)]}' { "log": [ { "commit": "0eacdb809995ae07a9a4a97860f3ad85da105880", "tree": "299d86889499b1154e23fd93911ca8751d95abf6", "parents": [ "3ed7b48dd3437db794bdea78466ae745e782b773" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 19 23:20:45 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 19 23:20:45 2026 +0200" }, "message": "image: build to check, never publish\n\nThe workflow pushed the harness image to GHCR on every change to its\ninputs and weekly, which under the apache organisation publishes a build\nthat is not a release. It now only builds, to show the Dockerfile still\ndoes; each machine builds its own with make image. The weekly rebuild\ngoes, since without publishing it has nothing to hand on, and so does\nthe packages permission. The daily pin check and its pull request stay.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "3ed7b48dd3437db794bdea78466ae745e782b773", "tree": "8621b2b68956f03e537e9274f712ac8f788d4015", "parents": [ "7ecdea53514c3dd30ea624693ca539e50f8d33c2" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 19 23:10:53 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 19 23:10:53 2026 +0200" }, "message": "CI: use only actions on the ASF allow-list\n\nEvery run failed at startup: Apache repositories may only use actions\nthat apache/infrastructure-actions approves. rust-toolchain is pinned to\nthe one commit the allow-list carries, and the cargo-deny action, which\nis not on it, gives way to installing cargo-deny and running make deny.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "7ecdea53514c3dd30ea624693ca539e50f8d33c2", "tree": "f7479bcb84985471c719d9ce93d4ac08c93caa8e", "parents": [ "eebd192a0408946bf61c9bf7d9d011abb9819654" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 18 23:04:46 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 19 23:06:28 2026 +0200" }, "message": "Repository settings: .asf.yaml\n\nFollows tooling-llmao: description, homepage, PR and issue subjects,\nnotifications to commits@tooling.apache.org, and a protected main.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "eebd192a0408946bf61c9bf7d9d011abb9819654", "tree": "a307c1572698f3d37c414c1e4ce99952e04b6cc2", "parents": [ "300981294d92051424cdfeaeeffc295bc86c5e9c" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 18 01:52:44 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 18 01:52:44 2026 +0200" }, "message": "Demo: a fictional decision register, seeded beside the papers\n\nThe demo, the evaluation set and a few tests ask what DR-19 decided about\nthe wiki staying on MoinMoin, which spike settles it, and what DR-22 decided\nabout the format entries travel in. Nothing in docs/ answers that, so the\ndemo had nothing to find. examples/decisions holds the two records, written\nfor that purpose and describing no real project, and DEMO_FROM seeds them\nbeside the papers by default.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "300981294d92051424cdfeaeeffc295bc86c5e9c", "tree": "a13875500ab99d9dd91b5222ada04d0a56ec45a0", "parents": [ "a0afee28121c989af083021802e9306219d87d25" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 17 00:59:45 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 17 00:59:45 2026 +0200" }, "message": "M19 held on the way: the companion stops a redirect before it is made, and renders a page in a tab\n\nThe third cut left one limit standing: a redirect was the browser\u0027s, followed before the\ncompanion saw where it went, so a page on a granted host could send the browser to any\nhost with that host\u0027s own cookies, and what came back was refused unread but the request\nwas made. The browser can hold its own requests, so now it does. While an ask is in\nflight the extension keeps session rules of declarativeNetRequest that block every\nrequest of its own to a host the ask does not name: one block rule on the extension as\ninitiator, an allow rule above it per host, written as a regular expression over the URL\nbecause `requestDomains` can say neither a port nor keep the apex out of `*.example.org`.\nA redirect elsewhere is stopped by the browser before it leaves, the site never hears it,\nand the refusal says where it was going, read from webRequest. Probed first in headless\nChromium: the rules do match the extension\u0027s own fetches, an IP is a domain to them, and\nnaming the extension as initiator scopes them so no tab of the owner\u0027s and no other\nextension is touched. The rules are rebuilt from the asks in flight, so none outlives its\nask and a worker that starts clears what one that died left behind.\n\nThe browser also has the `tabs` permission now, and the fetch tool a `render` argument:\nthe page is opened in a tab of the owner\u0027s browser, not shown, held to the hosts by the\nsame rules on the tab\u0027s frames, read as its scripts built it once two reads agree (a tab\nthe owner is not looking at runs timers on whole seconds, so the first read waits one\nout), and closed. A navigation the rules stopped is the answer as soon as the frame\nreports it, whatever the tab\u0027s status says; the first run under load waited for a status\nthat never came. Only the browser renders: the launcher and a tool server refuse the\nargument rather than fetch the bytes and call them rendered, and a rendered page is a\nsource of its own. The MCP tool adds the argument to its call only when asked, so a plain\nfetch\u0027s source id is what it was.\n\nTests: the real-Chromium test counts the site\u0027s requests under its other name and shows\nzero after the redirect and after a page whose script leaves the hosts, and reads a page\nthat is a shell until its script runs as built; the launcher test shows `render` carried\nto the ask and refused off the browser. PLAN M19 records the probe, what the egress as a\nbrowser proxy would and would not give (a browser\u0027s proxy is per profile, so the owner\u0027s\nown clicks would travel under the session\u0027s label), and why it was not taken.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "a0afee28121c989af083021802e9306219d87d25", "tree": "c7d95b3d4ae4509d69fc96d3a171db1604b135f9", "parents": [ "cec55a2809a8f89e521230423e16d4fd70de180e" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 17 00:57:59 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 17 00:57:59 2026 +0200" }, "message": "Deps: wasmtime 49.0.3 and rustls 0.23.46, for the advisories of 14 and 15 October\n\n`make deny` went red on advisories published since the last green run: RUSTSEC-2026-0346\nto 0349 against rustls 0.23.45 (TLS secrets in Debug output, ECH rejection, certificate\ndecompression, a downgrade) and RUSTSEC-2026-0350 to 0355 and the wasi-http ones against\nwasmtime 49.0.2 (host panics from a guest, a long URL crashing wasi-http, absolute-form\nrequests to other hosts, a filesystem sandbox escape on renamed symlinks). All name the\nnext patch release as the fix, so this is `cargo update` on those crates and nothing else.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "cec55a2809a8f89e521230423e16d4fd70de180e", "tree": "3b84d9c1af09a71ed32d99a093216fd586efe4fe", "parents": [ "a5bcadd00d8a120684af4b124a282a2f89f2eb2e" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Fri Oct 16 00:40:24 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Fri Oct 16 00:40:24 2026 +0200" }, "message": "Case study: pilot the Foundation\u0027s Tooling initiative\n\nAdd Tooling as a fourth pilot: Foundation-level work supported\ndirectly by the Foundation, with paid contractors and volunteers, and\na queue of requests from many projects. List tooling among the\nFoundation-level domains under an officer, and stop assuming every\npilot has a PMC (steward records rubric changes; review capacity is\nagreed with the steward).\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "a5bcadd00d8a120684af4b124a282a2f89f2eb2e", "tree": "f31f8364f11fa7076f96e822e39fd83e0e252295", "parents": [ "ba9f1b21745d5731501ea6d2d7aac57221bcef8c" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Thu Oct 15 23:10:20 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Thu Oct 15 23:10:20 2026 +0200" }, "message": "Case study: tighten Astra\u0027s revision; link every reference\n\nKeep Astra\u0027s sourced ASF corrections (release votes, code vetoes,\nretired podlings under Incubator oversight, members\u0027 list access,\nconfidentiality towards third-party services), the pilot scorecard,\npublic-first pilots, and alignment with the paper. Restore the chosen\nabstract with a one-line scope note, concrete counts (checked against\nprojects.apache.org: 216 committees, 24 podlings), the 2010 Lucene and\nSolr merge, the Hugging Face tie-in, and a crisp personal-domain rule.\nCut hedges and split long passages. Every § reference and every\nmention of the paper is now a link.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "ba9f1b21745d5731501ea6d2d7aac57221bcef8c", "tree": "53dd39e43311e71d34196b03b90cb71f885eced7", "parents": [ "6af7d076912d92ded1f491bccd7e0211c070e87d" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Thu Oct 15 23:07:11 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Thu Oct 15 23:07:11 2026 +0200" }, "message": "Case study: GPT-6 Astra revision\n\nUncommitted edits by GPT-6 Astra (OpenAI) to Seeding a Foundation,\ncommitted as found before review.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "6af7d076912d92ded1f491bccd7e0211c070e87d", "tree": "c1a09b648cf70a37cfe7db4a58acf9c7b14875e8", "parents": [ "cf76172ce7f2b50d8708c98578229fd17845ca8f" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Thu Oct 15 21:52:01 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Thu Oct 15 21:52:01 2026 +0200" }, "message": "Memory paper: state what the design covers of the VSM\n\nSplit the VSM table into what the design provides and what a\ndeployment must supply, and say plainly that viability depends on\npeople carrying out the exchanges the design makes visible. Drop the\nalgedonic-signal claim. Restore the case-study link, the two-page\noverview line, and the named search engines.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "cf76172ce7f2b50d8708c98578229fd17845ca8f", "tree": "a09937e55e0225b8b5cf72124bfbd12aca55f24a", "parents": [ "29bf6593a47988723a24fb7026c522d6446ba88e" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Thu Oct 15 21:44:09 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Thu Oct 15 21:44:09 2026 +0200" }, "message": "Memory paper: GPT-6 Astra follow-up edits\n\nUncommitted edits by GPT-6 Astra (OpenAI), committed as found:\nbyline spelling, overview wording, lexical search in place of named\nengines, and a reworded VSM passage in §13.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "29bf6593a47988723a24fb7026c522d6446ba88e", "tree": "de2cc5262af772b49a6f047b0de169252874c50a", "parents": [ "5e9d4d920756b6177b448e4d7a5f893695f8a850" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Thu Oct 15 19:35:51 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Thu Oct 15 19:35:51 2026 +0200" }, "message": "Memory paper: tighten Astra\u0027s revision; link every section reference\n\nKeep Astra\u0027s technical changes (fencing, recovery bundles, access\nfreshness, replay visibility, metadata erasure, the strategy review).\nRestore §1\u0027s concrete wording and the laptop backstop in §12; name the\nlook-ahead role the horizon scanner and add it and operational units to\n§2 and the glossary; give Local responsibility a Why and a table; move\nduplicated detail to Appendix E; cut §13\u0027s VSM part back to the table\nand two short paragraphs; drop the unverified reprint link on Beer 1984.\n\nEvery § and Appendix reference in the paper now links in-page, and the\ncase study links the paper\u0027s title and each mention of it.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "5e9d4d920756b6177b448e4d7a5f893695f8a850", "tree": "434a6d5e2f04d3997da9fa5d8962765f0bea261d", "parents": [ "c908558d168b77d7e7c6497565e16e4ff8669bbb" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Thu Oct 15 19:25:34 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Thu Oct 15 19:25:34 2026 +0200" }, "message": "Memory paper: GPT-6-Astra revision\n\nUncommitted edits by GPT-6-Astra (OpenAI) to the memory paper,\ncommitted as found before review.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "c908558d168b77d7e7c6497565e16e4ff8669bbb", "tree": "6e6af24aeb718a5faaa590f05ae84e9e0c802e74", "parents": [ "2bc55f8f54129d33594832889b79d08ea1b5774f" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Wed Oct 14 03:18:46 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Wed Oct 14 03:18:46 2026 +0200" }, "message": "Memory paper: clarify the token-budget question\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "2bc55f8f54129d33594832889b79d08ea1b5774f", "tree": "c1ade23bb2f072561e36e84065545879970af27b", "parents": [ "251e1a8cb3982d26cccd25058353871a85934c4b" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Wed Oct 14 03:14:27 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Wed Oct 14 03:14:27 2026 +0200" }, "message": "Memory paper: why intros across §12; retitle prices section\n\n\"Prices, and why not build in the token\" becomes \"Cost and\nthroughput\". It and Models and tools gain a Why opening, Identity\u0027s\nopening is labelled to match, and the token argument gets its own\nbold lead.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "251e1a8cb3982d26cccd25058353871a85934c4b", "tree": "08806b0251a9d7d7c8e3c503598615bddfc6f053", "parents": [ "29ff5843ed6c9d594bd46e43365937652d6513e6" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 20:39:14 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 20:39:14 2026 +0200" }, "message": "M19 third cut: the browser as the third host of fetch, through a companion beside the page\n\nA laptop\u0027s owner is signed in to the pages a session needs, and copying those logins\ninto grants as credentials is the wrong way to let a session read them. So a fetch grant\nthat says `browser \u003d true` is fetched by the owner\u0027s own browser: the companion, an\nextension beside the web launcher\u0027s page (crates/web/companion), holds one websocket to\nthe launcher, paired with the key the page hands it once the page itself is paired. The\nlauncher asks for a fetch with the token, which no page holds; the extension fetches\nwith the browser\u0027s credentials, to the hosts the ask names and nowhere else, and\nanswers with the status, the content type, the URL that answered and the body as text.\n\nThe guarantees stay where they are. The memory server decides the URL by the session\u0027s\npolicy before the browser is asked and the URL that answered before anything is kept,\nthe ask carries the hosts the session may reach, the answer is shaped by dm_fetch as the\nother two hosts\u0027 are, scanned, and kept as a source observed by `browser`; a tool server\nnever serves a browser tool. The access gate admits an extension\u0027s origin on the\ncompanion\u0027s socket and nowhere else. The page shows the companion beside its pairing.