when `preset.applied` is true.
5. A MOMENT-IN-TIME ANSWER DECIDED A PERMANENT CONFIGURATION. Round one made the
daemon the authority on a seat, which was right, but read it through `next_up`
— computed daemon-side from enabled profiles + default readiness + QUOTA
(Claudexor INV-135, which also documents it as informational and never a
routing gate). The preset is a once-only install-time decision (D-4), so an
owner who connected Claude and Codex during an hour when the Claude window
happened to be spent got a Codex-only preset PERMANENTLY, with no seam left to
revisit it — against D-3, where an exhausted subscription row stays CONFIGURED
and waits for capacity. `_configured_subscription_seat` now resolves the seat
from the durable facts (credential KIND, enabled, present, vendor-verified; or
the signed-in default login), `next_up` answers first so its seat is what the
receipt records, and when it refuses a configured seat still counts with the
engine's own reason kept beside it as a capacity note. `next_up` is still
consulted for the ONE thing only it answers: whether the default login's
EFFECTIVE route is the vendor session or an API key, which `auth_preference`
makes durable. Being out of capacity never launders an API-key, disabled or
unverified seat.
Version carriers untouched. config.py stays at exactly 1600; nothing is
grandfathered.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
PHASE 1A of the onboarding/subscriptions sprint (plan §D.1, decisions D-1..D-9).
subscription_install_presets.py — a PURE compiler. Given the harnesses whose
accounts the Claudexor daemon vouches for plus their live model discovery, it
emits the OUROBOROS_REVIEWER_SLOTS value (triad + scope + advisory), the
OUROBOROS_SUBAGENT_HARNESS value, a per-seat receipt, and a typed refusal when
a seat cannot be resolved. The ratified matrix is a TABLE, not an algorithm, so
it can be diffed against the plan line by line; the priority policy that
produced the three inferred completions is documented beside it. Owner
shorthand resolves to EXACT discovery ids through a small ordered per-family
alias table — a model no live id satisfies refuses instead of falling back to a
harness default, because a guessed id would only fail later inside a real
review. Effort rides the row field for effort-free ids and additionally the
compound slug where the harness spells effort inside the id, so the two
channels can never disagree by default. Credential profiles stay unpinned
(D28). The compiler validates its own output through parse_reviewer_slots
rather than keeping a second schema.
gateway/onboarding.py — POST /api/onboarding/complete replaces the wizard's
two-write finish (POST /api/settings then POST /api/owner/runtime-mode), whose
failure between the writes left providers saved and runtime mode not. Ordered:
re-prove install-time status server-side, validate through the shared setup
validator and the structural startup gate (a subscription alone never satisfies
it, D-1), read ONE live account/model snapshot when the payload declares
subscriptions were connected, compile, apply provider normalization FIRST and
add preset keys on top, persist settings + next-boot runtime mode + the
fresh-install safety default + the one-shot marker in a single write whose
eligibility is re-proved under the settings lock, then start the supervisor. A
daemon that cannot answer is a typed 503 that persists nothing, keeps the
wizard open, and advertises the skipSubscriptionPresets escape hatch.
GET /api/onboarding is now side-effect-free: it still normalizes what the
wizard displays but no longer saves. A read that authors settings.json silently
destroyed the fresh-install latch that both install-time behaviours depend on.
Also: OUROBOROS_SUBSCRIPTION_PRESET_VERSION joins SETTINGS_DEFAULTS and the
owner-only merge skip-list, so the generic settings save can neither author nor
clear it; _owner_write_settings grows an optional precondition evaluated inside
the settings lock; settings_setup_contract gains the two subscription intent
fields plus their parser; contracts/router/api_client/api_types/parity tests
mirror the new endpoint per the Gateway Boundary Pattern.
No version carrier is touched.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Add stable-by-default managed update channels with explicit QA and development feeds. Keep clean updates deterministic, invoke assisted merging only for real conflicts, and reserve hard reset for explicit recovery.
Preserve local work, Colab migration, process custody, and complete binary-aware review evidence without adding path-specific restrictions.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
Co-authored-by: Claudexor <noreply@claudexor.dev>
Closes all five defects the external v6.88.0 review left open, plus every finding from a
six-round cross-family review cycle (claude-fable-5:max + gpt-5.6-sol:ultra panels).
Core:
- The replace/hard-reset escape hatch is gated by the SAME protected-path authority as the
staged strategies, by EXCLUSION (safety-critical OR unrecognized tiers require an explicit
BOUND owner acknowledgement: echoed base/target SHA + path list, exact match, SHAs pinned
into prepare_managed_update — closes the fetch TOCTOU; audited to supervisor.jsonl BEFORE
preparation; never overridable when the delta is unverifiable). Ack is replace-family-only
(staged strategies ignore ack fields — pinned).
- Fail-closed dirty-count predicate (strict int == 0, bools rejected) at all three call sites,
and the PRODUCER checks git-status rc (a failed status can never read as clean).
- Typed protected_delta_unverifiable reason: missing SHAs / failing diff disables the
exemption, routes to manual end-to-end (backend + both dialogs). Protected-delta diffs are
rename-proof (--no-renames).
- Staged strategies re-gate the post-stop re-plan (protected block + SHA identity re-checked).
- Frozen contracts: UpdatePreflightProtectedRoute / UpdatePreflightResponse / UpdateApplyRequest
/ UpdateApplyResponse (Literal statuses) + api_types.js mirrors + parity tests + typed client.
- Update-engine hardening from the review cycle: typed writer fence with generation snapshots
(teardown-safe), repository-writer custody for service lanes (append rc fail-closed, bounded
kill-retry, distinct RepoWriterCustodyError), group-liveness lease retirement (incl. failed
starts), tx-before-intent ordering, rollback rc checks, assisted readiness proof, bounded
ssh-transport fetch (FETCH_TIMEOUT_RC), pgid-before-kill reaper.
- UI: dialog consumes protected_route.offered_strategy; stale-ack re-prompts with the fresh
disclosure; typed-reason manual rendering; assisted_started toast; degraded preflight is
honest and non-actionable.
- Docs: reproducible measurements replace the 39/39 (100%) claim (113 one-behind spans:
55 manual old rule vs 40 new); UNCONDITIONALLY wording scoped to the shipped semantics;
ABI types registered in the ARCHITECTURE frozen-contract table.
Verification: 168 routing tests (every finding pinned) + contracts/parity/packaging/smoke
green; node --test web/tests 70/70; six cross-family panel rounds converged (final round:
0 blockers, residuals fixed in-tree).
Follow-ups recorded (pre-existing, out of scope): checkout_and_reset intent-sha fallback
warning path; custody-ledger readability probe cost on very large ledgers.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Ship honest sticky activity/cost projections, collapsed provider setup, updated model defaults, fresh-desktop safety authorship, the 500-subagent ceiling, exactly two mobile gestures, and synchronous subtree cancellation with first-class Cancelled rendering.
Six reviewed phases land as one release.
Admission is the outer boundary: every migrated launcher records a manifest before
it can touch the filesystem, and finalizes a typed outcome on every path — success,
refusal, crash, and the real exit status. A structural audit enforces that boundary
across all fourteen launchers, together with confinement computed from the active
checkout and a single manifest publisher, judging by effect rather than by callee
name and failing closed on any write form it cannot resolve.
Harness exit codes are no longer trusted as run status: inspect returns zero for an
eval that raised and harbor returns zero for a job whose trials all errored, so the
launchers now read the harness's own artefact and keep "the harness failed", "it
scored nothing" and "it scored honest zeros" distinguishable.
The acceptance dialogue reconciles receipts through one typed identity that is an
equivalence by construction, so a passing check can no longer clear a red it never
addressed. Prompt caching is normalized at every send site and cached calls stop
under-reporting their input. The owner's context mode becomes explicit and
fail-closed, with one enforcement point for every writer of a disk-authored setting.
Deliberate limits are disclosed in each bench's METHODOLOGY.md rather than implied
by silence. Isolated benchmark egress and the multi-lane script generator are
deferred to a later release with restoration patches and carry-forward notes.