\n\nSaid plainly in PLAN: the ask goes to the web launcher on loopback, not through the\negress, so it is not metered or pinned there; a redirect is the browser\u0027s, followed\nbefore the companion sees where it went; and the whole cookie jar is reachable in\nprinciple, held to the grant\u0027s hosts on both sides.\n\nProven end to end with a companion standing in for the extension (crates/memory/tests/\nbrowser.rs) and with the real extension in headless Chromium (crates/web/tests/\ncompanion_browser.rs): the browser signs in to a site, and the session\u0027s fetch of it is\nsigned in. Headless Chromium shows an extension no tab for a page named on its command\nline, so that test opens the page through the DevTools endpoint; the container Chrome\nwrapper now mounts the checkout read-only so `--load-extension` can name the companion.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "29ff5843ed6c9d594bd46e43365937652d6513e6", "tree": "6a5b2802adcc2302e892cec6e7f33bff5050fbc6", "parents": [ "196f1c689286d6018483dec72f90c744bb302ef1" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 18:46:52 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 18:46:52 2026 +0200" }, "message": "Memory paper: cut Build Order, compact Related Work\n\nBuild Order added little the evaluation and survival sections do not\nalready say; remove it and point its few references at §11 instead.\nRelated Work becomes §13: one table of what each area builds on, the\nVSM mapping trimmed to a table and two sentences. No citation dropped;\nnumbering order unchanged.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "196f1c689286d6018483dec72f90c744bb302ef1", "tree": "5a0530e56da5cf29d81f564e61f3ba0d12a8b7c3", "parents": [ "40ca32d3c012e7d406a67b58baf4b0d15093dc0b" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 18:42:50 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 18:42:50 2026 +0200" }, "message": "Memory paper: restore the Viable System Model mapping\n\nThe shortening pass (78a3b47) cut the organisational-cybernetics\nparagraph along with Beer, Ashby, and Wiener. Bring it back in Related\nWork as a VSM mapping table on current role names, with the recursion,\nalgedonic-signal, requisite-variety, and feedback points, and add\nreferences 74 to 77 with links.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "40ca32d3c012e7d406a67b58baf4b0d15093dc0b", "tree": "784a0a35f1fdf1c2df1eae101ae31ceb5163efb1", "parents": [ "23d1b24513a9268a8956016f0e42e5a0269fba95" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 17:58:32 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 18:09:18 2026 +0200" }, "message": "M18: the projection as a live mount, served by the memory, tried on every confined launch\n\nThe projection\u0027s first rung rendered the record to files and had a hook turn the\nharness\u0027s file reads into gets. The hook sees the harness\u0027s own tools and nothing\nelse: a `cat` from a shell read the rendered body and the server never knew. This\nputs the server in the path. The render stays on disk as the shape of the view and\nthe home of the summaries and recall pages; what the sandbox mounts is a FUSE\nfilesystem the launcher serves over it (crates/mount). A listing and the summaries\npage come from the render, free, as the hook always let them; opening an entry file\nis Memory::get, through the filter, raising the label, in the read log and on the\ntape as a `get`, whatever tool made it; a refused get is a refused open, and an entry\nthe render still lists after another process replaced it is not served, since the\nrecord\u0027s word decides at open time. Direct I/O, so the kernel never answers a read\nthe launcher did not see. Read-only: writes stay with `write`.\n\nUsed optimistically. Every confined launch tries the mount, unprivileged through\nfusermount3 on the host and bound into the sandbox at the same /memory, and falls\nback to the render where the host has no /dev/fuse or helper, saying which on the\nlaunch line and in `amem doctor`. Over a mount the hook makes no get of its own, so\na read is counted once, and keeps its refusals of searches, writes and stray names.\nMounts a killed launcher left are cleared at the next launch.\n\nFound on the way: the sandbox\u0027s read-only remount dropped the flags a mount made\noutside the user namespace carries (nodev, noatime), which the kernel locks there,\nso every confined launch over a live mount failed with EPERM at the remount. The\nbind reads the flags back and keeps them. Before the fix the three confined launch\ntests failed with \"remount ro .../memory: EPERM\"; the end-to-end test then showed\na shell `cat` inside the sandbox landing in the read log as a `get` with no hook\nin the fake harness to have made it.\n\nserde_yaml_ng was not an option for the YAML move in the previous commit; noted\nthere. PLAN M4b says rung three is in and rung two passed over; M18 says the read\nhalf is decided and built and the read-write half is not.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "23d1b24513a9268a8956016f0e42e5a0269fba95", "tree": "984d11670c3094bf3790b96c17923ffc5388a459", "parents": [ "4901cd817466212c83a75cc41ca4ca29344dcbe9" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 17:46:24 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 17:46:24 2026 +0200" }, "message": "YAML through serde_norway: serde_yaml is archived and its parser unmaintained\n\n`make deny` fails on RUSTSEC-2024-0449: unsafe-libyaml, the libyaml transliteration\nunder serde_yaml 0.9, is unmaintained, as is serde_yaml itself since March 2024.\nserde_norway is the maintained fork with the same API over a maintained fork of the\nparser, so the two crates that read and write frontmatter, manifests and receipts\nmove to it with no change in what they write. serde_yaml_ng was the other candidate\nand still sits on the unmaintained parser.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "4901cd817466212c83a75cc41ca4ca29344dcbe9", "tree": "67ee65c318a115d4f76695bb9abdac462ab130d5", "parents": [ "82f1fbcd69b8850d4b106dbc81d023d0bb805f80" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 03:19:01 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 03:19:01 2026 +0200" }, "message": "Memory paper: every reference linked; auditors and recall deputy get sections\n\nAdd verified links for the six references that had none (DAMA-DMBOK,\nGray and Cheriton, Evans, Erol et al., Zimmermann et al., Sliwerski et\nal.). Includes Codex\u0027s reference corrections: fuller bibliographic\ndetail and DOIs for older works, and corrected titles and authors for\nseveral recent ones.\n\nAuditors and the recall deputy each get a short section with its own\nreason, so the role links in §2 land on them.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "82f1fbcd69b8850d4b106dbc81d023d0bb805f80", "tree": "2dc93a025e2adda6f1e50d56ee8771eef8100844", "parents": [ "63f4bb46910d2ff33b3005e36ca86f3befeba832" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 03:09:29 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 03:09:29 2026 +0200" }, "message": "amem: drop reqwest, which only the hosted tool client used\n\nThe hosted tool call now leaves through the egress, which has a client of its own, so\nthe launcher crate\u0027s reqwest dependency went unused; cargo-machete said so in verify.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "63f4bb46910d2ff33b3005e36ca86f3befeba832", "tree": "227b5669acb4630a6a76259978612433f56e0b62", "parents": [ "531dc6004919d6dd5e994cabb3e4b75371f5546c" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 03:03:34 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 03:03:34 2026 +0200" }, "message": "Case study: link every paper and section reference\n\nReferences to the paper\u0027s sections and Appendix B now link to the\nmatching headings in the paper; the case study\u0027s own section\nreferences link within the page. Every anchor was checked against the\nheadings it points to.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "531dc6004919d6dd5e994cabb3e4b75371f5546c", "tree": "2dd471396903477e180c5f7924cfd3f5ade21a1b", "parents": [ "24c003ac0440bed98a9fa6af2e4f53c5979e0be6" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 03:00:23 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 03:00:23 2026 +0200" }, "message": "M19: fetch is native in the tool server, behind the same gate as the component\n\nWebAssembly is chosen per tool, not as a rule: its case is isolation for code the\nproject does not fully trust, and fetch is the project\u0027s own. A tool server now runs\nthe binary\u0027s own fetch when no component is installed under the name, so a server in a\nmanaged environment carries no runtime for it; a component installed as fetch still\nruns, and the server says which it serves.\n\nNothing a caller sees differs. `dm_taps::fetch` asks the same `Gate` about every\nrequest, each redirect hop a request of its own, connects to the addresses the gate was\nshown, puts the credential on after the decision, and reports every URL reached. What\nis not the request itself, the URL split, redirects resolved, HTML made text, the\nanswer shaped, moved out of the component into `crates/fetch`, which the component and\nthe native fetch share, so the two hosts answer alike and cannot drift apart; its tests\nnow run in the workspace, where the component\u0027s could not. Admitting a request is one\nfunction for both hosts (`tool::admit`).\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "24c003ac0440bed98a9fa6af2e4f53c5979e0be6", "tree": "c6d149cdcbf7b5fc5f13f7790b32fbda26531e45", "parents": [ "b9c1e6eab4a7e7506890d7989410cb61ced5b01d" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 02:59:16 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 02:59:16 2026 +0200" }, "message": "Memory paper: numbered citations and linked roles\n\nCitations become [n] links to anchored entries in the reference list,\nnumbered in order of first citation; each entry keeps its URL. The §2\nrole tables link every role to the section that covers it.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "b9c1e6eab4a7e7506890d7989410cb61ced5b01d", "tree": "c2ee4d60922c66aabe8f63f1a24745daf5fd4b80", "parents": [ "01dd5c16eba87d8351bf59608d242fec6bed5322" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 02:53:39 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 02:53:39 2026 +0200" }, "message": "Memory paper: fold in Codex\u0027s review\n\nKeep: snapshots and backups must not bring erased content back, and the\nrestore drill checks it; one ordered label set cannot express separate\ncompartments; storage tiers named as such. Drop the second summary, the\nscope note, the reader paths, a fourth view of the write path, and a\ntable that repeated the raw-reach and label rules. Keep author-year\ncitations, fix the historian retention reference, and credit Codex.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "01dd5c16eba87d8351bf59608d242fec6bed5322", "tree": "0a10795cbce130bed159b5f818681da6ea7215c7", "parents": [ "b08885cfe6f5dea62c0d98b6cb8974c9c23536ff" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 02:49:11 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 02:49:11 2026 +0200" }, "message": "M19 second cut: hosted tool calls leave through the egress, and a source says where it was fetched from\n\nA hosted tool\u0027s call went out from the launcher\u0027s own process with a client of its\nown, so it was neither held to a ceiling before it left nor metered or timed, and the\nURLs the server reported were checked and then dropped. Now a tool server is a\ndestination of the launcher\u0027s: `Egress::with_tool_servers` carries one per hosted\ntool, by the tool\u0027s name, and `Egress::post` sends a request there with the session\u0027s\nlabel held to the tool\u0027s ceiling, the server\u0027s bearer injected, and a usage row and a\nspan per request under the model `tool`. The harness cannot reach a tool server by\npath; a tool is reached only through the memory server. Commands with no egress of\ntheir own (`amem tool`, `amem serve`, `amem gofannon`) make one on the first hosted\ncall, over the root\u0027s tool servers and telemetry.\n\n`Tools::call` answers with `Answered`, the tool\u0027s JSON and every URL reached, as the\ntap host already recorded them; the source keeps them as `reached` and serves them with\nthe answer, so a citation can be followed to the page.\n\nCo-Authored-By: Claude Fable 5.1 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "b08885cfe6f5dea62c0d98b6cb8974c9c23536ff", "tree": "b36e3038ea852730b16ab8ed2d3c6fe8dad1ac6f", "parents": [ "7be8d8ba7bfd7fbbe28779dc4b1ea904b1e9c577" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 02:37:54 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 02:37:54 2026 +0200" }, "message": "Memory paper: examples before rules, detail in appendices\n\nLead the densest passages with a concrete case: a handoff walked through\nthe write path, a planted entry traced by lineage, a laptop server in\nfront of an institution\u0027s, a requirement that steers work, a developer\u0027s\npersonal domain. Group the roles into three short tables, show only the\ncore entry fields in §3 (the full record is in Appendix A), and turn the\n§10 gates and the throughput limits into tables. Replay traps, raw-reach\noverrides, and helper rules move to the appendices; the terms table\nbecomes a glossary in Appendix F. Terms used early (harness, principal,\nstorage versus trust tiers, dom-platform) are explained where they first\nappear.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "7be8d8ba7bfd7fbbe28779dc4b1ea904b1e9c577", "tree": "4068bd495fd71c6cfb9dcacd28bcb09ed72e6ad6", "parents": [ "298ae17f074288b7255fef53f91e725c7006e8a6" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 02:33:11 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 02:33:11 2026 +0200" }, "message": "Memory paper: less dense labels, milestones, prices, and access control\n\nLabels and flow open with an example and a diagram, then one rule per\ndirection; the attestation, tool-server, grant, guard, and quarantine\ndetail moves to a new Appendix E, with the vendor-drift detail from\n§11. Milestones become lists of what each delivers and what proves it.\nThe price and access-control paragraphs are split, and the residual\npolicy, per-call send check, and paired pilot are kept.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "298ae17f074288b7255fef53f91e725c7006e8a6", "tree": "dc0a9cbd87d6cc60e704d7b652ddc41833d54c78", "parents": [ "16fdc3259c48112060425ea735f71117c56b7dc1" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 02:17:49 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 02:17:49 2026 +0200" }, "message": "Throughput is scarce on a vendor\u0027s pool too\n\nA vendor\u0027s API is someone else\u0027s accelerator pool: money buys rate\nlimits or reserved throughput, not capacity the vendor lacks, and at\npeak it throttles or serves a cheaper variant. The institution\u0027s rate\nlimit is itself a shared pool. So the perimeter sets spend and\nthroughput limits per class, per domain and principal, and triage lets\ndeferrable work wait at saturation while curation keeps its floor.