3.1 API sources: POST /api/projects creates from ONE of four sources. path=
attaches an existing owner folder via the new project_sources.py
(resolved-realpath validation: exists / directory / not the home root / no
repo-data overlap; opt-in init_git makes an attach-snapshot commit with a
local git identity — NEVER auto-init without the flag). git_url= clones
server-side into the durable projects root (atomic tmp->rename,
GIT_TERMINAL_PROMPT=0 + ssh BatchMode, typed auth_required for private
repos). with_workspace provisions a genesis folder; none = file-less.
provenance (attached|cloned|genesis|none), clone_url, and automatic
trusted_at (notification trust model: attaching IS the owner's grant) are
recorded as additive registry facts; live git data is always read from .git.
3.2 UI: New Project "+" in the Projects sidebar header — dialog with name +
four sources, a server-side home-confined directory browser (GET
/api/fs/dirs; works in web/Docker where no native picker exists) and the
honest "agent gets write+shell in this folder" note. Per-row kebab: rename
(POST /api/projects/{id}/update), hide (presentation-only project_hidden
ui-preference — NOT a resurrected status lifecycle), delete (POST
/api/projects/{id}/delete — un-registers + unbinds; the folder and memory
store are never touched). Owner-created (origin=owner_ui) projects are
always visible in the sidebar regardless of thread activity. New routes in
gateway contracts + router + api_client.js + api_types.js (parity green).
3.3 Agent one-liner: promote_chat_to_task(source=<path or git URL>) attaches
or clones through the same server primitives, registers the folder on the
project (provenance + trusted_at at the canonical DATA_DIR), sets it as the
task's active workspace, and reports loudly without a confirmation wait.
Owner-declined tradeoffs recorded in ARCHITECTURE so reviewers stop
re-proposing them: no env secrets-scrub for external-workspace shells (quiz
12 — freedom over isolation, a deliberate owner decision), external PR-flow
(quiz 14) and workspace-AGENTS.md reading (quiz 15) deferred out of sprint.
MAX_TOTAL_FUNCTIONS 3740 -> 3775 (workspace_admission, coop_checkpoint,
project_sources, gateway handlers).
Phase 1 of the megasprint — small structural fixes to swarm/observability
honesty plus the two owner-facing settings surfaces.
find_child_tasks gains scope="direct"|"subtree"; per-node absorption/handoff
(loop.py) use direct, so a childless grandchild no longer receives a false
children_unabsorbed reminder about its parent/sibling.
verify_and_record: new refused_out_of_scope receipt status (a policy refusal,
not a fail; never raises has_failures) + artifact_observation now confirms a
child's deliverable under the read-only subagent_projects/deliverables roots
(existence/size only).
outcomes: a dedicated policy_denials bucket — an unrecovered *_blocked refusal
on ANY tool (incl. write/shell/integration) is telemetry, not an execution
degrade and not a tool_failure headline; genuine errors still degrade;
build_trace_summary shows the honest bucket breakdown so reflection is not
poisoned. (site-presentation incident: integration_blocked/LIST_FILES reddened
a shipped site.)
supervisor/queue: idle heartbeat suppressed while a descendant progresses
(not latched, so it still fires on genuine idle).
schedule_subagent returns the child's effective profile summary
(shell/writable roots/lane) to the parent and injects it into the child's
start context; a capability mismatch names the correct spawn; new recursive
cost_usd_with_children rollup on the parent card + Logs.
protected_artifacts: glob carve-out (rm -f *.out beside a black-box ref no
longer blocks; a pattern that could match the ref still does) + refusals name
the nearest allowed action.
Settings->Behavior Safety Supervisor card (Full/Light/Off via the audited
owner endpoint, confirm-on-lower, 24h skip counter; safety_mode added to
/api/state + StateResponse). EFFORT_SCALE SSOT (none..max): xhigh/max added,
direct-Anthropic effort mapped to adaptive-thinking output_config.effort (was
a dead control), and a requested effort clamped down to each route's learned
ceiling (capability_evidence effort_ceilings namespace; disclosed, never
silent). MAX_TOTAL_FUNCTIONS 3699->3740.
Commit 1/3 of the bench post-mortem sprint (plan: smooth-skipping-charm).
File-API root-label hybrid: user_files reads under the active workspace
auto-route with a trailing note; writes get an actionable redirect;
resolve_user_file_path rejects outside-home absolute paths early
(casefold-aware, external-workspace reach preserved); list_files failures
are first-class errors on every state.
Safety supervisor: parse-fix (max_tokens/reasoning none/timeout on all
routes incl. local+gigachat; droppable response_format with bracket-scan
fallback; droppable reasoning_effort), empty/truncated/unparseable
classification, durable-first audit events; owner-only
OUROBOROS_SAFETY_MODE (full/light/off) with the full self-lowering guard
set incl. percent-encoding hardening and a LIVE Playwright guard chain
(route.fallback — makes the pre-existing owner-route blocks effective).
Light-mode honesty: read-vs-write structural mention-scan (AST-refined,
secret-named paths always blocked), block messages name real task roots,
staged attachments expose script-usable abs paths.
Deadline package: web/wait tools clamp to remaining minus finalization
reserve (never flooring past it); web_search transport timeout; no_proxy
read/write floor SSOT; plan_task deadline scaling with typed skip.
schedule_subagent surfaces tree slot occupancy.
10 triad+scope review rounds to convergence (25 findings: 21 confirmed
fixed, 2 rejected with evidence, 2 partial). 40+ focused tests.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Five owner-requested improvements plus an automated assisted managed-update merge.
P1 (project naming): skill/system tasks (skill_lifecycle_*) with no human text now get a
skill-derived name (metadata + structural-id source) instead of the dead-end "New project",
with a durable project_named reason-code event.
P2 (safe updates): the managed update does a REAL git 3-way merge in an isolated temp worktree so
local advanced/pro changes survive — update_merge_policy.py classifies conflicts; a staged
POST /api/update/preflight + apply{auto_merge|assisted|manual|replace} lands a clean merge behind a
fail-closed lock with a pre-restart smoke + transactional rollback + a post-boot boot-loop guard; a
main-screen Update pill + staged dialog surface it; the availability check runs on restart.
SC2 (automated assisted merge): conflicts or uncommitted local work route to an AUTOMATED reviewed
flow — the supervisor stages a real merge into the live worktree (re-basing the first parent to
pre_update_sha via update-ref, so the reviewed diff includes the owner's dirty/untracked work), the
agent resolves the markers, and the UNMODIFIED commit_reviewed lands a reviewed 2-parent merge. A
tx-keyed managed commit path enforces exclusivity + a conflict-marker leakage gate + suppressed
push/tag + an inline pre-restart smoke; a central write-exclusivity guard; an orphan watchdog;
non-destructive, merge-state-keyed boot recovery; protected-path official changes route to manual.
P3 (full-output bubbles): any truncated subagent/research bubble carries {truncated, full_ref} and
expands inline to the genuinely-full output (composed result + trace), fetched on demand.
P4 (Activity): a new Dashboard subtab shows cron schedules, running/queued tasks, and background
consciousness with direct mechanical controls (skill schedules read-only).
P5 (skill token budget): the byte-cap skill-review gate becomes a pack-level token budget (a 76 KB
data file no longer locks a legitimate skill) with a chunked over-budget fallback (per-chunk
parseable quorum) + a first-class write_surface='read_only' subagent surface.
Reviewed via 8 rounds of the real triad+scope immune review, 2 rounds of Ouroboros multi-model
planning, and a final claudexor (gpt-5.5) review against the plan and the commit-gate checklist.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Multi-task chat steering (WS1): a busy-chat decision turn STEERS the right running
task instead of spawning a duplicate. It sees the chat's running tasks as a structural
runtime fact (current_chat.running_tasks) and the new LLM-first steer_task(task_id,
message) delivers to that task's owner-mailbox — idempotent (client_message_id-derived
msg_id, no double-deliver), fail-visible on a stale target, generalizing to N concurrent
tasks (the agent's judgment picks the target — no keyword gate, BIBLE P5). A busy project
room routes to the same decision turn (project-scoped) rather than mechanically
auto-spawning; the 1:1 project auto-delivery is idempotent too.