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "16fdc3259c48112060425ea735f71117c56b7dc1", "tree": "0eb2567140541db5ea1404861c21b2dd605a059b", "parents": [ "bdc521c9ebb9a4c181b035f2e5f181a387885153" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 02:10:59 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 02:10:59 2026 +0200" }, "message": "Trust: drop the lead-in and the benchmark figure\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "bdc521c9ebb9a4c181b035f2e5f181a387885153", "tree": "d4c0d5b37af1400434c798f9b10191a42f335300", "parents": [ "09a9bcd174b6b8900a7cff5d191c633039009707" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 02:02:17 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 02:02:17 2026 +0200" }, "message": "Screen before anything reads a write; raw reach depends on origin\n\nEvery write lands in the historian and is then screened; the index,\nledger, materializer, and taps read only events that passed. A failing\nevent stays in the historian, quarantined at the highest label for the\nsecurity role, so the attempt and its lineage are on record; the\nsecret is rotated and the body erased.\n\nRaw entries reach by origin: the task chain sees its own handoffs at\nonce, fleet-written raw is visible where policy admits raw, and content\nexternal authors wrote through a tap reaches only triage and the task\nit started until curated. The case study\u0027s open front door says so.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "09a9bcd174b6b8900a7cff5d191c633039009707", "tree": "617f00a07c546e59a4e0f920a71d80bbecaf104d", "parents": [ "9e30581d520f86813f18f2480e880c8e00410810" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 01:43:30 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 01:43:30 2026 +0200" }, "message": "Memory paper: principle 9 says who grants permissions\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "9e30581d520f86813f18f2480e880c8e00410810", "tree": "b35bb1329660b435adeae496f052c33179d0ba85", "parents": [ "67ceea10ed31fa12f045d346058dcc58a0d9b4aa" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 01:38:46 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 01:38:46 2026 +0200" }, "message": "Paper and case study: fewer AI tells, and a short case-study abstract\n\nRemove \"X, not Y\" and \"rather than\" contrasts used for effect, and\nrecast sentences that ended on their actor so the actor leads. The\ncase study\u0027s opening now matches the paper\u0027s: the hard case in one\nsentence, what the study does in the next.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "67ceea10ed31fa12f045d346058dcc58a0d9b4aa", "tree": "06286704b29d3cdc45861be10d937bb54a65d871", "parents": [ "dab4d5ef90725dc6df1a1562fa134993ff88c38d" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 01:33:15 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Tue Oct 13 01:33:15 2026 +0200" }, "message": "Memory paper: the abstract states requirements, then proposes\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "dab4d5ef90725dc6df1a1562fa134993ff88c38d", "tree": "42cc4279cf469a7ad58eabd6dbd4bb6525a9e24a", "parents": [ "25e050dcce1374f2ddc644b77d296184d5967741" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 17:15:33 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 17:15:33 2026 +0200" }, "message": "Memory paper: a two-sentence abstract\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "25e050dcce1374f2ddc644b77d296184d5967741", "tree": "71ff2ff3f8b9660ad0f89d48aa46b913e0c2df29", "parents": [ "dfeecb35d5e0e9c694cd38a22ebcf35c7e7e9d6b" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 16:16:48 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 16:16:48 2026 +0200" }, "message": "Case study: same treatment as the paper, and Foundation facts corrected\n\nRestructure Seeding a Foundation the way the paper was: a reason first\nin every section, tables and short lists instead of dense paragraphs,\nand nothing that only repeats the paper. New: people and names (Apache\nIDs and other identities as dated assertions, issuer and subject for\nauthors without an Apache ID), stewards per domain, lineage for the\nopen front door and for private-list declassification, and the July\n2026 incident as the case for the poisoning defences.\n\nFacts corrected after review: Foundation-level domains belong to\nofficers and the board, not PMCs; podlings have podling PMCs; Solr\nleft Lucene in 2021 and the two merged development in 2010; vetoes\napply to code changes only; committers apply tracker labels; Bugzilla\nis a tracker too; the Security Team guards security material.\n\nIn the paper: the incident entered Hugging Face through a dataset\nupload; a repository copy of a skill is a generated stub; a stray\nreference left by the curator rename is removed.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "dfeecb35d5e0e9c694cd38a22ebcf35c7e7e9d6b", "tree": "6f9c3d7058017053e4946974ce26a9fa028189f0", "parents": [ "d3e7da323694cc9d942ce87e4d605799d8f97efe" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 15:12:15 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 15:12:15 2026 +0200" }, "message": "Memory paper: curator, and lineage on the read side\n\nRename the archivist to curator, the cross-industry term (digital\ncuration; the curated tier), and name the domain owner as the data\nsteward it works under.\n\nLineage gains computed read-side edges. A write or send records its\nsession and historian position, so its read set, including reads by\nits recall deputy and helpers, is a query over events already kept.\nCited edges are what the author asserts; informed-by edges are what\nthe service observed, and erasure, leaks, and poisoning use those.\nSends become events, so what left and what it was made from is\nanswerable.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "d3e7da323694cc9d942ce87e4d605799d8f97efe", "tree": "814792129cda045fc930084a3d269823c60ec077", "parents": [ "67997cdfe1bfc6fa9558c9fea798c6b6205f1d23" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 14:54:54 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 14:54:54 2026 +0200" }, "message": "Memory paper: the historian keeps lineage; no walls of text\n\nName the event log the historian, after process historians in\nindustrial control, and make lineage explicit: writes, reads, ledger\noperations, and curation are events, so who-derived-what and\nwho-read-what are queries over one ordered record. Reads become\ndurable events rather than telemetry only, which erasure propagation\nand declassification review already relied on. The archivist keeps\nthe collection; the historian records what happened.\n\nRewrite §8 for scanning: a task\u0027s life as a diagram, six rules with\ntheir reasons in one table, one short subsection per rule, a worked\nexample, taps as a list. The task schema moves to Appendix C, which is\nnow short bulleted subsections and a targets table. Long paragraphs\nelsewhere are split or turned into lists, and the abstract is shorter.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "67997cdfe1bfc6fa9558c9fea798c6b6205f1d23", "tree": "77d62b78525ef1de2ab9ba6dde8e96c2a59a13c0", "parents": [ "b0780587b0df8a76376603a5eaf79976d3a64103" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 13:32:17 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 13:32:17 2026 +0200" }, "message": "Memory paper: shorter, layered, why first; trust, identity, and safety\n\nRestructure the paper so it reads from a two-page overview down to\ndetail, with every section and role opening on why it exists. Body\nshrinks from about 14.5k to 10.5k words; ledger semantics and failure\nmodes move to appendices, and the closing summary goes.\n\nReader feedback addressed:\n- Safety leads alongside cost: the OpenAI and Hugging Face incident of\n July 2026, where models ran an ungoverned shared message board.\n- New §4 Trust and Handling: four separate labels, and rules that keep\n trust from passing along a chain (non-transitive, typed, no authority\n laundering through summaries).\n- Identity across org change follows RFC 4151: opaque permanent keys,\n names recorded with their dated authority.\n- Why the design measures tokens but does not build on their price.\n- The curation role is renamed archivist, with the reasoning given.\n- Attribution to Claude Fable 5 and Claude Opus 5.\n\nSection references in the case study follow the new numbering.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "b0780587b0df8a76376603a5eaf79976d3a64103", "tree": "23dfb85ffe0f794bb7999e5f8c6f5eec9f2e1cd3", "parents": [ "57d67d1533c2fa3060f705ba2558e9f7f87493ad" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 13:19:36 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 13:19:36 2026 +0200" }, "message": "PLAN: M19, WebAssembly per tool rather than as a rule\n\nDecided for M19\u0027s second cut: WASI stays for connectors the Foundation does not fully\ntrust, contributed ones, where its isolation is the point; a tool this project writes\nand trusts may be native in the tool server behind the same gate, the hosts, pinned\naddresses, credential and reached URLs being the server\u0027s either way. Fetch first.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "57d67d1533c2fa3060f705ba2558e9f7f87493ad", "tree": "4e864b37b69aee238471ffda79865e349147856f", "parents": [ "3a346b032170cf990df903568185319162d45172" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 13:17:12 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 13:17:12 2026 +0200" }, "message": "Merge PR #13 (paper-domains) onto the evaluation revision\n\nLinearized from a merge: this commit carries what the merge resolved.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "3a346b032170cf990df903568185319162d45172", "tree": "3cb8bfc778fa601596d4970db8faf4606d075bb7", "parents": [ "545b89d79f48b185bd73c8c3775c7acaada8c7ad" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 12:42:21 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 12:42:21 2026 +0200" }, "message": "M19 first cut: tools served by a tool server, called by a launcher that carries none\n\nA launcher in a managed environment should call its tools as services, not run their\ncomponents itself. The tool host\u0027s per-request decision becomes a Gate: the session\u0027s\npolicy in a launcher, or in a tool server a HostGate, which keeps the policy\u0027s hard\nrules (TLS, granted methods, nothing inward) and lets a host through only when both the\nserver\u0027s grant and the caller name it, so a caller narrows and never widens. Every\nrequest a gate allows is recorded.\n- `amem tool-server [--listen] [--token-env]` serves a root\u0027s installed tools over\n MCP\u0027s streamable HTTP; off loopback it refuses to start without a bearer token. Each\n answer carries the tool\u0027s JSON and the URLs it reached.\n- A grant\u0027s `hosted \u003d \"\u003curl\u003e\"` (https, or http on loopback) sends that tool\u0027s calls to\n a tool server, with the hosts this session may reach at its label\n (Memory::fetch_hosts); its `credential` is then the server\u0027s bearer.\n- The launcher decides every reported URL by its own policy (Memory::check_reached)\n and refuses an answer that names none or names one the policy refuses; what it keeps\n is a source observed by `tool-server`.\ncrates/memory/tests/hosted.rs proves it with the real fetch component and processes:\nan answer with the token, none without, nothing for a session whose hosts leave the\npage out, a redirect off the server\u0027s grant refused there, and a fake server naming a\nforbidden host, or none, not believed. Not yet: routing these calls through the egress\nfor metering, keeping the reached URLs on the source, and registration in llmao\u0027s MCP\nregistry (#25). PLAN.md\u0027s M19 and the README say so.\n\nAlso: the conformance self-test\u0027s fake server timed leases on the wall clock, so a WSL2\nclock step under load let its heartbeat-noop defect pass undetected (it failed one\ncommit hook here, and passed five runs alone); it now times them on the monotonic clock.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "545b89d79f48b185bd73c8c3775c7acaada8c7ad", "tree": "ab93d6fd3e36e003f4d86653756a85f1954c2ba8", "parents": [ "2a5f9614ada95a193f7f757a4672adcb6c66f465" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 10:13:18 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 10:13:18 2026 +0200" }, "message": "PLAN: M19, tools hosted rather than carried, for a launcher in a managed environment\n\nThe WASI components suit a laptop; a managed deployment should host the tools and the\nlauncher call them. Planned behind the existing `sources::Tools` seam: `amem\ntool-server` serving the same components over MCP for the gateway\u0027s registry, a\n`HostedTools` backend in the launcher reached through the egress and chosen per tool in\nthe grants, and the guarantees kept at the memory server, with the one that moves,\nper-request control inside the tool, carried by passing the session\u0027s allowed hosts and\nrequiring the reached URLs back. Proven locally first; deployed once llmao\u0027s registry\n(#25) takes servers.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "2a5f9614ada95a193f7f757a4672adcb6c66f465", "tree": "53e086c480e46dc6cb67024f638c9b8b13ee352f", "parents": [ "68f2c6411393d4cb563e4d9997a44cb2fad1273f" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 10:08:01 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 10:08:01 2026 +0200" }, "message": "PLAN: M18, Anthropic\u0027s memory tool on the memory server, and a FUSE rung for the projection\n\nA candidate, not built: the Claude API\u0027s client-side memory tool maps command for\ncommand onto the memory server (view /memories is T0, view a file is get, create a raw\nwrite through the gates, edits new versions, delete a tombstone, the progress protocol\nthe handoff), first as a backend for the SDKs\u0027 memory helpers; for Claude API agents,\nnot the harnesses here or the gateway\u0027s open models. Beside it, the projection\u0027s second\nrung as a live FUSE mount through the server, which would observe every read whatever\ntool made it and gate every write, after a register decision on \"project, never mount\".\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "68f2c6411393d4cb563e4d9997a44cb2fad1273f", "tree": "10cb369bef034cfeaf2ab7f2630c3ec46c132a49", "parents": [ "844a5f93071fa4a3e605f115f0a81e058371eb27" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 09:31:09 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 09:31:09 2026 +0200" }, "message": "docs: where LiteLLM\u0027s own memory and llmao stand, 12 October\n\nA section a reviewer at llmao will want first: LiteLLM\u0027s `/v1/memory` is a key-value\nstore scoped to user and team, read by nothing at inference, and admin-only on the\ngateway today (401 with a PAT on 1.102.2); the gateway-side memory BerriAI built,\ninjected tools and hidden rounds, was closed unmerged on 12 September and 4 October,\nand went the opposite way from this design; its MCP registry is what proposal 5 builds\non. And what llmao did since 266122c, per proposal: nothing yet on trace or session,\nthe Models page but not /v1/models, compatibility by documentation rather than in the\ngateway, and the open issues where the rest would land (#25 MCP registration, #43\nmetrics, #44 config snippets, PR #51).\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "844a5f93071fa4a3e605f115f0a81e058371eb27", "tree": "12445d8e3351630ed2e9fcd8b4fc6f58747ebd0d", "parents": [ "3e6251b556f2a0693120cf75f0f14018831cb632" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 03:25:10 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 03:25:10 2026 +0200" }, "message": "Demo: four new acts, the platform, re-enactment, a tap and the record moving\n\nWhat was built and shown in no act now has one, each run live in a full eleven-act run\non 12 October (about 21 minutes, every act passing):\n- 7, The platform: agent:architect proposes an agent definition, a recall suite and a\n default model as artifacts in a platform domain; raw, they don\u0027t load; verified by\n the owner, they do, and the agent\u0027s rewrite of the definition is held. Codex, launched\n with no model, runs on the one the platform names, with the definition in its prompt,\n and its handoff ends with the definition\u0027s line; the suite is scored from the\n platform; and the run\u0027s cost is shown in every resource kept: wall clock, CPU in the\n sandbox and the launcher, peak memory, time waiting on model calls, tokens.\n- 8, Run it again: an act 6 session re-enacted from its tape on its own model, as a\n control, and on gemma4-26b, scored by how its calls and tools kept to the tape. The\n first run of re-enactment against a real harness, and it held.\n- 9, From outside: the GitHub issues tap files apache/tooling-trusted-releases\u0027 open\n issues as proposed tasks under a grant that reaches api.github.com alone, with no\n credential; a second run files nothing; a person admits one.\n- 10, The record moves: the event log by id and digest, the index rebuilt from it, an\n export at the public and internal labels, an import under another owner, and an\n erasure there that refuses the same text when the bundle is imported again.\n- 11 is the limits, the close, as act 7 was.\ndocs/demo-narrative.md covers the new acts with this run\u0027s figures, and acts 1 to 6\u0027s\nchanged ones, through a reader test and a fact-check against the transcript; the README\nlists the acts, says act 9 needs api.github.com and that act 7 adds a domain, and no\nlonger says re-enactment has never met a real harness.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "3e6251b556f2a0693120cf75f0f14018831cb632", "tree": "50e6fc63b053f93c35b407979923ba1aeab155cb", "parents": [ "d41543ef4430ad7c65ebdf505b065c7439603f35" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 02:36:48 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 02:36:48 2026 +0200" }, "message": "Costing beyond tokens: each call timed, each run\u0027s wall clock, CPU and memory kept\n\nThe paper\u0027s price vector (§12) counts compute time and memory as resource classes\nbeside tokens; only tokens, cache and calls were metered. Now:\n- The egress times each call it forwards, start to end, as `latency_ms` beside its\n tokens (migrated into older logs as unknown, not zero); `amem usage` shows ms per call.\n- The launcher keeps each run of a harness in a `runs` table: harness, runner, task,\n exit code, wall clock, and the CPU time, user and system, and peak resident memory of\n the process tree it confined, as `wait4` counted them when it reaped the run (the\n harness, its tools and the memory server inside, each level reaping its children),\n and its own CPU over the run, the egress among it, from getrusage. crates/sandbox\u0027s\n new `measure` does it for both backends (checked to build for macOS) and for an\n unconfined run; a run handed to a container host keeps its wall clock only, and says so.\n- `amem cost` adds host resources per session and gives each completed task its share\n of its session\u0027s wall clock and CPU, as of its money; `prices.toml` gains\n `[resources]`, per CPU-hour and per GiB-hour of peak memory over the wall clock.\n- scripts/eval.py measures every condition the same way, `wait4` on its process tree in\n a session of its own, and reports CPU and peak memory beside tokens and seconds; a\n timeout now kills the whole tree, not only its first process.\nPLAN.md\u0027s M17 says what is not yet: a task\u0027s own claim-to-completion time, accelerator\ntime, bytes stored, and limits, which want a cgroup per run. The README\u0027s not-built\nlist says the same.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "d41543ef4430ad7c65ebdf505b065c7439603f35", "tree": "3f860e9a2e91e2e395286c1b082d247934bf5293", "parents": [ "4336fe514a07a0391a7b9eac5bcd5fea0b1eb351" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 02:12:57 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 02:12:57 2026 +0200" }, "message": "A task that delegated waits on its continuation, and closes when it does\n\nAct 4 showed the gap: a run that delegates is released, its task back in the pool as\nclaimable as any, so a worker could take it and do the comparison again while its\nsubagents and continuation did it once already; and when the continuation completed,\nnothing closed it. The continuation is the rest of the task\u0027s work, titled \"Resume:\"\nwith its body, so it is the task\u0027s successor, and the ledger now treats it as one:\n- A task with an open continuation (origin `continues:\u003cid\u003e`, neither completed nor\n invalidated) is not claimable, by claim_next or by name, on SQLite and PostgreSQL. It\n stays admitted and on the board.\n- Ledger::complete_by_continuation closes such a task when the continuation completes,\n with the continuation\u0027s handoff, unless a holder with a live lease has it; and the\n server\u0027s complete walks up the chain, so a continuation of a continuation closes both.\n- A continuation invalidated without a successor leaves the task claimable again; one\n folded into a successor does not, since the successor is open.\nTests on both backends for the wait, the close and the dead end, and a server test of a\ntwo-level chain. Act 4 prints the original task\u0027s state after 4.4 (waiting) and 4.6\n(closed by its continuation); the narrative, README and PLAN\u0027s M5d say so.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "4336fe514a07a0391a7b9eac5bcd5fea0b1eb351", "tree": "3bd0c1297235b3ac11b044ece8ceb8c58bc28758", "parents": [ "9706f3811a20bba3e1f1fcb330a4e1d3254b59d9" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 01:56:31 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 01:56:31 2026 +0200" }, "message": "README: brought up to what is built, and what is not, as of 12 October\n\nAn audit of every claim against the code, PLAN.md and the commits since d5492a7:\n- Status no longer says every part ran live: the Gofannon bridge and the search tool\n have met only fakes, Seatbelt no Mac, re-enactment no real harness.\n- The not-built list gains costing beyond tokens: only tokens, cache and calls are\n metered; no session or task duration, call latency, CPU time, memory, accelerator time\n or bytes stored, which the paper\u0027s price vector counts, and no CPU or memory limits.\n \"Drift beyond metadata\" is \"Drift over many runs\", since the detectors already read\n answers; Gofannon\u0027s own model calls are named as unmetered.\n- ten harnesses, not seven, and Seatbelt as a backend; `state/` holds the event log,\n which is not rebuildable, and re-enactment\u0027s runs; `.tapes` in the record;\n `[taps.\u003cname\u003e]` and `platform` in the grants.\n- The parts table gains the event log and the platform, and reenact\u0027s subcommands; the\n evaluation\u0027s four conditions and many harnesses; the layout\u0027s sandbox, server, taps,\n image and docs rows; the hook\u0027s docs-only path and verify\u0027s coverage floor.\n- The demo: act titles as the run prints them, act 4 as it is (the delegating task stays\n open), the narrative linked, and DEMO_FROM\u0027s default and what it needs.\nAct 7 reads the two lists by their headings and bold names, both kept. The Makefile\u0027s\ncomment on ACTS said six acts were the default; it is all seven.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "9706f3811a20bba3e1f1fcb330a4e1d3254b59d9", "tree": "1d369a30d71a9565f73a0149cadeeaa11bb1cc09", "parents": [ "380f25136861d47381783913ceff6263b336d2da" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 01:54:53 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Mon Oct 12 01:54:53 2026 +0200" }, "message": "make verify passes again: the model-driven commands tested end to end, and a flaky sweep\n\nLine coverage had fallen to 88.2%, under the 90% floor, since the weekend\u0027s model-driven\ncode went in with `make check` as the only gate: curation.rs was 7% covered, checker.rs\n16%, librarian.rs 32%, replay.rs 42%. crates/memory/tests/curation.rs runs them through\nthe binary against a fake gateway that answers each kind of question the way its parser\nexpects (the checker\u0027s verdict, a contradiction, the quarantine reader\u0027s word, a drift\nprobe) and can be repointed, as a vendor swapping the model behind a name would look:\n- a curation cycle finds what the record plants (a summary its body contradicts, two\n decisions at odds, a write to agents held in quarantine, a poor summary, a duplicate\n title, a `file:` source changed since), files each once, and a second cycle on the\n repointed model fires the drift probes;\n- the checker alone reports, files, and files nothing twice; the librarian surveys;\n- drift probes stay quiet on one model and fire on another;\n- replay resends a session\u0027s recorded contexts and agrees with the same model.\nCoverage is 91.6%.\n\nThe transcripts test an_excerpt_erased_here_or_out_of_shape_does_not_come_back failed\nonce under coverage and not in thirty runs since: its fixture swept at now_utc() moments\nafter keeping the transcript, with retention at zero days, so a host clock that steps\nback (WSL2 does when it resyncs) left nothing swept. It sweeps a minute on now.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "380f25136861d47381783913ceff6263b336d2da", "tree": "324342efea5872f31a7e32720791fea60bca5d02", "parents": [ "83a218b7bd34d6c17d85d02c4665266c7a28a2ca" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 22:47:00 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 22:47:00 2026 +0200" }, "message": "make verify: machete takes dm-ledger\u0027s postgresql_archive as the pin it is\n\ndm-ledger declares postgresql_archive only to hold it at 0.20.0, the version whose reqwest\nthe egress can live with; nothing imports it, so cargo machete called it unused and\n`make verify` has stopped there since the PostgreSQL ledger landed (c297002, 10 October).\nCI would have said so, but its jobs have not started since the account\u0027s spending limit\nwas reached. The pin is now listed in [package.metadata.cargo-machete].\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "83a218b7bd34d6c17d85d02c4665266c7a28a2ca", "tree": "7b9734616dd5209f1eee28f90bad0934d63d0009", "parents": [ "ee207a03e7e796fa9c61e1a286a3198baefae9a4" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 20:47:14 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 20:47:14 2026 +0200" }, "message": "Demo: a narrative that matches a run, and three fixes a full run found\n\ndocs/demo-narrative.md, reader-tested four more times and fact-checked against a fresh\nfull run, whose figures it now gives throughout. It says what act 4 really does: each\nAgent call is caught and filed as a task with a follow-up, the follow-ups fold into one,\nand the original task goes back to the board, where it stays open and could be worked\nagain. It also defines harness, gateway, the paper and \"held\", says which calls go\nthrough the egress and that fetches don\u0027t, gives every figure a scale, and says which\nresults vary from run to run.\n\nFixes:\n- 5.1 counted no spans: the sink keeps raw protobuf, where a span name can run into the\n next field\u0027s tag byte, often a digit, so grep -w missed every one. Names are now\n matched by what may not continue them, still skipping task.created_by.\n- 5.4 and 5.5 took the alphabetically last transcript, a random pick since session ids\n are random. They now take the latest of this harness\u0027s sessions with a cited turn,\n act 4\u0027s delegating session, whose turns the hook\u0027s session-end note cites.\n- Act 6\u0027s dr19-decision pattern passed a refusal (\"no decision entries recorded\"). It\n now needs the record\u0027s answer; every saved answer since 9 October grades the same,\n except that false pass.\n- Act 3 calls gemma4-26b the checker, as act 2 does, rather than \"the reader\", which\n clashed with agent:reader; 3.3\u0027s heading is \"The checker\u0027s verdicts\".\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "ee207a03e7e796fa9c61e1a286a3198baefae9a4", "tree": "61f4f2538cc94c983c9c3c2d00e66d6428188285", "parents": [ "e235c18a3cab420e1d2167e61f140c273e794039" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 19:29:48 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 19:29:48 2026 +0200" }, "message": "Demo: who acts in each act, fixes from a proofread, and a narrative\n\nEach act\u0027s header now names its actors: you, the real sessions and the model each runs\non, the scripted agents (no model behind them), and the parts of the system that act.\nFixes a proofread against a full run found: the erasure receipt printed as cut-off JSON\nand now reads as a few lines (scripts/demo/receipt.py); 3.3\u0027s second list is labelled as\nthe owner\u0027s queue; 3.8 says the crossing call still goes out and the next is refused;\n4.6 no longer claims the original task completes (it stays on the board, which is\ntoday\u0027s design); the span counter in 5.1 matched attribute names too and now counts\nwhole names; 5.4 no longer claims its search found entries.\n\ndocs/demo-narrative.md: cues for the presenter and a handout, keyed to the step numbers,\nproofread for accuracy against the run and for tone. A reader test found a few more\ngaps, listed in the next session\u0027s handoff.