Skill-dispatch resilience (WS2): the ctx calling-convention is decided on the RAW handler
(no spurious-ctx TypeError for keyword-only handlers). (The no-deps _execution_lock skip
fast path was withdrawn — it reopened a cross-skill dep leak; a reader/writer fast path is
deferred to a live-verifiable release. Head-of-line is mitigated by the pre-existing
out-of-process dispatch + the nested-finally lock release.)
Chat-lane wedge resilience (WS3): bridge intake is hoisted EARLY in the supervisor loop;
a dedicated per-generation liveness watchdog (off the serial loop) alerts the owner on a
supervisor-loop stall OR a heartbeat-silent in-process chat turn (read lock-free; +
/restart hint). In-process admission cannot be safely freed (the wedged turn holds
_chat_agent_lock), so out-of-process kill stays deferred; WS10 ephemeral turns keep the
chat responsive meanwhile.
WebSocket hardening (WS4): broadcasts fan out concurrently (asyncio.gather — one slow
client can't head-of-line); chat-history jsonl parses off the event loop (asyncio.to_thread).
v6.33.0 review carryover (WS5): the P3 scope-review floor is owner-only + audited (POST
/api/owner/scope-review-floor, merge-skipped from generic settings, guarded on shell/browser/
SAFETY channels). Max context mode is enforced at point-of-USE and point-of-BUILD (fail-closed
to Low when the active route — remote OR local n_ctx — no longer confirms >=1M, read-only;
USE_LOCAL_MAIN routes the gate to local n_ctx; switch_model refuses a sub-1M route while the
transcript is max-sized, fail-closed). A short ephemeral decision turn runs a DEFAULT-DENY
read/decision ALLOWLIST (no durable/control/review/skill/shell or extension·MCP tools) and
leaves no durable task record. The external-shell secret guard catches relative interpreter-
string paths. Ratified extras: op=structural code intelligence is polyglot via tree-sitter
(Go/Rust/Java/... + a visible structural_unavailable marker); an OpenAI-compatible /models
capability probe; Settings Max-save shares the capability-ack flow.
SYSTEM.md slim (WS6): the named-project how-to moves from the prompt into the
promote_chat_to_task tool description.
New surface: POST /api/owner/scope-review-floor, steer_task tool,
OUROBOROS_SUPERVISOR_LIVENESS_DEADLINE_SEC, OUROBOROS_PACING_INTERVAL_SEC.
Reviewed by the full triad (gpt-5.5 / gemini-3.5-flash / opus-4.8) + scope (gpt-5.5, 1M) +
claudexor (gpt-5.5) across 8 gauntlet rounds; converged with the sole remaining finding —
the WS2 no-deps reader/writer fast path — an owner-deferred, evidence-based decline.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Context window is no longer a static per-model table: every window claim is sourced,
route-fingerprinted Capability Evidence (provider /models metadata, local n_ctx, or an
owner acknowledgement) with a status (confirmed/asserted/unprobeable/failed), persisted
atomically. Max context mode is fail-closed — it requires >=1M confirmed/asserted evidence
for the active route. Changing the model while Max is on stays friction-free: the change
succeeds and context auto-downgrades to Low with a plain notice when the new route can't be
confirmed >=1M, but a genuine no-connection during the probe is an error (the model is not
saved), and a transient provider outage never erases a prior confirmed record.
Multi-project: the agent can now CREATE a NAMED project from chat in one LLM-first call
(promote_chat_to_task project_name/title; non-ASCII names get a deterministic hash id while
the display name is preserved). A main-chat task converts to a project in one click,
auto-named from its title/objective (no prompt, no extra LLM call); project-chat follow-up
tasks bind to their project so the main chat shows no stray "turn into project" button and
instead a calm pointer that opens the project panel; a converted card becomes a calm indigo
project identity (no red "error" look); per-project unread dots sort active projects to the
top (server-stored last-viewed); the project status/sleep-wake lifecycle was removed.