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "e235c18a3cab420e1d2167e61f140c273e794039", "tree": "256fd534cf134365431b84fa2ee227fc5788beeb", "parents": [ "470954551515931a15c251091d49054b7a33c281" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 18:23:47 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 18:23:47 2026 +0200" }, "message": "Demo: each act and step says what it shows; a transcript; old records caught\n\nEach act opens with a heavy rule, its number and title, and a short paragraph on what it\nshows; each step with a light rule, a number (2.3) and a sentence or two\n(scripts/demo/show.sh, used by act 1 and the rest). The run opens with a header: when,\nthe commit, the harness, the record, the acts. `make demo-all TRANSCRIPT\u003d\u003cfile\u003e` also\nwrites the whole run there as plain text, the run\u0027s exit code kept, so it can be read\nback with a narrative. Bold only on a terminal.\n\nAct 2 crashed with StopIteration on a record an older demo made (3 October): its\ndom-demo has no admit_own, so the curation tasks stayed proposed and none was there to\nclaim. demo-ready now reports such a record and points at RESET\u003d1, which now takes any\nrecord holding dom-demo but never MEMORY_ROOT\u0027s, and act 2 says so instead of crashing.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "470954551515931a15c251091d49054b7a33c281", "tree": "935ff9942a7957933be43ebf87f30f8739cff778", "parents": [ "3546c95eab294e873b3eb4153c304ba7c8f314f1" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 16:22:00 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 16:22:00 2026 +0200" }, "message": "make demo-ready: get the demo to a state it can run, and say what is missing\n\nscripts/demo-ready.sh seeds the record when there is none (RESET\u003d1 starts a demo record\nover, and refuses any record whose owner is not human:demo:), builds the harness image\nwhen the one unpacked is not the pinned Claude Code and unpacks it into the record, checks\nthat the gateway answers with the key in local/.virtual-key, shows the logins amem doctor\nfinds (HARNESS\u003d insists on one), and ends with the command to run, or the lines to fix.\n\nmake local-up and local-down now check first that podman can run: in a WSL shell with no\nlogin session /run/user/\u003cuid\u003e does not exist, and podman failed with \"mkdir\n/run/user/1000: permission denied\". They say the one-time fix, sudo loginctl\nenable-linger, instead. The demo itself needs no podman where wslc.exe builds the image.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "3546c95eab294e873b3eb4153c304ba7c8f314f1", "tree": "fcf7209298ab0fc8626b79f5a3f49e410ca5c207", "parents": [ "fce0f8dd9445c03d038149b6660cec904e0b6e3a" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 05:39:22 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 05:39:22 2026 +0200" }, "message": "Eval: read a launched session\u0027s transcript from the record\n\nSince 99901af a session\u0027s end takes the transcript the record keeps out of the\nharness\u0027s private home, and scripts/eval.py read token counts from that copy afterwards:\nthe rehearsal of act 6 on the bumped image printed \"no transcript\" for every run. It now\nreads the record\u0027s copy by the session id the launch announced, in the record or the\nempty one, and the home only as a fallback. Rehearsed: codex on qwen3.8-27b, memory 4/4,\nempty 0/4, tokens read for all eight.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "fce0f8dd9445c03d038149b6660cec904e0b6e3a", "tree": "3181fbb311fa344cdb6791f4a835fbd37b314627", "parents": [ "a1a35433ec08a504bb6011973ca0d5a31b7d7e4e" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 05:28:22 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 05:28:22 2026 +0200" }, "message": "Harness pins bumped after the demo, and the bump asks the registry without npm\n\nClaude Code 2.1.287 -\u003e 2.1.296, Codex 0.160.0 -\u003e 0.162.1, Gemini CLI 0.62.0 -\u003e 0.63.0,\nCopilot 1.0.91 -\u003e 1.0.95, OpenCode 1.18.34 -\u003e 1.19.0, Qwen Code 0.24.7 -\u003e 0.25.0, Grok\n1.0.46 -\u003e 1.0.50, pi 1.0.4 -\u003e 1.1.0, held for the demo until now. The image was rebuilt\nand unpacked, and the installed versions read back from the rootfs. The bump script\nneeded npm; where there is none it now asks registry.npmjs.org for the latest version.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "a1a35433ec08a504bb6011973ca0d5a31b7d7e4e", "tree": "0b4dbb41499fd8a4007db9d6ecc0e15c5a0e7e3d", "parents": [ "3472ed0db1548fd64075c2eaecddd583171f659d" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 05:16:55 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 05:16:55 2026 +0200" }, "message": "The platform as a domain: artifacts in memory, loaded only once verified\n\n`platform \u003d \"\u003cdomain\u003e\"` in the grants names a domain the owner holds whose entries carry\nthe fleet\u0027s configuration as artifacts, fenced blocks with the info string\n`platform \u003ckind\u003e \u003cname\u003e`:\n\n- agent: instructions added to a harness\u0027s task prompt (named for the harness, or default)\n- template: `work`, the opening of the task prompt, in place of the launcher\u0027s own\n- eval: a golden suite, scored with `amem golden --platform \u003cname\u003e`\n- harness: JSON; its `model` is the default when a launch names none\n\nAn artifact loads only from an active entry a person verified, the newest winning, as a\npolicy rule is enforced only once verified: an agent cannot write the instructions the\nnext agent runs under. `amem platform list` shows every artifact and why each that does\nnot load does not; `amem platform show \u003ckind\u003e \u003cname\u003e` the one that does. A platform that\nnames a domain the owner does not hold is refused when the grants are read.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "3472ed0db1548fd64075c2eaecddd583171f659d", "tree": "223aaf05200825a52d03b80d95cc1f6e6100617a", "parents": [ "90d6b94ade5d67e607c915d254d0a03356cfdc53" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 05:10:39 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 05:10:39 2026 +0200" }, "message": "Re-enactment: what the adversarial pass found, fixed\n\nA fresh reviewer attacked 1f7b66e. Fixed:\n\n- A recorded result above the re-run\u0027s handling was served all the same; it is now a\n miss, the divergence, and the live path refuses it as the filter would.\n- Git ran on the host against a tree the confined harness can write, in the launcher\u0027s\n environment: a planted fsmonitor or post-checkout hook ran with its credentials. Git now\n runs with a cleared environment, hooks and fsmonitor off; a test plants both.\n- `--backend wslc` ran the re-run unconfined; it is refused.\n- Erasure missed tape calls whose body was under 24 characters, and summaries and titles;\n it now matches the entry\u0027s id too.\n- The run\u0027s home, with a login\u0027s copy and a transcript, was never removed; it goes with\n the run, and a session\u0027s run reports go with its tape\u0027s sweep.\n- The checkout was a git worktree whose `.git` pointed outside the sandbox\u0027s mounts; it is\n a hardlinked clone of its own, named for the session, pid and run.\n- One torn tape header stopped every sweep and listing; it is passed over.\n- `--auth` must be said every time, so a loop does not repeat subscription runs unawares.\n- A tool the server lacks is answered by the router after a divergence, as before.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "90d6b94ade5d67e607c915d254d0a03356cfdc53", "tree": "04a349948a8c17b13fc71bf9078a2bc0d37958df", "parents": [ "8a183ab3b536ececbe8d990ed5b27f51ea7285a1" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 05:03:53 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 05:03:53 2026 +0200" }, "message": "The Gofannon bridge: its deployed agents as a tool, and a worker on the ledger\n\nGofannon (apache/tooling-gofannon) serves its deployed agents over REST: GET\n/deployments, POST /rest/\u003cname\u003e/start (a run id), GET /runs/\u003cid\u003e, POST /runs/\u003cid\u003e/stop.\nA `gofannon` tool tap (taps/gofannon) speaks those as agents, run, start, status and stop,\non the memory server\u0027s MCP surface: every request decided by the policy at the session\u0027s\nlabel, results scanned and kept as sources. Gofannon authenticates by its session cookie\nonly; the grant names the variable and the Cookie header, and the host puts it on, so the\ntap never holds it. A tool grant may now be `fresh`: its answers are kept as sources but\nnever answered from, as a run\u0027s state must not be.\n\n`amem gofannon work \u003cagent\u003e` claims a task, starts the agent on it with the task in a\nnamed input field, keeps the lease while the run goes, and files what it returned as the\ntask\u0027s handoff, completing it, or releases the task with why. `amem gofannon agents`\nlists what is deployed. Proven against a fake of the four routes, the cookie on every\nrequest and nothing sent from a session above the tool\u0027s ceiling. Gofannon\u0027s own model\ncalls are not metered here, and a scoped machine credential is still to be asked of it.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "8a183ab3b536ececbe8d990ed5b27f51ea7285a1", "tree": "ad37e985d081e99cb92bbb487c78454ab28a7236", "parents": [ "f0c64149c20d8dab070f776a272277ec292418ec" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 04:57:16 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 04:57:16 2026 +0200" }, "message": "The event log: every entry write through its domain\u0027s log, and a materializer\n\nThe paper\u0027s source of truth is a log per domain, with the record, the index and the\nledger as projections. Here, in its smallest real form: every write of an entry (each\nversion, demotion, promotion, supersession, import and erasure) is appended to its\ndomain\u0027s log before the record takes it, state/log/\u003cdomain\u003e.jsonl, a sequence number per\ndomain, one writer per domain behind an exclusive file lock. The log carries ids and\ndigests, never bodies, so an erasure needs no log rewrite.\n\n`amem log materialize` is the domain\u0027s one materializer: it rebuilds the domain\u0027s part\nof the index from the log and the record (dm-index gains rebuild_domain), reports an\nentry the record holds at another version than the log names, and replays the ledger\u0027s\nevents into its projection. `amem log show` reads the log, the owner\u0027s.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "f0c64149c20d8dab070f776a272277ec292418ec", "tree": "fbb6f51fa147c6b42a55250e3078d12ab56230eb", "parents": [ "a87cf78aa6e32e5352915af263a06b5d8fd6820b" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 04:39:56 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 04:49:56 2026 +0200" }, "message": "macOS: Seatbelt confinement, dry-coded, with where things sit inside a property of the backend\n\nmacOS has no mount namespace, so a plan there has to put the private home, the socket, the\nmemory binary and the projection at their host paths, and write the harness\u0027s\nconfiguration against them. Where the plan puts things is now a Layout, carried on the\nPlan: Layout::namespaces() is the INSIDE_* constants, as before, and Layout::seatbelt()\nhas everything at its host path, TMPDIR under the private home, and the relay on a\nloopback port the launcher picks per session. prepare() is prepare_in() with the\nnamespaces layout; every adapter takes the memory binary and the home from the layout,\nand a hook command quotes the binary\u0027s path when a shell would split it. Every plan the\nnamespaces backend makes is byte-for-byte what it was: 132 plans across every harness,\nauth mode, image and rootfs, dumped before and after, mounts, environment, command and\nevery file written, diff clean.\n\ndm_sandbox::seatbelt::profile is a pure function from a Seatbelt plan to the SBPL text:\ndeny by default; fork, exec and a few named system services; a handful of devices; the\nsystem read-only; metadata only for the directories on the way to a grant; the harness\u0027s\ninstall, the memory binary and the projection read-only; the private home and the working\ntree read-write; no network but the egress socket and the relay\u0027s port. Paths are escaped\nas SBPL strings; a relative path, a . or .. component, a grant of the host\u0027s home or of\nanything above it, and a relay off loopback are refused. On macOS run() resolves the\ngrants (/tmp to /private/tmp) and runs the plan under sandbox-exec -p. The launcher\u0027s auto\nbackend is Seatbelt on macOS, and --backend seatbelt names it; --unconfined is unchanged.\n\nNot yet run on a Mac. The profile\u0027s tests run everywhere; the two that run sandbox-exec, a\nconfined read and write inside and outside a grant, compile only on macOS, where CI\u0027s\ntest (macos) job runs them. PLAN.md\u0027s M8 row says what waits for one.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "a87cf78aa6e32e5352915af263a06b5d8fd6820b", "tree": "481d4631a8fd88d8c6fb96e4e88ce5f3b72dd056", "parents": [ "962ba069e3be8899c372e16463fb9467bf763bbd" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 04:48:10 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 04:48:10 2026 +0200" }, "message": "Re-enactment: a session run again at its commit against the tape of its memory calls\n\nThe paper\u0027s live re-execution, for comparing harness versions or models on the same\ntask. Not a copy of the root: search ranks against the whole corpus, the ledger moves,\nand a copy does not scale. A tape instead.\n\nEvery memory tool call a harness makes is kept on its session\u0027s tape with its full\nresult (record/\u003cdomain\u003e/.tapes/\u003csession\u003e/), owner-only, on the transcripts\u0027 clock unless\npinned for a benchmark, and erased with an entry\u0027s body as decision contexts are. The MCP\nserver\u0027s call_tool is written by hand to do it, and the launcher\u0027s own in-process calls\nstay off the tape. A prompted launch heads the tape with its prompt, harness, model and\nthe working tree\u0027s commit.\n\n`amem reenact run \u003csession\u003e` starts the harness on that prompt in a detached checkout of\nthat commit beside the repository, confined as a launch is, with a private home of its\nown. Each call that matches the tape by tool, arguments and occurrence gets the recorded\nresult and writes nothing; the first that does not is the first divergence, after which\na read is served as the record is now, a write is captured for the report, and a call\noutside is refused. A re-run keeps no tape and no decision contexts of its own, and\nnothing is substituted into the harness\u0027s model calls. The report gives steps to the\nfirst divergence, the tool sequences\u0027 alignment, the exit, whether a handoff was left,\ntokens and time; `amem reenact report` puts each harness and model on a line. Repeated\nruns refuse a subscription login, as the terms checked on 11 October ask. `amem reenact\ntapes|show|pin|unpin` for the owner.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "962ba069e3be8899c372e16463fb9467bf763bbd", "tree": "3abf9223e716dd8b695b78243157e1486fc60621", "parents": [ "20599edb38ea719aa05e12f6ed82f6fde0c1407d" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 04:27:50 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 04:27:50 2026 +0200" }, "message": "Savings: the paper\u0027s judge of \"used\", on a sample, beside the citation rule\n\nThe wasted-read ratio took \"used\" to be \"cited by id in the handoff\", which needs no\nmodel and undercounts what a session relied on without naming it. The paper samples a\ncheap-model judge. `amem savings --judge-provider \u003cdest\u003e` now runs one: a deterministic\nsample of what sessions with a handoff opened (--judge-sample, 20 by default), each entry\nread beside the session\u0027s handoffs by a small model through the egress, answering\n{\"used\", \"why\"}. The report gives the judged wasted-read ratio and how often the citation\nrule agrees with the judge; a call that fails or an answer that does not parse is a read\nnot judged, and is counted as such.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "20599edb38ea719aa05e12f6ed82f6fde0c1407d", "tree": "5b797621917e20a1a04dfa336739115dd8814ac4", "parents": [ "96549f02f4d8115cc338d4171b29e1dbc2a076bd" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 04:23:15 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 04:23:15 2026 +0200" }, "message": "Tools: connect to the checked address, release a held answer, and an end-to-end test\n\nThe tool host resolved a name for the policy and again when the request connected, so a\nname that answered outward to the check and inward to the connect got through. The\nrequest now connects to the addresses the policy was shown (dm_taps::pinned), with TLS\nstill verifying the certificate against the name in the URL; a name that resolves to\nnothing sends nothing.\n\nA held answer had no way out but the sweep. `amem source release \u003cid\u003e` (the owner only)\nlets it be served from then on, with what the scan found and that the owner released\nit, and the release is a line in state/sources.jsonl.\n\ncrates/taps/tests/tools.rs runs the real fetch and search components through use_tool\nagainst a fake site on loopback: a page as text, kept and answered from its source; a\nredirect to a name off the grant refused before it leaves; a session that read above the\nceiling sending nothing; an answer with instructions held, refused to an agent\u0027s release,\nserved after the owner\u0027s; and search\u0027s credential in the header its grant names.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "96549f02f4d8115cc338d4171b29e1dbc2a076bd", "tree": "30c9908fa1025ab8c87e1725d2b17c03437de608", "parents": [ "890d10b56bf479dc57a73d6aa830532cb437997a" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 04:16:29 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 04:16:29 2026 +0200" }, "message": "Import restores the transcript excerpts a bundle carries\n\nAn export wrote excerpts/\u003centry\u003e/\u003csession\u003e.\u003cturn\u003e.json beside its entries and an import\nignored them. Now the import reads and checks them before writing anything (plain names,\nno links, a body naming the entry and turn its path does; one bad excerpt refuses the\nbundle whole), reports each bundle id\u0027s landed id, and writes each excerpt under the id\nits entry landed under, at the higher of its label and the domain\u0027s default. One whose\ntext is on an erasure receipt here, or whose transcript this record erased, is skipped.\nThe transcript each names gets a swept header holding only these excerpts, or the header\nalready here takes them in, so transcript_turn finds them as it finds a sweep\u0027s.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "890d10b56bf479dc57a73d6aa830532cb437997a", "tree": "2d9c0ffb2eff7929ce6f66ba85896ea0004b16b6", "parents": [ "118fb8091a7f3cbd19aa316ca2af9dae20bc95fe" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 04:11:22 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 04:11:22 2026 +0200" }, "message": "A session\u0027s end takes the transcripts the record keeps out of the harness\u0027s home\n\nSession::finish, after mining has read the home\u0027s copy, removes each transcript this\nsession kept in the record: only a regular file inside the private home, named by an\norigin the record holds live, no link on the way. The record is where a transcript lives\nfrom there, on its clock and under erasure; a copy left behind outlived both.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "118fb8091a7f3cbd19aa316ca2af9dae20bc95fe", "tree": "61158bdffe177e56463c2287168bc5e946b0db3b", "parents": [ "2aafe597526d6e85880d72a8ce5f90183dd46313" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 03:36:36 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 03:36:36 2026 +0200" }, "message": "README: the tools\u0027 open gaps in the not-built list\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "2aafe597526d6e85880d72a8ce5f90183dd46313", "tree": "4741f7bede1f4970faad40c64b2f1adfdd166ff7", "parents": [ "a5f3f130673cd60ef5ead777cf46679860e44391" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 03:16:02 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 03:16:02 2026 +0200" }, "message": "Act 5 replays the harness session it just showed\n\nThe rehearsal running alongside picked the newest session with recorded calls,\nwhich was act 5\u0027s own drift probes: four plain replies that agreed trivially.\nThe replay now takes the session whose transcript the act just showed, a harness\nat work; a native Claude session\u0027s calls go to the gateway now that replay\nretargets them.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "a5f3f130673cd60ef5ead777cf46679860e44391", "tree": "834413e727b24634a7ed3758c335b6b7be48c10d", "parents": [ "da1d14eaf7b0bd64d06bc87b0a1bb1d48bbbf315" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 03:14:16 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 03:14:16 2026 +0200" }, "message": "Fetch in act 3; a native Claude session replays on the gateway\n\nAct 3 now shows the fetch tool: an agent fetches a docs.python.org page while it\nhas read only public entries, is refused a host off the grant, reads an internal\nentry, is then refused docs.python.org on the label rule while apache.org, a\ntrusted host, still answers, and gets the first page again from its source with\nnothing sent; the decision log shows one line per request. The demo\u0027s MCP helper\ngets a `steps` mode that goes on past a refusal and prints each call.\n\nRunning it found a panic in tap-fetch: a run of text that starts with a\nmulti-byte character, a pilcrow on docs.python.org, was stepped past by one byte.\nIt steps by the character now, with a test.\n\nReplay: when a session\u0027s calls went to a destination this replay cannot reach and\nthe replay runs on the gateway, they are sent there unchanged but for the model,\nsince the gateway speaks every API a harness here records. A native Claude Code\nsession, recorded on a subscription, replays on the gateway\u0027s Qwen; the run says\nretargeted_from. Live: four calls, two steps agreed. Elsewhere the replay refuses\nand names where to replay. The egress\u0027s direct calls now go through the same\nrequest shaping as its proxy, so a replayed Claude request has its late system\nmessage folded for the gateway as it would live. Act 5 replays the newest\nsession again, whatever its destination, and says when it was retargeted.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "da1d14eaf7b0bd64d06bc87b0a1bb1d48bbbf315", "tree": "ce1145a5dc4830b864ad23461004a2385eb6dd8b", "parents": [ "da62f60e6604a795e407370ace7e24e3bf262f33" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 02:58:16 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 02:58:16 2026 +0200" }, "message": "docs: potential implementation details for each llm.apache.org proposal\n\nEach proposal now ends with how it could be done, naming the proxy\u0027s own setting\nwhere there is one: the OTel callback and a collector that keeps internal spans\nout; litellm_session_id and tags behind a baggage-mapping hook, key limits, and a\nsession token as a short-lived virtual key; model removal driven by llmao\u0027s own\nhealth loop, versions in model_info, logprobs through drop_params; one pre-call\nhook for the four harness fixes; and the MCP gateway\u0027s servers and object\npermissions, with pinned definitions and labels as llmao code. Setting names are\nto be checked against the version the gateway runs.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "da62f60e6604a795e407370ace7e24e3bf262f33", "tree": "d649752c66139060722f8b25557472245ff482b5", "parents": [ "ef74f3aedd0f6b732db446e333745741f043fb7b" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 02:56:34 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 02:56:34 2026 +0200" }, "message": "Tools: fetch and search as taps an agent calls, every request decided by the policy\n\nA confined harness has no network, and the vendors\u0027 web tools silently do nothing\non the gateway\u0027s open models. Fetch and search are now taps in a second WIT world,\n`tool`: one synchronous call, outbound HTTP and nothing else, hosted by the\nlauncher outside the sandbox and called through the memory server\u0027s new MCP\ntools, `fetch` and `web_search`, or by the owner with `amem tool`.\n\nEvery request a tool makes, each redirect hop its own, asks the policy\u0027s new\n`fetch` action before it leaves, and is logged. Hard rules, no exception: https,\na granted method, a tap granted as a tool, and no host resolving inward\n(loopback, private, link-local, shared; the metadata address among them). Then\nreach, a built-in denial an exception can lift for one task: the host must match\nthe tool\u0027s grant, `*.apache.org` as a pattern, at most at the ceiling of the\nhosts matched, since a URL or a query from a session that read internal entries\ncarries them out; `trusted` hosts take a higher ceiling. A credential goes on\nafter the decision, in the header the grant names.\n\nWhat comes back is data: scanned as a write is, held for the owner when it\ncarries instructions, else kept under `.sources/` at the tool\u0027s results label,\nserved with `cite_as: source:\u003cid\u003e` and `observed_by: tap`, answered from the\nsource when the same call comes again, and swept on the transcript clock unless\na live entry cites it. `amem source list|show|sweep`.\n\nThe guest components, tap-fetch (redirects, HTML to text, a size cap) and\ntap-search (Brave\u0027s and SearXNG\u0027s answers), live in taps/. Tested: the policy\u0027s\nreach, labels, and hard rules; inward addresses; live, an apache.org page fetched,\nkept and served again from its source, and a host off the grant, plain http and\nthe metadata address refused before leaving. Not tested: search against a live\nprovider, and the tools end to end against a fake site.\n\nAlso: act 5 replays the newest session whose calls went to the gateway, since a\nreplay changes only the model and Claude\u0027s session went to Anthropic.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "ef74f3aedd0f6b732db446e333745741f043fb7b", "tree": "ea2c2bfd58a6d5b6dedce7ba45b6b3a39666bbe9", "parents": [ "3256a7641d75000f78035ce347a66e33ab6bdda7" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 02:29:22 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 02:29:22 2026 +0200" }, "message": "get on a moved entry redirects to its current version, in one hop\n\nA list or a search can always offer an entry a curation replaces a moment later.\nThe reader\u0027s get then said \"not found\", and the demo\u0027s act 3 died on exactly\nthat. Now a replaced entry answers as an HTTP 301: `moved`, with the location\nof its current version. The location is the end of the chain of successors,\nthe newest active one the reader may read, resolved by the index in one\nrecursive query, so a reader makes one more round trip however many times the\nentry was replaced. A demoted or erased entry, or one replaced by nothing the\nreader may read, answers `gone`, as a 410. Both are said only about an entry\nthe reader could read; anything else stays \"not found\".\n\n`Memory::get_following` follows the redirect through the same checks as any\nread, and again only if the current version was itself replaced in between, a\nrace that costs another round trip, at most eight. The MCP get tool and `amem\nget` use it, and report `redirected_from` so a reader cites what it read.\n\nTests: one redirect to the end of a two-hop chain, gone after erasure, the MCP\ntool reading the successor with redirected_from. Five tests that expected \"not\nfound\" for a replaced, demoted or erased entry now expect moved or gone.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "3256a7641d75000f78035ce347a66e33ab6bdda7", "tree": "ff20e813de3adc908515c429a6aed749de9b6317", "parents": [ "73c163ac4d7b285466b012bbc018a2086532dc10" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 02:20:18 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 02:20:18 2026 +0200" }, "message": "A replaced entry leaves list and search, not only get\n\nThe demo\u0027s second rehearsal stopped in act 3: it listed decisions, picked one,\nand an agent\u0027s get on it said not found. The librarian had replaced that entry\nin act 2. The store marks a replaced entry superseded as it writes the new one,\nbut since the perimeter\u0027s gate (8b0ed57) the write path indexed the copy the\ngate had read before that, still active, so list and search went on serving an\nentry get refused. Releasing a held rewrite from the quarantine never indexed\nthe replaced entry at all, and neither did a bundle\u0027s import.\n\nAll three now index the replaced entry as the store holds it, the write path\nand the release through one helper. Two tests, each failing on the old code:\na replaced entry is gone from list and search, and a released rewrite takes the\nentry it replaced out of list. A record written before this keeps its stale\nrows until `amem reindex`.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "73c163ac4d7b285466b012bbc018a2086532dc10", "tree": "fbe0947e675b4db07f1fa46e9a1ff3efdf76727e", "parents": [ "5ae8674b297b68a820b1eda9a4133771ac7b86b8" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 02:16:37 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 02:16:37 2026 +0200" }, "message": "docs: proposals for llm.apache.org, each from its motivation\n\nllmao is an Apache project and these go to it as pull requests, so each now\nsays what goes wrong without it and what the Foundation gets, and names the\nopen standard it rests on, so the gateway\u0027s surface stays llmao\u0027s own with\nLiteLLM behind it: one trace from a task to a model\u0027s answer (Trace Context,\nBaggage, the GenAI conventions, a request id back); sessions a gateway can tell\napart (a session id now, a token by exchange later, which a hosted memory\nserver waits for; limits per key); a model list that tells the truth (health,\nversions, logprobs); harness compatibility fixed once in the gateway; and what\nthe gateway\u0027s tool registry needs to hold.