UI: oval (pill) composer with centered controls; per-thread chat scroll restored on tab/
panel switch instead of jumping to the top.
Also: real deadline_at finalization + advisory pacing, polyglot tree-sitter code intelligence
for non-Python symbols (query_code op=digest; Python stays on stdlib ast), reflection
faculty-atrophy doctrine, BIBLE P1 (Capability Evidence) + P8 (faculty atrophy) clauses, and
assorted WS9 tool fixes.
New surface: POST /api/owner/capability-ack, ouroboros/capability_evidence.py,
data/state/capability_evidence.json.
Reviewed by triad (gpt-5.5/gemini-3.5-flash/opus-4.8) + scope (gpt-5.5) + claudexor (gpt-5.5)
+ an independent adversarial multi-agent audit, against the original plans and the owner's raw
message transcript; all confirmed defects fixed, remaining findings evidence-rejected or tracked.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
One agent, parallel durable projects. The single self stays unified (one identity,
constitution, evolution; BIBLE P1) while gaining an owner-facing project layer.
- Projects registry (data/state/projects.json, boot-reconciled, never age-pruned,
deterministic per-project chat ids). Conversation lane stays free; real work routes
to first-class pooled tasks via the LLM-first promote_chat_to_task tool. Project chats
ride the one WebSocket with chat_id-stamped frames + per-thread history; owner-mailbox
steering of a project running task; one-writer-per-project lease (swarms exempt);
agent-restart drain protects running project tasks; optional invisible-git working
folders; /api/projects (+ /api/projects/from-task) and durable task-to-project bindings.
- Per-project memory: journal (journal_write/read), workpad (workpad_*), and bounded
context injection beside project knowledge.
- Full project awareness: the one mind sees ALL threads in its unified memory — recent
dialogue, dialogue_blocks consolidation, and chat_history (only A2A virtual transport
excluded). A project TASK gets a FOCUSED working context, not memory isolation. No
silent prefix-slicing of cognitive artifacts (workpad/journal/digest/WORLD): full
content or a visible pointer; durable writes reject over-limit.
- UI: design-system shell — left #primary-sidebar of rows with a Projects section; a
project opens as a right split panel (desktop) / overlay (mobile) hosting a full chat
instance over the one shared WS (fan-out by chat_id); a backend-created project pushes
a projects_changed frame; header restart/panic + a More menu (consciousness/evolve/
review); chips above the composer.
Reviewed across 16 triad+scope rounds to convergence (gpt-5.5 scope reviewer unchanged).
The final confirming run was waived by the owner due to OpenRouter credit exhaustion; the
post-convergence diff is one small, regression-tested fix (bound-task media routing).
Phase 1 of the v6.18.0 unified plan.
Restore workspace parent access to task_acceptance_review without exposing commit/runtime-control tools, strengthen plan_task prompt discipline, normalize system-message placement at the LLM boundary, harden OpenRouter reasoning-signature retry behavior, tighten VLM routing/timeouts/payload caps, and move Claude Code governance prompts through private SDK prompt-file handoff.
Also integrate the useful OpenAI-compatible onboarding/model-loader slice from PR #36; the other PR #36 commits were stale-base changes already present in v6.17.0 and were not re-merged.
Review evidence: two adversarial review cycles completed; real triad+scope dry-run completed with scope_status=responded, scope_blocked=false, scope_review_skipped=false. Remaining triad version_bump finding is intentionally deferred per the accepted four-phase plan, which performs the unified 6.18.0 version/release sync in Phase 4.
Consolidate repeated gateway, review, skill lifecycle, marketplace, memory/context, release, and web UI paths while preserving public API shapes, review gates, and runtime contracts.
Verification: python3 -m pytest tests -q --tb=short; external triad review PASS with scope review skipped only for context budget advisory.
Move browser-facing HTTP and WebSocket ownership into a dedicated gateway package, add the frontend API-client boundary, and keep release metadata aligned for the pre-release.