\n\nChecked against llmao at 266122c, which already has drop_params, budgets per\nproject and a health roll-up; the effort mismatch survives drop_params, since\nthe parameter is supported and its value refused.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "5ae8674b297b68a820b1eda9a4133771ac7b86b8", "tree": "be7c71b3a39a949ffa8c3dbaf2178fcda8befd21", "parents": [ "b95782ddaa92bacd86e91162bdcca8eccf8413f5" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 02:11:50 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 02:11:50 2026 +0200" }, "message": "What the fresh-record rehearsal of 11 October found, fixed\n\nThe whole demo ran on a fresh record with Claude, exit 0, act 6 at 4/4 with\nmemory against 0/4 empty. Four things read wrong on stage:\n\n- Act 3\u0027s spend limit refused nothing: on a fresh record the checker\u0027s six calls\n came to 1,432 tokens, under the act\u0027s 1,500. The limit is now 400, which the\n third call crosses, and the decision-log line picks the spend decision rather\n than whatever was logged last. Rerun: refused at 434 of 400.\n- Act 4 showed an empty queue and a rescore that never moved the blocker, since\n rank moves along the edge at admission now. The act prints the queue after\n admission: the blocker at 9, above the task it blocks at 8.\n- Act 2\u0027s librarian rewrote, and the act then verified, \"AD-NN — \u003cthe decision\n in one line\u003e\": the seed took the decisions directory\u0027s TEMPLATE.md for a\n decision. The seeder skips templates as it skips READMEs.\n- Act 5\u0027s replay said the recorded side was a self-report under a line saying\n the egress observed it. The caption now follows `observed_by`.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "b95782ddaa92bacd86e91162bdcca8eccf8413f5", "tree": "309e77d3d9dd27dbf355b891074a0d7013b0d2cc", "parents": [ "f13a5c0d19ba04b54b261f7f040f7e3fc42dcf8e" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 01:52:08 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 01:52:08 2026 +0200" }, "message": "docs: the Gemini route on llm.apache.org is deployed; only its model list is not\n\ngenerateContent through /v1beta answered 200 on gemma4-26b and qwen3.8-27b; the\nearlier probe hit only GET /v1beta/models, which answers 404. The ask shrinks to\nrouting that list.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "f13a5c0d19ba04b54b261f7f040f7e3fc42dcf8e", "tree": "af1db1826c4a9fd20cec4070c0f25891c2548f61", "parents": [ "751ce1ec2f965b437ac1748be0dd425077fd4c5b" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 01:51:08 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 01:51:08 2026 +0200" }, "message": "docs: what we would ask of llm.apache.org, hosted MCP servers included\n\nThe asks found building against the gateway, each with the workaround it would\nretire: LiteLLM features to switch on (drop_params, budgets per key, health\nchecks, request tags, OpenTelemetry with traceparent, logprobs), configuration\nand upstream fixes (the /v1beta route, the Gemini adapter, trailing system\nmessages, versioned model names), the vendor-side tools that silently do nothing\non open models (Codex offered web_search on 56 recorded requests, none ran), and\nwhat hosted MCP servers would need: access per key and tool, pinned tool\ndefinitions, a label on results, acting as the person, the same tags and trace,\nand why the memory server itself stays per session for now. Linked from the\nREADME.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "751ce1ec2f965b437ac1748be0dd425077fd4c5b", "tree": "e9ec424d8f7dfc00caa12cabc217343d82d6ee4b", "parents": [ "9c1a0ced27489bec306c3e9c67bd4d63b21eda65" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 01:46:15 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 01:46:15 2026 +0200" }, "message": "observed_by on every record of what a session did: harness or egress\n\nA transcript, a turn read by citation, and an excerpt now say `observed_by:\nharness`, the harness\u0027s own account; a decision context says `egress`, which\nevery model call passes through; a replay run says which it replayed. Records\nkept before this read back with the same defaults, so nothing is migrated. The\nwords match `amem usage`\u0027s source column. Act 5\u0027s replay line names the observer.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "9c1a0ced27489bec306c3e9c67bd4d63b21eda65", "tree": "97ee6d33fe8f18d818b79f3864547c55f87c9eeb", "parents": [ "b7254172dcf50919748eded8fa8e7204eef91e14" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 01:41:35 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 01:41:35 2026 +0200" }, "message": "Transcripts keep why: reasoning folded into the turn it led to, withheld reasoning said\n\nA Claude Code transcript showed a bare \"Thinking\" before each decision: headless,\nClaude Code omits its thinking and records a signature alone. The launcher now\nasks for summaries, `showThinkingSummaries` in the private home\u0027s settings and\n`--thinking-display summarized` on headless runs, checked live: the thinking\nblock came back empty without the flag and with its summary with it. Codex gets\n`show_raw_agent_reasoning`, which keeps an open model\u0027s raw reasoning.\n\nThe transcript parser folds reasoning into the assistant turn it came before:\n`[reasoning]` with the text, `(summarised)` for a summary, and \"[reasoning\nwithheld by the provider]\" where there is only a signature, redacted thinking or\nencrypted content. Gemini\u0027s thought parts are labelled in place. Reasoning adds\nno turn, so citations number the same. The work prompt asks the agent to say in\none plain sentence why before each decision that changes something, and its\nhandoff to say why, for providers that withhold everything.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "b7254172dcf50919748eded8fa8e7204eef91e14", "tree": "a101ce798aeb5e6e67f9ad4510e769f3c05edef6", "parents": [ "ab60475690a636d01980113e2d66673f2b3e37d3" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 01:32:46 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 01:32:46 2026 +0200" }, "message": "README: rewritten past its first section against the code as it is\n\nThe proof-of-concept section and its two lists stay, act 7 reads them, with cost\nadded to what works only at demo scale. After it: what the system is, the two\nhalves and the egress, a diagram of today\u0027s shape, the root\u0027s files; build and\nrun; each part with its commands; the demo in its seven acts; what the\npre-commit gate runs; the layout with every crate; and the status as of 11\nOctober. The old text had the index and ledger in one SQLite file, no egress,\npolicy or librarian, and a status from M0.\n\nlocal/README.md gains a section on prices.toml and amem cost. Replay\u0027s help and\nact 5\u0027s caption now say it replays the egress\u0027s recorded contexts, with the\ntranscript only as a fallback.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "ab60475690a636d01980113e2d66673f2b3e37d3", "tree": "f073aa25bf7f169ac4f39512fb67870c6e7aaff2", "parents": [ "2d1e51b465698b9e0b646cdfaefd2d9c498dacb7" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 01:28:07 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sun Oct 11 01:28:07 2026 +0200" }, "message": "amem cost: a price table, cost per session and per completed task, plan quota apart\n\nEvery usage row now records its billing: metered, on a key or gateway the\nlauncher holds, or plan, on the harness\u0027s own login (a destination that passes\nthe harness\u0027s credential through, a tunnel, or a harness\u0027s own report). Older\nrows are migrated as metered, except harness reports and tunnels.\n\nprices.toml under the root, written as a template by `amem init`, prices each\nmodel in US dollars per million tokens, input, output, cache reads and cache\nwrites apart, matched by name or longest prefix. `amem cost [--json]` gives\neach session\u0027s metered spend on priced models, with unpriced models and plan\nquota shown as tokens beside it, and each completed task\u0027s cost: the session\nthat wrote its closing handoff, shared among the tasks that session completed.\nNothing is guessed: a model the table does not name is shown unpriced.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "2d1e51b465698b9e0b646cdfaefd2d9c498dacb7", "tree": "9a5e41e5e9de2eaebc63075a757afe6439819c7f", "parents": [ "36cfa8934c80ba2840a2c5cbcfc1ad52d42287fe" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 21:58:49 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 21:58:49 2026 +0200" }, "message": "docs: decision contexts and replay on them; tunnelled runs fall back to the transcript\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "36cfa8934c80ba2840a2c5cbcfc1ad52d42287fe", "tree": "0fd4faa0c44f1f2e64f12c9d08fb403faa8037bd", "parents": [ "c8501b976d7307d95addad271a721e3c799ceede" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 21:57:21 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 21:57:21 2026 +0200" }, "message": "Replay reads recorded contexts properly: tools and text in every provider\u0027s shape\n\nThe live replay of a Codex session\u0027s recorded contexts scored zero on both\nmodels, which the model that made the decisions cannot honestly score. Two\nreading bugs: tool calls were found by scanning text after a marker, and the\nResponses API puts a call\u0027s name before its type, so the scan took the next\nitem\u0027s name; and the answer\u0027s text was read in the chat shape only, so a\nResponses API answer was empty. Tool calls and text are now read by walking the\nJSON, a whole answer or each streamed event, in Anthropic\u0027s, chat completions\u0027,\nthe Responses API\u0027s and Gemini\u0027s shapes, and replay reads the recorded side\nagain from the kept raw response.\n\nLive on that session through the gateway: qwen3.8-27b replaying its own\ncontexts agrees at every point, 4 of 4; gemma4-26b agrees at 2 of 4, answering\nearly where the recording opened another entry.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "c8501b976d7307d95addad271a721e3c799ceede", "tree": "aa2dd1202e6cf18ceb338376b4bb31f59867c6fc", "parents": [ "f04ab616b99b54c8c83197106f97dd28a3acc18d" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 21:41:28 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 21:41:28 2026 +0200" }, "message": "Decision contexts recorded at the egress; replay uses them, not the transcript\n\nThe paper\u0027s replay uses recorded decision contexts, not transcripts: a\ntranscript is the harness\u0027s own account, which an agent could shape and a\nharness may leave incomplete. The egress is in the path of every metered model\ncall, so it now keeps each one\u0027s context, the request exactly as it left and\nthe response as it came back, with the tools the model asked for, beside the\nsession\u0027s domain\u0027s entries at the session\u0027s label: never indexed, readable by\nthe owner alone, swept on the transcripts\u0027 clock. A context carries every entry\nbody the session had read, so erasing an entry removes the contexts that carry\nits text and lists them on the receipt.\n\n`amem replay` now sends a recorded request again, to the same destination and\npath with only the model changed and the answer unstreamed, and compares the\ntools the candidate asks for with the tools the upstream returned; a session\nfrom before contexts were kept falls back to its transcript, and the run says\nwhich it used.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "f04ab616b99b54c8c83197106f97dd28a3acc18d", "tree": "192f2dc1b1e1388f5539dc5eea6eb44e508a7d97", "parents": [ "31823ade4a7d658aeacc89836b9c80411b745523" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 21:34:16 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 21:34:16 2026 +0200" }, "message": "egress: a spend refusal says only why, not that the destination is unavailable\n\nThe checker\u0027s refusal over a spend limit read \"... its limit is 1500 is not\navailable to this session\": a spend refusal is its own error now, its message\nthe policy\u0027s reason.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "31823ade4a7d658aeacc89836b9c80411b745523", "tree": "33c704f3a41d92bc7f2497b9ed9961a631ac1fc3", "parents": [ "c5001340320584ad4478c0809a643348ef9259ea" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 21:25:14 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 21:25:14 2026 +0200" }, "message": "Prefetch at fetch time, drift on a schedule, inflation per creator, a transcript tool\n\n`get` over MCP carries `read_with`: the summaries of at most two entries the\nread log shows searched up with it at least three times, under the session\u0027s\nfilter, logged as a read, the paper\u0027s rule 4. `amem curate --drift` probes the\nchecker\u0027s model each cycle against its first run and files confirmed drift.\n`amem task stats` counts, per creator, filings held back for requirements the\ncreator does not hold, and the librarian\u0027s telemetry alarms at three. Agents\nfollow a citation by turn with the `transcript_turn` MCP tool.\n\nThe README\u0027s lists move accordingly: spend limits are built, replay is built in\nits first mode with the self-report caveat, drift runs on a schedule. The\ndemo\u0027s act 3 shows a spend limit refusing the checker partway, and act 5\nreplays a kept transcript on the worker model.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "c5001340320584ad4478c0809a643348ef9259ea", "tree": "b8f764a16b54e82e992eeef814e025beaf85eab9", "parents": [ "17418e3d836b430ef1a100b1c602658421b4d52f" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 21:18:42 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 21:18:42 2026 +0200" }, "message": "Spend limits at the egress, frozen-context replay, and Codex\u0027s tool calls in its transcript\n\nSpend limits per resource class: `[spend.\u003cdestination\u003e]` in grants.toml sets\ntokens per session and per day for the root; a `spend` rule in the Rego\ndecides, so a record policy may add limits. The egress asks before every model\ncall, on its own calls and on a harness\u0027s POSTs through the proxy, with what it\nhas metered; over a limit the call does not leave, refused as a permission\nerror with the reason, which a harness does not retry, and the refusal is a\nlogged decision.\n\n`amem replay \u003csession\u003e` presents a kept transcript\u0027s decision points again to\na model through the egress and scores its next step against the recorded one:\nthe same tool, or a reply that overlaps. The owner\u0027s alone, while the\ntranscript is live; each run is logged with digests of the context and the\nprompt. The recorded side here is the harness\u0027s own transcript, a\nself-report; the egress\u0027s record of what the model was sent is the stronger\ncontext, and is not yet kept. Live on the rehearsal\u0027s sessions, the gateway\u0027s\nQwen agreed with Claude\u0027s recorded steps from 0.25 to 0.75.\n\nCodex\u0027s rollout records tool calls as function_call items the transcript\nparser dropped, so a Codex transcript said what the agent wrote but not what\nit did; each call is now a turn, `[used tool mcp__memory__get]`, as Claude\nCode\u0027s are.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "17418e3d836b430ef1a100b1c602658421b4d52f", "tree": "731babc7683d341176ff2878e23ecacf023525c5", "parents": [ "df5794a76c944a25d225ed7c6b8696b007be9f15" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 20:46:05 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 20:46:05 2026 +0200" }, "message": "Two things the acts 1 and 4 rehearsal found: a broadcast false positive, and a report that never completed\n\nAct 1\u0027s Claude session wrote a correct, cited answer about DR-19 and had it\nquarantined twice as a broadcast: \"on the request path for every model call\"\nmatched the scan\u0027s address to agents. A broadcast addresses agents as its\nreaders; the pattern now wants an addressing word and an agent noun, \"To all\nagents\", \"Note to other agents\", \"Other agents should\", and no longer takes\nmodels, sessions or a bare \"for\". That sentence is now a test that must pass,\nbeside the broadcasts that must still be caught. Claude stopped rather than\nreword around the filter and left the decision to the owner, as it should.\n\nAct 4\u0027s subagent tasks ran, but Codex followed the subagent prompt Claude had\nwritten, report back and write nothing, so the launcher released them and the\ncontinuation waited for ever. A delegated task\u0027s deliverable is its report, as\na subagent\u0027s is to the session that spawned it: a board-filed task that ends\ncleanly with output is now completed with its report as handoff. The act says\nwhat the continuation still waits for instead of a heading over nothing.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "df5794a76c944a25d225ed7c6b8696b007be9f15", "tree": "e8c1e82534038e7fbf396e60a8d2440b5dd670f1", "parents": [ "4d9e8aa659bbbf1ca978cd0989f48a132febbc28" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 20:13:14 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 20:13:14 2026 +0200" }, "message": "Workers only claim: rank moves along edges at admission and in triage\u0027s cycle\n\nThe last commit had `amem work` rescore the domain before each claim, which\nlet any worker rebalance the queue, many times a cycle. The paper has it\notherwise: automatic re-ranks are the ledger\u0027s own appends, rubric-wide\nrescoring runs once per triage cycle, and the manual rescore is a gated\noverride. So the worker\u0027s rescore is gone; when a task is admitted, the\nledger raises the open tasks it waits on, transitively, to its rank plus the\nunblock weight, each a `rescored` event naming the task served; a proposed\ntask moves nothing until triage admits it; and a session holding a task files\nno higher than that task, so delegated work cannot outrank what it serves.\nThe cycle\u0027s rescore and the owner\u0027s `amem task rescore` are unchanged, and no\nMCP tool reaches them.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "4d9e8aa659bbbf1ca978cd0989f48a132febbc28", "tree": "85f9e4fb11a2ad597094e6a761a28cea9283a8c8", "parents": [ "6f4743078b94183eb8dc145d3250e25b5cd56577" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 20:05:49 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 20:05:49 2026 +0200" }, "message": "The proof of concept says what it is not; claims follow the top task\u0027s contributions\n\nThe README\u0027s first section names what the paper asks for that is not built\nand what is built but works only at demo scale, each with what replaces it;\nthe demo ends with act 7, printing both lists from the README.\n\n`amem work` rescores its domain before each claim, so a worker takes the\nhighest-ranked task it can do: what blocks or was filed for the top task has\nrisen to it, and the manifest decides what is claimable. `--task \u003cid\u003e` works\none named task; the acts use it, and act 4 runs the subagents\u0027 tasks and the\ncontinuation that waited for both. Act 5 shows a kept transcript and a cited\nturn, and summarises drift with a simulated repoint.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "6f4743078b94183eb8dc145d3250e25b5cd56577", "tree": "78755dd192cdf04424f71c0ce1ec219e91c567d1", "parents": [ "8a4680e9bd7bc2b11a4244794405655255cb9ed4" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 19:45:31 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 19:45:31 2026 +0200" }, "message": "Merge transcripts as sources, and fold a run\u0027s delegations into one continuation\n\nTranscripts are kept in the record as sources, not entries, reached only by\ncitation by turn, and expire into excerpts of the entries that cite them\n(feat/transcripts). The merge gives its policy input the held task.\n\nThe rehearsal\u0027s Claude session delegated twice, one Agent call per subagent,\nand the board filed a continuation per call; the session itself noticed and\nfiled one continuation for both. The fan-out now does that: an open\ncontinuation of the same parent is folded into the new one, which waits for\nevery subagent of the run, and the old one is closed as superseded by it,\nits child left open. Act 5 summarises the drift checks and shows a repoint.\n\nLinearized from a merge: this commit carries what the merge resolved.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "8a4680e9bd7bc2b11a4244794405655255cb9ed4", "tree": "91c32b56c708591a2c627a80df5f423cf3bfb17c", "parents": [ "1760289c02afcb082b3d2b61fc212a3a908c250d" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 18:30:21 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 18:30:21 2026 +0200" }, "message": "Transcripts are sources in the record, reached by citation, and expire\n\nAt session end the launcher keeps the harness\u0027s transcript under the record, in the\nsession\u0027s domain, as a source beside the entries: record/\u003cdomain\u003e/.transcripts/\n\u003csession\u003e.json (header and numbered turns) and .jsonl (the harness\u0027s lines). It is\nnever indexed, never in T0, and no search, list or recall returns it. It carries the\nharness, the session\u0027s label at the end (at least the domain default) as its\nclassification, and a retain_until from the domain\u0027s transcript_retention_days in\ngrants.toml (30 when unset).\n\nThe hook\u0027s handoff and mined entries cite the turns they were drawn from as\ntranscript:\u003csession\u003e#\u003cturn\u003e (runs as #a-b). Memory::transcript_turn and\n`amem transcript show \u003csession\u003e [--turn N]` serve a turn only when an entry the reader\nmay read cites it, under the read filter, raising the label as a get does.\n\n`amem transcript sweep`, also run by the curation cycle\u0027s owner pass, drops expired\ntranscripts: cited turns become excerpts of each citing live entry, carrying the\nturn\u0027s classification, the rest is dropped, and state/transcripts.jsonl records the\nsession, the turns kept and dropped, and when. An excerpt is served only while its\nentry is, is erased with it (on the entry\u0027s receipt), and is exported beside it.\n`amem transcript erase` is the owner\u0027s early erasure: a stub, a receipt, and the\nciting entries flagged. `amem savings` counts the record\u0027s live transcripts.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "1760289c02afcb082b3d2b61fc212a3a908c250d", "tree": "3567d5701fabaaae6ca36c07363f9a8b945353b9", "parents": [ "284e64f3703ba2f0ffec0d331bec35064604c7e0" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 18:34:54 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 18:34:54 2026 +0200" }, "message": "docs: the trust tiers, policy as memory, the task fabric, prefetch and the read metrics, vendor drift, and the demo in acts\n\nmake demo-all plays the demo\u0027s acts on one record.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "284e64f3703ba2f0ffec0d331bec35064604c7e0", "tree": "9e9a281b532854efd07f321483f2d76fa94c0cf1", "parents": [ "ea5997706c87585d63364689b5327a1a41aef825" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 18:30:31 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 18:30:31 2026 +0200" }, "message": "Merge prefetch on claim and the paper\u0027s read metrics in amem savings\n\nThe read log keeps both the reader\u0027s author and the prefetch tool.\n\nLinearized from a merge: this commit carries what the merge resolved.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "ea5997706c87585d63364689b5327a1a41aef825", "tree": "37f811723d8b448a9d182e70f8ba3942166691a0", "parents": [ "c9da4ebf2424bf27cca2fc72fe5c8ca2046cee9f" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 17:43:35 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 17:43:35 2026 +0200" }, "message": "Prefetch on claim, and the paper\u0027s four retrieval metrics in savings\n\n`amem work` now puts the summaries of the entries a claimed task likely\nneeds in its prompt: the top five hits of a search on the task\u0027s title\nand body, then entries the read log says are retrieved with them (pairs\nseen together in at least three searches, counted as the librarian\ncounts them), at most eight and inside a 600-token budget. The search\nand the partner lookups both run under the session\u0027s compiled read\nfilter, so a narrowed policy narrows the prefetch too; it raises the\nsession label like a search and is logged as one `prefetch` read for\nthe session the harness runs under. `--no-prefetch` leaves it out, for\nthe eval\u0027s no-memory comparisons.\n\n`amem savings` gains a Metrics section, text and JSON, per session and\nin total: fetch-through rate, retrieval depth per completed task,\nprefetch precision and the wasted-read ratio, from the read and write\nlogs. \"Used\" is cited by id in the session\u0027s handoff, not the paper\u0027s\nsampled model judge; the report says so.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "c9da4ebf2424bf27cca2fc72fe5c8ca2046cee9f", "tree": "913e6f1c8668b0fdf678fa4f33ba15d0e3f214e0", "parents": [ "f4f61b348095903371c73657d697149e89a50905" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 18:27:35 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 18:27:35 2026 +0200" }, "message": "Merge vendor-drift detection: amem drift probe and check\n\nThe stdio serve command moves into its own function to keep the dispatch\ninside the line limit with drift\u0027s arm added.\n\nLinearized from a merge: this commit carries what the merge resolved.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "f4f61b348095903371c73657d697149e89a50905", "tree": "1c466eccc7447e5a4c0f9e1983273161ef2bb9ce", "parents": [ "d5c31aae1e538a1cb4c1e46dbbb46db209ac7724" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 18:04:39 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 18:04:39 2026 +0200" }, "message": "amem drift: the vendor-drift probe battery, pinned on our side\n\n`amem drift probe` runs a pinned probe set (probes/drift.toml: four temperature-0\nfingerprints, two format probes, two refusal-boundary probes) through the egress\nagainst one destination and model, each probe --repeat times, and appends the run to\nstate/drift/\u003cdestination\u003e/\u003cmodel\u003e.jsonl: per answer its digest, length, input and\noutput tokens as the provider reported them, latency, the reported model,\nsystem_fingerprint, finish reason, and whether a format probe matched or a refusal\nprobe refused. The run records what our side pinned: the amem version, the probe\nset\u0027s digest, and the request shape (path, temperature, max tokens per probe).\nRequests carry temperature 0 and a token limit through model::request_sampled; what\nmining, the checker and the deputy send is unchanged.\n\n`amem drift check` compares the latest run with a baseline run, first checking\nwhether our pinned side changed (then it is not vendor drift), then per detector:\ninput tokens for identical prompts, a new reported model or fingerprint, the answer\nflip rate above the baseline\u0027s own within-run flip rate plus a margin, format probes\nthat stop passing, refusals that change, and median latency (reported only).\n--baseline-model compares one model\u0027s run with another\u0027s baseline, which is how a\nrepoint behind a fixed alias looks when the destination will not do one. --file files\nconfirmed drift as one owner\u0027s task with the evidence and the paper\u0027s playbook.\n\n`make drift MODEL\u003d...` runs both through the gateway.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "d5c31aae1e538a1cb4c1e46dbbb46db209ac7724", "tree": "a9f7aa6e639c875739084f06d55828f03b5c542f", "parents": [ "0064ff6ecec16450b286e2fe1e70811d6c05cc84" ], "author": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 18:21:04 2026 +0200" }, "committer": { "name": "Sander Striker", "email": "striker@apache.org", "time": "Sat Oct 10 18:21:04 2026 +0200" }, "message": "The demo in acts, and what rehearsing them found\n\nscripts/demo-all.sh plays the demo act by act on one record, ACTS choosing:\nthe read path (scripts/demo.sh), then scripts/demo/2-curation.sh (a curation\ncycle, a librarian run landing curated, verified proposed by an agent and\napproved by a person, the gate on the tier, the librarians\u0027 telemetry),\n3-perimeter.sh (a rogue broadcast quarantined, the reader\u0027s verdicts, taint,\na rule as a policy entry inert until verified then enforced and cited, a\nscoped exception, the digest in T0, the lint\u0027s rates, and a root policy\nnarrowing an agent\u0027s reads), 4-fabric.sh (an L1 rubric, the rescore along the\nedges, subagents on the board with a named harness, the fabric\u0027s telemetry),\n5-observe.sh (spans to a loopback collector, and the read metrics, drift and\ntranscripts where the build has them) and 6-eval.sh (memory against none).\nscripts/demo/mcp.py speaks to `amem serve` as an agent, several calls to a\nsession.\n\nFound rehearsing them: `amem serve` now honours MEMORY_TASK, as the\nlauncher\u0027s in-process server does; the read log records who read, and the\nrelay alarm counts only agents reading another agent\u0027s entry, not the owner;\nthe write-rate alarm is for agents, not an owner seeding the record; and\ncuration\u0027s floor promotes curation an agent can do, never an owner\u0027s alarm.\n\nCo-Authored-By: Claude Opus 5.5 \u003cnoreply@anthropic.com\u003e\n" } ], "next": "0064ff6ecec16450b286e2fe1e70811d6c05cc84" }